[Backport release-26.05] keepassxc: fix CVE-2026-69150

[herbetom]

Backport of #575169

Things done

• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.
• Follows the automation/AI policy.
• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • aarch64-darwin
• Tested, as applicable:
  • Basic functionality of all binary files, usually in ./result/bin/.
  • Ran nixpkgs-review on this PR. See nixpkgs-review usage.
  • Package tests at passthru.tests.
  • NixOS tests in nixos/tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.

[nixpkgs-commit-check]

This report is automatically generated by the PR / Check / cherry-pick CI workflow.

Some of the commits in this PR require the author's and reviewer's attention.

Sometimes it is not possible to cherry-pick exactly the same patch.
This most frequently happens when resolving merge conflicts.
The range-diff will help to review the resolution of conflicts.

If you need to merge this PR despite the warnings, please dismiss this review shortly before merging.

Warning

Difference between 1b3e3b7 and original 1b2cf58 may warrant inspection.

Show diff

@@ Metadata
  ## Commit message ##
     keepassxc: fix CVE-2026-69150
 
+    (cherry picked from commit 1b2cf585dabdd27a02bfde2b1bba2194b6bb3f53)
+
  ## pkgs/by-name/ke/keepassxc/package.nix ##
 @@
    lib,
@@ pkgs/by-name/ke/keepassxc/package.nix
    libsForQt5,
  
 @@ pkgs/by-name/ke/keepassxc/package.nix: stdenv.mkDerivation (finalAttrs: {
-       ];
-     };
  
--  patches = [ ./darwin-remove-macdeployqt.patch ];
-+  patches = [
-+    ./darwin-remove-macdeployqt.patch
+   patches = [
+     ./darwin.patch
 +
 +    (fetchpatch2 {
 +      name = "CVE-2026-69150.patch";
 +      url = "https://github.com/keepassxreboot/keepassxc/commit/6a534f38c61295d60b0e937739a12511e76dbfeb.patch?full_index=1";
 +      hash = "sha256-izHjFIqtBcMXK3XMPvSKv1d/1I5It59ClGrrcCz6lL4=";
 +    })
-+  ];
+   ];
  
-   # Upstream develops against a build of PCSC from Xcode.
-   # The types are incompatible with nixpkgs pcsclite.
+   cmakeFlags = [

Hint: The full diffs are also available in the runner logs with slightly better highlighting.

[ryand56]

LGTM (can't use the merge bot because of commit check bot)

stable derivation differs from unstable

[SigmaSquadron]

LGTM (can't use the merge bot because of commit check bot)

We need to get you your commit bit