From b7999153a9d906523b3d42ca9af32112c6a56d2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Sun, 17 Aug 2025 00:29:44 +0200
Subject: [PATCH 1/3] cudaPackages_12_9: switch to libxml2_13 that has patches
 for 5 CVEs

---
 pkgs/development/cuda-modules/cudatoolkit/default.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/cuda-modules/cudatoolkit/default.nix b/pkgs/development/cuda-modules/cudatoolkit/default.nix
index 9201f7755d4a..baa41e61613e 100644
--- a/pkgs/development/cuda-modules/cudatoolkit/default.nix
+++ b/pkgs/development/cuda-modules/cudatoolkit/default.nix
@@ -21,7 +21,7 @@
   libxcrypt-legacy,
   libxkbcommon,
   libkrb5,
-  libxml2,
+  libxml2_13,
   krb5,
   makeWrapper,
   markForCudatoolkitRootHook,
@@ -157,14 +157,7 @@ backendStdenv.mkDerivation {
     python311
   ]
   ++ lib.optionals (cudaAtLeast "12.9") [
-    # Replace once https://github.com/NixOS/nixpkgs/pull/421740 is merged.
-    (libxml2.overrideAttrs rec {
-      version = "2.13.8";
-      src = fetchurl {
-        url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-        hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
-      };
-    })
+    libxml2_13
     python312
   ];
 

From 1f685465b7a0f78e1f61832d4fd74c173961abfd Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Mon, 18 Aug 2025 12:16:20 +0200
Subject: [PATCH 2/3] opensnitch-ui: migrate to python-slugify to fix build

---
 pkgs/by-name/op/opensnitch-ui/package.nix             |  9 ++++++++-
 .../by-name/op/opensnitch-ui/use_python_slugify.patch | 11 +++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch

diff --git a/pkgs/by-name/op/opensnitch-ui/package.nix b/pkgs/by-name/op/opensnitch-ui/package.nix
index 0c9bdbdb1ca8..2c7a17b2266f 100644
--- a/pkgs/by-name/op/opensnitch-ui/package.nix
+++ b/pkgs/by-name/op/opensnitch-ui/package.nix
@@ -12,6 +12,13 @@ python3Packages.buildPythonApplication {
   inherit (opensnitch) src version;
   sourceRoot = "${opensnitch.src.name}/ui";
 
+  patches = [
+    # https://github.com/evilsocket/opensnitch/pull/1413
+    # unicode-slugify has failing tests and is overall unmaintained and broken.
+    # python-slugify is a preferrable replacement
+    ./use_python_slugify.patch
+  ];
+
   postPatch = ''
     substituteInPlace opensnitch/utils/__init__.py \
       --replace-fail /usr/lib/python3/dist-packages/data ${python3Packages.pyasn}/${python3Packages.python.sitePackages}/pyasn/data
@@ -38,7 +45,7 @@ python3Packages.buildPythonApplication {
     pyinotify
     pyqt5
     qt-material
-    unicode-slugify
+    python-slugify
     unidecode
   ];
 
diff --git a/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch b/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch
new file mode 100644
index 000000000000..877b5006251a
--- /dev/null
+++ b/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch
@@ -0,0 +1,11 @@
+diff --git a/requirements.txt b/requirements.txt
+index 66e0de13..68d651b1 100644
+--- a/requirements.txt
++++ b/requirements.txt
+@@ -1,5 +1,5 @@
+ grpcio-tools>=1.10.1
+ pyinotify==0.9.6
+-unicode_slugify==0.1.5
++python-slugify>=7.0.0
+ pyqt5>=5.6
+ protobuf

From e6843057afac9afe3a72ff50ea31a914f75e77c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oliv=C3=A9r=20Falvai?= <ofalvai@gmail.com>
Date: Mon, 18 Aug 2025 20:02:04 +0200
Subject: [PATCH 3/3] python3Packages.fontmake: remove unnecessary patch

---
 pkgs/development/python-modules/fontmake/default.nix | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/pkgs/development/python-modules/fontmake/default.nix b/pkgs/development/python-modules/fontmake/default.nix
index 8fb3c30f6df4..9f651758e3b0 100644
--- a/pkgs/development/python-modules/fontmake/default.nix
+++ b/pkgs/development/python-modules/fontmake/default.nix
@@ -27,16 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-cHFxb7lWUj/7ATynoMGQkhArKWCHHLYvQG5IoaXwVBs=";
   };
 
-  patches = [
-    # Update to FontTools 4.55 and glyphsLib 6.9.5
-    # https://github.com/googlefonts/fontmake/pull/1133
-    (fetchpatch2 {
-      url = "https://github.com/googlefonts/fontmake/commit/ca96d25faa67638930ddc7f9bd1ab218a76caf22.patch";
-      includes = [ "tests/test_main.py" ];
-      hash = "sha256-vz+KeWiGCpUdX5HaXDdyyUCbuMkIylB364j6cD7xR1E=";
-    })
-  ];
-
   build-system = [
     setuptools
     setuptools-scm