From 62423febbde0921ed2406b5ef64b388781afd0fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 12 Mar 2026 15:46:30 +0100
Subject: [PATCH] cryptomator: 1.18.1 -> 1.19.2

Fixes CVE-2026-32303 and CVE-2026-29110.
---
 .../cr/cryptomator/downgrade-fuse.patch        | 13 +++++++++++++
 pkgs/by-name/cr/cryptomator/package.nix        | 18 +++++++++++++++---
 2 files changed, 28 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/by-name/cr/cryptomator/downgrade-fuse.patch

diff --git a/pkgs/by-name/cr/cryptomator/downgrade-fuse.patch b/pkgs/by-name/cr/cryptomator/downgrade-fuse.patch
new file mode 100644
index 000000000000..8daeee0a30f6
--- /dev/null
+++ b/pkgs/by-name/cr/cryptomator/downgrade-fuse.patch
@@ -0,0 +1,13 @@
+diff --git a/pom.xml b/pom.xml
+index fdaf9b328..2dbc69fb8 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -39,7 +39,7 @@
+ 		<cryptomator.integrations.win.version>1.6.0</cryptomator.integrations.win.version>
+ 		<cryptomator.integrations.mac.version>1.5.0</cryptomator.integrations.mac.version>
+ 		<cryptomator.integrations.linux.version>1.7.0</cryptomator.integrations.linux.version>
+-		<cryptomator.fuse.version>6.0.1</cryptomator.fuse.version>
++		<cryptomator.fuse.version>5.1.0</cryptomator.fuse.version>
+ 		<cryptomator.webdav.version>3.0.1</cryptomator.webdav.version>
+ 		<cryptomator.webdav-servlet.version>1.2.12</cryptomator.webdav-servlet.version>
+ 
diff --git a/pkgs/by-name/cr/cryptomator/package.nix b/pkgs/by-name/cr/cryptomator/package.nix
index 628b952157f2..e374518ca5cc 100644
--- a/pkgs/by-name/cr/cryptomator/package.nix
+++ b/pkgs/by-name/cr/cryptomator/package.nix
@@ -17,18 +17,30 @@ let
 in
 maven.buildMavenPackage rec {
   pname = "cryptomator";
-  version = "1.18.1";
+  version = "1.19.2";
 
   src = fetchFromGitHub {
     owner = "cryptomator";
     repo = "cryptomator";
     tag = version;
-    hash = "sha256-C2pvToxIK8gPzmqcRKYCu4B2FBrOGcH2Uzpjdt3nZZs=";
+    hash = "sha256-9JWZaTsL2sfnGQAZI56T2iQnTNhERsFNFFCeLMB7WC0=";
   };
 
+  patches = [
+    # fix for "java.lang.IllegalStateException: No fuse library found at expected path"
+    ./downgrade-fuse.patch
+  ];
+
   mvnJdk = jdk;
   mvnParameters = "-Dmaven.test.skip=true -Plinux";
-  mvnHash = "sha256-dOpvojr6gVtDFE52eghOVZWGspRLQrTDotOMkVGaG9k=";
+  mvnHash = "sha256-IVOcDFW5YKgUHJKX3ZXYVnOevwmOwN5yEU8jfPtCY1I=";
+  mvnFetchExtraArgs.env = {
+    inherit SOURCE_DATE_EPOCH;
+  };
+
+  # fix for "date 1980-01-01T00:00:00Z is not within the valid range 1980-01-01T00:00:02Z to 2099-12-31T23:59:59Z"
+  # this should be in env, but looks like buildMavenPackage doesn't support that
+  SOURCE_DATE_EPOCH = 315532802; # 1980-01-01T00:00:02Z
 
   preBuild = ''
     VERSION=${version}