quickjs-ng: fix CVE-2026-1144, CVE-2026-1145

These vulnerabilities affect quickjs-ng 0.11.0 and earlier:

- CVE-2026-1145: heap-based buffer overflow in js_typed_array_constructor_ta
  https://github.com/quickjs-ng/quickjs/issues/1305

- CVE-2026-1144: use-after-free in Atomics Ops Handler
  https://github.com/quickjs-ng/quickjs/issues/1301
  https://github.com/quickjs-ng/quickjs/issues/1302

Apply upstream patches as no new release is available yet.

pkgs/by-name/qu/quickjs-ng/package.nix

@@ -2,6 +2,7 @@
   lib,
   cmake,
   fetchFromGitHub,
+  fetchpatch,
   stdenv,
   testers,
   texinfo,
@@ -18,6 +19,24 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Mb0YyxTWU6a8HFTVBmlJ5yGEDmjKXHqTSszAvb8Y01U=";
   };
 
+  patches = [
+    # CVE-2026-1145: Fix heap buffer overflow in js_typed_array_constructor_ta
+    # https://github.com/quickjs-ng/quickjs/issues/1305
+    (fetchpatch {
+      name = "CVE-2026-1145.patch";
+      url = "https://github.com/quickjs-ng/quickjs/commit/53aebe66170d545bb6265906fe4324e4477de8b4.patch";
+      hash = "sha256-PObMEqIush07mQ7YcoFUJ3rXitOlEU0tCsgVi6P2zW0=";
+    })
+    # CVE-2026-1144: Fix OOB access in atomic ops
+    # https://github.com/quickjs-ng/quickjs/issues/1301
+    # https://github.com/quickjs-ng/quickjs/issues/1302
+    (fetchpatch {
+      name = "CVE-2026-1144.patch";
+      url = "https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141.patch";
+      hash = "sha256-ph6U+Mz7gxR4RWEtc+XU5fO6qjApQTqqW5dzwnOqTdc=";
+    })
+  ];
+
   outputs = [
     "out"
     "bin"