From 7bd25810990ad355d4f4284d65f9843c79ade148 Mon Sep 17 00:00:00 2001
From: lucasew <lucas59356@gmail.com>
Date: Mon, 29 Jun 2026 18:45:33 -0300
Subject: [PATCH 1/2] gb-backup: unstable-2021-10-27 -> 0-unstable-2026-06-05

Upstream now embeds Lepton compression via lepton_jpeg_go and no longer
requires the external dropbox/lepton binary.

Assisted-by: Grok 4.3 (xAI)
---
 pkgs/by-name/gb/gb-backup/package.nix | 28 +++++++++++++--------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/pkgs/by-name/gb/gb-backup/package.nix b/pkgs/by-name/gb/gb-backup/package.nix
index d543c8e68fec..95229a822702 100644
--- a/pkgs/by-name/gb/gb-backup/package.nix
+++ b/pkgs/by-name/gb/gb-backup/package.nix
@@ -1,36 +1,34 @@
 {
   lib,
-  makeWrapper,
   buildGoModule,
   fetchFromGitHub,
-  lepton,
+  nix-update-script,
 }:
 
-buildGoModule {
+buildGoModule (finalAttrs: {
   pname = "gb-backup";
-  version = "unstable-2021-10-27";
+  version = "0-unstable-2026-06-05";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "leijurv";
     repo = "gb";
-    rev = "61383d445af7b035fb8e1df0cacc424340dd16df";
-    sha256 = "sha256-YRrD2gW+gzxD2JwadCbF/SBSsHeeGPsa8kKZHHAytVo=";
+    rev = "d388723a2cbed495bcf1793aa0958a9ba4f3d6b9";
+    hash = "sha256-um2wMfHdEL3GkILtM7R/bNW17pknq0M/CCfHPlu6/58=";
   };
 
-  vendorHash = "sha256-H3Zf4VNJVX9C3GTeqU4YhNqCIQz1R55MfhrygDgJTxc=";
+  vendorHash = "sha256-fjOIp2LUBaAPAPMxU2T+qbIQZgmVa0vNPYzW2hOsBr8=";
 
-  nativeBuildInputs = [ makeWrapper ];
-
-  nativeCheckInputs = [ lepton ];
-
-  postFixup = ''
-    wrapProgram $out/bin/gb --prefix PATH : ${lib.makeBinPath [ lepton ]}
-  '';
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "Gamer Backup, a super opinionated cloud backup system";
     homepage = "https://github.com/leijurv/gb";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ babbaj ];
+    mainProgram = "gb";
   };
-}
+})

From f338f71d96bcb2f2bd48b78aac85a82fa4d3f586 Mon Sep 17 00:00:00 2001
From: lucasew <lucas59356@gmail.com>
Date: Mon, 29 Jun 2026 18:45:33 -0300
Subject: [PATCH 2/2] lepton: remove

Archived upstream with known vulnerabilities (CVE-2022-4104). Prefer
lepton-jpeg-util. gb-backup no longer depends on this package.

Assisted-by: Grok 4.3 (xAI)
---
 pkgs/by-name/le/lepton/package.nix | 38 ------------------------------
 pkgs/top-level/aliases.nix         |  1 +
 2 files changed, 1 insertion(+), 38 deletions(-)
 delete mode 100644 pkgs/by-name/le/lepton/package.nix

diff --git a/pkgs/by-name/le/lepton/package.nix b/pkgs/by-name/le/lepton/package.nix
deleted file mode 100644
index 336afe9a1b16..000000000000
--- a/pkgs/by-name/le/lepton/package.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  git,
-  glibc,
-}:
-
-stdenv.mkDerivation {
-  version = "2019-08-20";
-  pname = "lepton-unstable";
-
-  src = fetchFromGitHub {
-    repo = "lepton";
-    owner = "dropbox";
-    rev = "3d1bc19da9f13a6e817938afd0f61a81110be4da";
-    sha256 = "0aqs6nvcbq8cbfv8699fa634bsz7csmk0169n069yvv17d1c07fd";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    git
-  ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ glibc.static ];
-
-  meta = {
-    homepage = "https://github.com/dropbox/lepton";
-    description = "Tool to losslessly compress JPEGs";
-    license = lib.licenses.asl20;
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    maintainers = with lib.maintainers; [ artemist ];
-    knownVulnerabilities = [ "CVE-2022-4104" ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ec0410759418..ba9694556446 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1164,6 +1164,7 @@ mapAliases {
   leaf = throw "'leaf' has been removed as it is unmaintained. Consider using 'fastfetch' instead"; # Added 2026-04-24
   ledger-agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   ledger_agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
+  lepton = throw "'lepton' has been removed as it is archived upstream and has known vulnerabilities (CVE-2022-4104). Consider using 'lepton-jpeg-util' instead"; # Added 2026-06-29
   lesstif = throw "'lesstif' has been removed due to its being broken and unmaintained upstream. Consider using 'motif' instead."; # Added 2025-06-09
   lexical = throw "'lexical' has been removed because it was deprecated and archived upstream. Consider using 'beamPackages.expert' instead"; # Added 2026-02-24
   lfe = warnAlias "'lfe' is deprecated in favor of using the beamPackages sets. Use 'beam27Packages.lfe' instead." beam27Packages.lfe; # added 2026-06-15