From 57804578fb80eb5d8cc4c7d235458164a0f4629c Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Fri, 13 Feb 2026 21:15:02 +1100
Subject: [PATCH 1/2] calibre: apply fix for CVE-2026-25635

CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-25635
Upstream advisory: GHSA-32vh-whvh-9fxr
Nix security tracking issue: https://tracker.security.nixos.org/issues/NIXPKGS-2026-0156

Fixes #488046
---
 pkgs/by-name/ca/calibre/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index b9aca5aeb332..b7a3af7b4a16 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -61,6 +61,15 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://github.com/debian-calibre/calibre/raw/refs/tags/debian/${finalAttrs.version}+${debian-source}/debian/patches/hardening/0007-Hardening-Qt-code.patch";
         hash = "sha256-lKp/omNicSBiQUIK+6OOc8ysM6LImn5GxWhpXr4iX+U=";
       })
+      # Fix CVE-2026-25635
+      # http://tracker.security.nixos.org/issues/NIXPKGS-2026-0156
+      # https://github.com/NixOS/nixpkgs/issues/488046
+      # Fixed upstream in 9.2.0.
+      (fetchpatch {
+        name = "CVE-2026-25635.patch";
+        url = "https://github.com/kovidgoyal/calibre/commit/9739232fcb029ac15dfe52ccd4fdb4a07ebb6ce9.patch";
+        hash = "sha256-fzotxhfMF/DCMvpIfMSOGY8iVOybsYymRQvhXf7jQyc=";
+      })
       # Fix CVE-2026-25636
       # http://tracker.security.nixos.org/issues/NIXPKGS-2026-0160
       # https://github.com/NixOS/nixpkgs/issues/488052

From c2b957ed5a04a50dbcb711393eb86ef5402f7eea Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Fri, 13 Feb 2026 21:18:06 +1100
Subject: [PATCH 2/2] calibre: apply fix for CVE-2026-25731

CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-25731
Upstream advisory: GHSA-xrh9-w7qx-3gcc
Nix security tracking issue: https://tracker.security.nixos.org/issues/NIXPKGS-2026-0155

Fixes #488045
---
 pkgs/by-name/ca/calibre/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index b7a3af7b4a16..a706eff0e343 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -86,6 +86,15 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://github.com/kovidgoyal/calibre/commit/9484ea82c6ab226c18e6ca5aa000fa16de598726.patch";
         hash = "sha256-hpWFSQXyOAVRqou0v+5oT5zIrBbyP2Uv2z1Vg811ZG0=";
       })
+      # Fix CVE-2026-25731
+      # http://tracker.security.nixos.org/issues/NIXPKGS-2026-0155
+      # https://github.com/NixOS/nixpkgs/issues/488045
+      # Fixed upstream in 9.2.0.
+      (fetchpatch {
+        name = "CVE-2026-25731.patch";
+        url = "https://github.com/kovidgoyal/calibre/commit/f0649b27512e987b95fcab2e1e0a3bcdafc23379.patch";
+        hash = "sha256-G9H6hEN5cyFIqDmJZv+bgt+6ZF6/K2t9npYjksjcxTo=";
+      })
     ]
     ++ lib.optional (!unrarSupport) ./dont_build_unrar_plugin.patch;