localsend: patch CVE-2026-25154

Patching:
https://github.com/localsend/localsend/security/advisories/GHSA-34v6-52hh-x4r4
Diff:
https://github.com/localsend/localsend/commit/8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c

pkgs/by-name/lo/localsend/package.nix

@@ -10,6 +10,7 @@
   libayatana-appindicator,
   undmg,
   makeBinaryWrapper,
+  fetchpatch,
 }:
 
 let
@@ -35,6 +36,18 @@ let
       pasteboard = "sha256-lJA5OWoAHfxORqWMglKzhsL1IFr9YcdAQP/NVOLYB4o=";
     };
 
+    patches = [
+      # Fix for https://github.com/localsend/localsend/security/advisories/GHSA-34v6-52hh-x4r4
+      # See: https://github.com/NixOS/nixpkgs/issues/488755
+      # Can be removed with new release > 1.17.0
+      (fetchpatch {
+        url = "https://github.com/localsend/localsend/commit/8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c.patch";
+        hash = "sha256-Fswir+TebCDPxHVBg8YM3ROx2uoLG92E3E15wnzHz+U=";
+      })
+    ];
+
+    patchFlags = [ "-p2" ];
+
     postPatch = ''
       substituteInPlace lib/util/native/autostart_helper.dart \
         --replace-fail 'Exec=''${Platform.resolvedExecutable}' "Exec=localsend_app"