# TEMPORARY backport of NixOS/nixpkgs#576853
# (php 8.3.36 / 8.4.27 / 8.5.12; fixes CVE-2026-109618, CVE-2026-109619).
# Merged to master 2026-10-21, not yet on nixpkgs-unstable.
# Track: https://track.nix.ee/?pr=576853
#
# Remove once `nix flake update` pulls it in: delete this file and every
# reference to it (grep 576853). The overlay becomes a no-op and warns at eval
# time as soon as the locked nixpkgs ships these versions or newer.
final: prev:
let
  inherit (prev) lib;

  updates = {
    php83 = {
      version = "8.3.36";
      hash = "sha256-RvS0XjaI7SsYGQFae1MsFbUcwFW907E/0A3f7r7tzV8=";
    };
    php84 = {
      version = "8.4.27";
      hash = "sha256-slMKh3xyL0sIyeF0owywi6wrfhkD7m6eMV8KqfX4LCQ=";
    };
    php85 = {
      version = "8.5.12";
      hash = "sha256-/7YO3EN87WO1E35JhNs3moERxQBJxxFRDYuVgnfvwag=";
    };
  };

  # php-packages.nix hunk of the PR: the new releases' filter OOM tests only
  # pass when the freshly built module is loaded explicitly.
  packageOverrides = _: phpPrev: {
    extensions = phpPrev.extensions // {
      filter = phpPrev.extensions.filter.override {
        postConfigure = ''
          substituteInPlace \
            tests/oom_filter_input.phpt \
            tests/oom_filter_input_array.phpt \
            tests/oom_filter_default_encoded.phpt \
            --replace-fail "'-n'," "'-n', '-d', 'extension=$PWD/modules/filter.so',"
        '';
      };
    };
  };

  bump =
    name:
    { version, hash }:
    if lib.versionAtLeast prev.${name}.version version then
      lib.warn
        "nixpkgs ships ${name} ${prev.${name}.version} (>= ${version}): NixOS/nixpkgs#576853 has landed, remove overlays/nixpkgs-pr-576853-php.nix"
        prev.${name}
    else
      # `.override` on a php buildEnv rebuilds the interpreter with the new
      # args, but the extension scope (php-packages) keeps the closure's
      # original `packageOverrides`. Only `overrideAttrs` re-enters
      # generic.nix with the overridden args and rebuilds that scope, so a
      # no-op `overrideAttrs` is what makes `packageOverrides` take effect.
      (prev.${name}.override { inherit version hash packageOverrides; }).overrideAttrs (_: { });
in
lib.mapAttrs bump updates