Temporary overlay until the PR reaches nixpkgs-unstable. Fixes CVE-2026-109618 and CVE-2026-109619. Becomes a no-op and warns at eval time once the locked nixpkgs ships these versions; delete it then.
