Nicolas Graves via Guix-patches via <guix-patches@gnu.org> writes:

> This fixes CVE-2021-39360.
>
> * gnu/packages/gnome.scm (libzapojit): Update to 0.0.3-1.99d49ba.
> ---
>  gnu/packages/gnome.scm | 45 ++++++++++++++++++++++--------------------
>  1 file changed, 24 insertions(+), 21 deletions(-)
>
> diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
> index 77a0633b50..82ea9d6699 100644
> --- a/gnu/packages/gnome.scm
> +++ b/gnu/packages/gnome.scm
> @@ -10591,28 +10591,31 @@ (define-public gsound
>      (license license:lgpl2.1+)))
>  
>  (define-public libzapojit
> -  (package
> -    (name "libzapojit")
> -    (version "0.0.3")
> -    (source (origin
> -              (method url-fetch)
> -              (uri (string-append "mirror://gnome/sources/" name "/"
> -                                  (version-major+minor version) "/"
> -                                  name "-" version ".tar.xz"))
> -              (sha256
> -               (base32
> -                "0zn3s7ryjc3k1abj4k55dr2na844l451nrg9s6cvnnhh569zj99x"))))
> -    (build-system gnu-build-system)
> -    (native-inputs
> -     (list gobject-introspection intltool pkg-config))
> -    (inputs
> -     (list gnome-online-accounts json-glib rest))
> -    (home-page "https://wiki.gnome.org/Projects/Zapojit")
> -    (synopsis "Library for accessing SkyDrive and Hotmail")
> -    (description
> -     "Libzapojit is a GLib-based library for accessing online service APIs of
> +  (let ((revision "1")
> +        (commit "99d49bac5edc4afdcac742a0a142908e405597b0"))
> +    (package
> +      (name "libzapojit")
> +      (version (git-version "0.0.3" revision commit))
> +      (source
> +       (origin
> +         (method git-fetch)
> +         (uri (git-reference
> +               (url "https://gitlab.gnome.org/Archive/libzapojit")
> +               (commit commit)))
> +         (file-name (git-file-name name version))
> +         (sha256
> +          (base32 "12frqg925rmic3rf37h5vs48xdy3mfi4ip24v0bl73h5sxy8n828"))))
> +      (build-system gnu-build-system)
> +      (native-inputs
> +       (list gobject-introspection intltool pkg-config))
> +      (inputs
> +       (list gnome-online-accounts json-glib rest))
> +      (home-page "https://wiki.gnome.org/Projects/Zapojit")
> +      (synopsis "Library for accessing SkyDrive and Hotmail")
> +      (description
> +       "Libzapojit is a GLib-based library for accessing online service APIs of
>  Microsoft SkyDrive and Hotmail, using their REST protocols.")
> -    (license license:lgpl2.1+)))
> +      (license license:lgpl2.1+))))
>  
>  (define-public gnome-clocks
>    (package
apply, and add autoconf, autoconf-archive, automake, glib:bin and
libtool to fix build.