From dc46283b4b330851889405a3050c1d0cb71a49f6 Mon Sep 17 00:00:00 2001
From: GraysonTinker <graysontinker@gmail.com>
Date: Tue, 24 Mar 2026 21:10:07 -0700
Subject: [PATCH 1/2] quickjs-ng: 0.11.0 -> 0.13.0

---
 pkgs/by-name/qu/quickjs-ng/package.nix | 23 ++---------------------
 1 file changed, 2 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/qu/quickjs-ng/package.nix b/pkgs/by-name/qu/quickjs-ng/package.nix
index 26e9f5fc2ce4..f67c544f6489 100644
--- a/pkgs/by-name/qu/quickjs-ng/package.nix
+++ b/pkgs/by-name/qu/quickjs-ng/package.nix
@@ -2,7 +2,6 @@
   lib,
   cmake,
   fetchFromGitHub,
-  fetchpatch,
   stdenv,
   testers,
   texinfo,
@@ -10,33 +9,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quickjs-ng";
-  version = "0.11.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "quickjs-ng";
     repo = "quickjs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Mb0YyxTWU6a8HFTVBmlJ5yGEDmjKXHqTSszAvb8Y01U=";
+    hash = "sha256-t1GvD1iBRfJwzZHoLxMbE2Gh1Ow8v0ZASxCVnOT7ST4=";
   };
 
-  patches = [
-    # CVE-2026-1145: Fix heap buffer overflow in js_typed_array_constructor_ta
-    # https://github.com/quickjs-ng/quickjs/issues/1305
-    (fetchpatch {
-      name = "CVE-2026-1145.patch";
-      url = "https://github.com/quickjs-ng/quickjs/commit/53aebe66170d545bb6265906fe4324e4477de8b4.patch";
-      hash = "sha256-PObMEqIush07mQ7YcoFUJ3rXitOlEU0tCsgVi6P2zW0=";
-    })
-    # CVE-2026-1144: Fix OOB access in atomic ops
-    # https://github.com/quickjs-ng/quickjs/issues/1301
-    # https://github.com/quickjs-ng/quickjs/issues/1302
-    (fetchpatch {
-      name = "CVE-2026-1144.patch";
-      url = "https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141.patch";
-      hash = "sha256-ph6U+Mz7gxR4RWEtc+XU5fO6qjApQTqqW5dzwnOqTdc=";
-    })
-  ];
-
   outputs = [
     "out"
     "bin"

From 97b4afb818b6e60a523b4e7b2da82893ede32c6f Mon Sep 17 00:00:00 2001
From: GraysonTinker <graysontinker@gmail.com>
Date: Tue, 24 Mar 2026 21:10:32 -0700
Subject: [PATCH 2/2] quickjs: mark vulnerable for CVE-2026-3979

---
 pkgs/by-name/qu/quickjs/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/qu/quickjs/package.nix b/pkgs/by-name/qu/quickjs/package.nix
index e471f16b0d15..344f873f03b3 100644
--- a/pkgs/by-name/qu/quickjs/package.nix
+++ b/pkgs/by-name/qu/quickjs/package.nix
@@ -125,6 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
     knownVulnerabilities = [
       "CVE-2026-1144"
       "CVE-2026-1145"
+      "CVE-2026-3979"
     ];
   };
 })