From c18b3dbb0aff47b5f6915671712fd65dd865d55f Mon Sep 17 00:00:00 2001
From: qubitnano <146656568+qubitnano@users.noreply.github.com>
Date: Mon, 22 Dec 2025 17:53:24 -0500
Subject: [PATCH 1/2] mongodb: modernize

---
 pkgs/servers/nosql/mongodb/7.0.nix     |  2 +-
 pkgs/servers/nosql/mongodb/mongodb.nix | 31 +++++++++++++-------------
 2 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/pkgs/servers/nosql/mongodb/7.0.nix b/pkgs/servers/nosql/mongodb/7.0.nix
index e1185c9165c1..fc2d3be3fa97 100644
--- a/pkgs/servers/nosql/mongodb/7.0.nix
+++ b/pkgs/servers/nosql/mongodb/7.0.nix
@@ -22,7 +22,7 @@ in
 buildMongoDB {
   inherit avxSupport;
   version = "7.0.26";
-  sha256 = "sha256-731rmMz5C2cmOVKRWmT439uiRUW3kWQCz2/l/Ffk9zI=";
+  hash = "sha256-731rmMz5C2cmOVKRWmT439uiRUW3kWQCz2/l/Ffk9zI=";
   patches = [
     # ModuleNotFoundError: No module named 'mongo_tooling_metrics':
     # NameError: name 'SConsToolingMetrics' is not defined:
diff --git a/pkgs/servers/nosql/mongodb/mongodb.nix b/pkgs/servers/nosql/mongodb/mongodb.nix
index ca90935250ff..84a4a0f5e7bb 100644
--- a/pkgs/servers/nosql/mongodb/mongodb.nix
+++ b/pkgs/servers/nosql/mongodb/mongodb.nix
@@ -16,6 +16,7 @@
   curl,
   cctools,
   xz,
+  versionCheckHook,
 }:
 
 # Note:
@@ -24,7 +25,7 @@
 
 {
   version,
-  sha256,
+  hash,
   patches ? [ ],
   license ? lib.licenses.sspl,
   avxSupport ? stdenv.hostPlatform.avxSupport,
@@ -60,15 +61,15 @@ let
   inherit (lib) systems subtractLists;
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   inherit version passthru;
   pname = "mongodb";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo";
-    rev = "r${version}";
-    inherit sha256;
+    tag = "r${finalAttrs.version}";
+    inherit hash;
   };
 
   nativeBuildInputs = [
@@ -87,13 +88,13 @@ stdenv.mkDerivation rec {
     openldap
     sasl
     snappy
+    xz
     zlib
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     cctools
   ]
-  ++ lib.optional stdenv.hostPlatform.isLinux net-snmp
-  ++ [ xz ];
+  ++ lib.optional stdenv.hostPlatform.isLinux net-snmp;
 
   # MongoDB keeps track of its build parameters, which tricks nix into
   # keeping dependencies to build inputs in the final output.
@@ -103,14 +104,14 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # fix environment variable reading
     substituteInPlace SConstruct \
-        --replace "env = Environment(" "env = Environment(ENV = os.environ,"
+        --replace-fail "env = Environment(" "env = Environment(ENV = os.environ,"
   ''
   + ''
     # Fix debug gcc 11 and clang 12 builds on Fedora
     # https://github.com/mongodb/mongo/commit/e78b2bf6eaa0c43bd76dbb841add167b443d2bb0.patch
-    substituteInPlace src/mongo/db/query/plan_summary_stats.h --replace '#include <string>' '#include <optional>
+    substituteInPlace src/mongo/db/query/plan_summary_stats.h --replace-fail '#include <string>' '#include <optional>
     #include <string>'
-    substituteInPlace src/mongo/db/exec/plan_stats.h --replace '#include <string>' '#include <optional>
+    substituteInPlace src/mongo/db/exec/plan_stats.h --replace-fail '#include <string>' '#include <optional>
     #include <string>'
   ''
   + lib.optionalString (!avxSupport) ''
@@ -130,7 +131,7 @@ stdenv.mkDerivation rec {
     "--disable-warnings-as-errors"
     "VARIANT_DIR=nixos" # Needed so we don't produce argument lists that are too long for gcc / ld
     "--link-model=static"
-    "MONGO_VERSION=${version}"
+    "MONGO_VERSION=${finalAttrs.version}"
   ]
   ++ map (lib: "--use-system-${lib}") system-libraries;
 
@@ -157,11 +158,9 @@ stdenv.mkDerivation rec {
   '';
 
   doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-    "$out/bin/mongo" --version
-    runHook postInstallCheck
-  '';
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/mongo";
+  versionCheckProgramArg = "--version";
 
   installTargets = "install-devcore";
 
@@ -179,4 +178,4 @@ stdenv.mkDerivation rec {
     ];
     platforms = subtractLists systems.doubles.i686 systems.doubles.unix;
   };
-}
+})

From da9d56b6abf186309fa2644ec17f0e10820e9288 Mon Sep 17 00:00:00 2001
From: qubitnano <146656568+qubitnano@users.noreply.github.com>
Date: Mon, 22 Dec 2025 17:55:29 -0500
Subject: [PATCH 2/2] mongodb-7_0: 7.0.26 -> 7.0.28

Fixes: CVE-2025-14847
---
 pkgs/servers/nosql/mongodb/7.0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nosql/mongodb/7.0.nix b/pkgs/servers/nosql/mongodb/7.0.nix
index fc2d3be3fa97..5cdd476155a5 100644
--- a/pkgs/servers/nosql/mongodb/7.0.nix
+++ b/pkgs/servers/nosql/mongodb/7.0.nix
@@ -21,8 +21,8 @@ let
 in
 buildMongoDB {
   inherit avxSupport;
-  version = "7.0.26";
-  hash = "sha256-731rmMz5C2cmOVKRWmT439uiRUW3kWQCz2/l/Ffk9zI=";
+  version = "7.0.28";
+  hash = "sha256-28IouDQ+uzRoUm+PvESFkX1oz0dbFURd7JMsI7orYsc=";
   patches = [
     # ModuleNotFoundError: No module named 'mongo_tooling_metrics':
     # NameError: name 'SConsToolingMetrics' is not defined: