anchor.diff:  # Those pieces of software we entirely ignore upstream's handling of, and just
   # make sure they're in the path if desired.
   let
  -  k3sVersion = "1.18.2+k3s1";     # k3s git tag
  +  k3sVersion = "1.18.8+k3s1";     # k3s git tag
     traefikChartVersion = "1.81.0"; # taken from ./scripts/download at the above k3s tag
  -  k3sRootVersion = "0.3.0";       # taken from .s/cripts/download at the above k3s tag
  +  k3sRootVersion = "0.4.1";       # taken from ./scripts/download at the above k3s tag
  +  k3sCNIVersion = "0.8.6-k3s1";   # taken from ./scripts/version.sh at the above k3s tag
     # bundled into the k3s binary
     traefikChart = fetchurl {
       url = "https://kubernetes-charts.storage.googleapis.com/traefik-${traefikChartVersion}.tgz";
  
positive.code:       owner = "rancher";
        repo = "plugins";
        rev = "v${version}";
        sha256 = "0ax72z1ziann352bp6khfds8vlf3bbkqckrkpx4l4jxgqks45izs";
      };
  
      meta = {
  
negative.code:   k3sRoot = fetchzip {
      # Note: marked as apache 2.0 license
      url = "https://github.com/rancher/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
      sha256 = "0ppj8y9g410hn6mjkfgfsi2j9yv7rcpic21znpmbrkx8b2070hf0";
      stripRoot = false;
    };
    k3sPlugins = buildGoPackage rec {
      name = "k3s-cni-plugins";
      version = k3sCNIVersion;
  
      goPackagePath = "github.com/containernetworking/plugins";
      subPackages = [ "." ];
  