From 474402246adf049a7093a29e91fa7c8d2d48b981 Mon Sep 17 00:00:00 2001
From: Cobalt <cobalt@cobalt.rocks>
Date: Wed, 11 Mar 2026 02:48:35 +0100
Subject: [PATCH] harfbuzz: 12.3.0 -> 13.2.1

---
 .../harfbuzz/disable-check-symbols-test.patch | 13 +++++++
 pkgs/by-name/ha/harfbuzz/package.nix          | 34 +++++++++++--------
 2 files changed, 32 insertions(+), 15 deletions(-)
 create mode 100644 pkgs/by-name/ha/harfbuzz/disable-check-symbols-test.patch

diff --git a/pkgs/by-name/ha/harfbuzz/disable-check-symbols-test.patch b/pkgs/by-name/ha/harfbuzz/disable-check-symbols-test.patch
new file mode 100644
index 000000000000..34b2daea8fa7
--- /dev/null
+++ b/pkgs/by-name/ha/harfbuzz/disable-check-symbols-test.patch
@@ -0,0 +1,13 @@
+diff --git c/src/meson.build i/src/meson.build
+index a92e46fe2..3514ae85b 100644
+--- c/src/meson.build
++++ i/src/meson.build
+@@ -1238,7 +1238,7 @@ if get_option('tests').enabled()
+   env.set('HBHEADERS', ' '.join(HBHEADERS))
+ 
+   if cpp.get_argument_syntax() != 'msvc' and not meson.is_cross_build() # ensure the local tools are usable
+-    dist_check_script += ['check-static-inits', 'check-symbols']
++    dist_check_script += ['check-static-inits']
+     if get_option('wasm').disabled() and not get_option('with_libstdcxx')
+       dist_check_script += ['check-libstdc++']
+     endif
diff --git a/pkgs/by-name/ha/harfbuzz/package.nix b/pkgs/by-name/ha/harfbuzz/package.nix
index cebf23db0247..1f81a812a7f5 100644
--- a/pkgs/by-name/ha/harfbuzz/package.nix
+++ b/pkgs/by-name/ha/harfbuzz/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   pkg-config,
   glib,
   freetype,
@@ -14,6 +13,9 @@
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
+  withRaster ? false,
+  withCairo ? false,
+  cairo,
   icu,
   graphite2,
   harfbuzz, # The icu variant uses and propagates the non-icu one.
@@ -35,21 +37,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "harfbuzz${lib.optionalString withIcu "-icu"}";
-  version = "12.3.0";
+  version = "13.2.1";
 
   src = fetchurl {
     url = "https://github.com/harfbuzz/harfbuzz/releases/download/${finalAttrs.version}/harfbuzz-${finalAttrs.version}.tar.xz";
-    hash = "sha256-hmDr08J9lAf8hDO10XK6+6XwMXywu0M58o5TcMk9Qrc=";
+    hash = "sha256-ZpXaPrfhvgqjCS/k2BQzoztH9FGSWcdZ1ynjqaVcFCk=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
-      name = "CVE-2026-22693.patch";
-      url = "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch";
-      hash = "sha256-mdgIhp1ndPSfzplBRB7s+BN2T5Z9dEYZ0bAmSDCUPSE=";
-    })
-  ];
+  # This test fails reliably when executed through mesonCheckPhase but passes with
+  # a direct 'meson test' checkPhase, the validated symbols are fine but msan is not happy
+  # skipping this for now as it is not relevant for the packaging
+  patches = [ ./disable-check-symbols-test.patch ];
 
   postPatch = ''
     patchShebangs src/*.py test
@@ -69,10 +67,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   mesonFlags = [
     # upstream recommends cairo, but it is only used for development purposes
-    # and is not part of the library.
+    # and hb-raster and is not part of the main library.
     # Cairo causes transitive (build) dependencies on various X11 or other
     # GUI-related libraries, so it shouldn't be re-added lightly.
-    (lib.mesonEnable "cairo" false)
+    (lib.mesonEnable "cairo" withCairo)
+    (lib.mesonEnable "raster" withRaster)
     # chafa is only used in a development utility, not in the library
     (lib.mesonEnable "chafa" false)
     (lib.mesonEnable "coretext" withCoreText)
@@ -97,7 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     docbook-xsl-nons
     docbook_xml_dtd_43
   ]
-  ++ lib.optional withIntrospection gobject-introspection;
+  ++ lib.optional withIntrospection gobject-introspection
+  ++ lib.optional withCairo cairo;
 
   buildInputs = [
     glib
@@ -147,6 +147,10 @@ stdenv.mkDerivation (finalAttrs: {
       "harfbuzz"
       "harfbuzz-gobject"
       "harfbuzz-subset"
-    ];
+      "harfbuzz-vector"
+    ]
+    ++ (lib.optional withIcu "harfbuzz-icu")
+    ++ (lib.optional withRaster "harfbuzz-raster")
+    ++ (lib.optional withCairo "harfbuzz-cairo");
   };
 })