overlays: backport nixpkgs#576853 (php 8.3.36/8.4.27/8.5.12)

Temporary overlay until the PR reaches nixpkgs-unstable. Fixes
CVE-2026-109618 and CVE-2026-109619. Becomes a no-op and warns at eval
time once the locked nixpkgs ships these versions; delete it then.

overlays/default.nix

@@ -2,6 +2,8 @@
 {
   flake.overlays = {
     packagesOverlay = import ../pkgs/overlay.nix;
+    # TEMPORARY: drop with the file once NixOS/nixpkgs#576853 reaches nixpkgs-unstable.
+    phpPr576853Overlay = import ./nixpkgs-pr-576853-php.nix;
 
     frappixFrappeOverlay = inputs.frappix.frappeOverlay.x86_64-linux;
     frappixLibsOverlay = inputs.frappix.libsOverlay.x86_64-linux;

overlays/nixpkgs-pr-576853-php.nix

@@ -0,0 +1,59 @@
+# TEMPORARY backport of NixOS/nixpkgs#576853
+# (php 8.3.36 / 8.4.27 / 8.5.12; fixes CVE-2026-109618, CVE-2026-109619).
+# Merged to master 2026-10-21, not yet on nixpkgs-unstable.
+# Track: https://track.nix.ee/?pr=576853
+#
+# Remove once `nix flake update` pulls it in: delete this file and every
+# reference to it (grep 576853). The overlay becomes a no-op and warns at eval
+# time as soon as the locked nixpkgs ships these versions or newer.
+final: prev:
+let
+  inherit (prev) lib;
+
+  updates = {
+    php83 = {
+      version = "8.3.36";
+      hash = "sha256-RvS0XjaI7SsYGQFae1MsFbUcwFW907E/0A3f7r7tzV8=";
+    };
+    php84 = {
+      version = "8.4.27";
+      hash = "sha256-slMKh3xyL0sIyeF0owywi6wrfhkD7m6eMV8KqfX4LCQ=";
+    };
+    php85 = {
+      version = "8.5.12";
+      hash = "sha256-/7YO3EN87WO1E35JhNs3moERxQBJxxFRDYuVgnfvwag=";
+    };
+  };
+
+  # php-packages.nix hunk of the PR: the new releases' filter OOM tests only
+  # pass when the freshly built module is loaded explicitly.
+  packageOverrides = _: phpPrev: {
+    extensions = phpPrev.extensions // {
+      filter = phpPrev.extensions.filter.override {
+        postConfigure = ''
+          substituteInPlace \
+            tests/oom_filter_input.phpt \
+            tests/oom_filter_input_array.phpt \
+            tests/oom_filter_default_encoded.phpt \
+            --replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so',"
+        '';
+      };
+    };
+  };
+
+  bump =
+    name:
+    { version, hash }:
+    if lib.versionAtLeast prev.${name}.version version then
+      lib.warn
+        "nixpkgs ships ${name} ${prev.${name}.version} (>= ${version}): NixOS/nixpkgs#576853 has landed, remove overlays/nixpkgs-pr-576853-php.nix"
+        prev.${name}
+    else
+      # `.override` on a php buildEnv rebuilds the interpreter with the new
+      # args, but the extension scope (php-packages) keeps the closure's
+      # original `packageOverrides`. Only `overrideAttrs` re-enters
+      # generic.nix with the overridden args and rebuilds that scope, so a
+      # no-op `overrideAttrs` is what makes `packageOverrides` take effect.
+      (prev.${name}.override { inherit version hash packageOverrides; }).overrideAttrs (_: { });
+in
+lib.mapAttrs bump updates