From ebc5c1b127e53b2dfec1dece09dba92470bb6c34 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Mon, 9 Feb 2026 19:57:47 +0100
Subject: [PATCH] localsend: patch CVE-2026-25154

Patching:
https://github.com/localsend/localsend/security/advisories/GHSA-34v6-52hh-x4r4
Diff:
https://github.com/localsend/localsend/commit/8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c
---
 pkgs/by-name/lo/localsend/package.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/by-name/lo/localsend/package.nix b/pkgs/by-name/lo/localsend/package.nix
index 6648bb188a06..f8b254df99f3 100644
--- a/pkgs/by-name/lo/localsend/package.nix
+++ b/pkgs/by-name/lo/localsend/package.nix
@@ -10,6 +10,7 @@
   libayatana-appindicator,
   undmg,
   makeBinaryWrapper,
+  fetchpatch,
 }:
 
 let
@@ -35,6 +36,18 @@ let
       pasteboard = "sha256-lJA5OWoAHfxORqWMglKzhsL1IFr9YcdAQP/NVOLYB4o=";
     };
 
+    patches = [
+      # Fix for https://github.com/localsend/localsend/security/advisories/GHSA-34v6-52hh-x4r4
+      # See: https://github.com/NixOS/nixpkgs/issues/488755
+      # Can be removed with new release > 1.17.0
+      (fetchpatch {
+        url = "https://github.com/localsend/localsend/commit/8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c.patch";
+        hash = "sha256-Fswir+TebCDPxHVBg8YM3ROx2uoLG92E3E15wnzHz+U=";
+      })
+    ];
+
+    patchFlags = [ "-p2" ];
+
     postPatch = ''
       substituteInPlace lib/util/native/autostart_helper.dart \
         --replace-fail 'Exec=''${Platform.resolvedExecutable}' "Exec=localsend_app"