anchor.diff: -{ lib, fetchFromGitHub, fetchzip }:
  +{ lib, fetchFromGitHub, fetchzip, stdenv }:
   
   rec {
  -  version = "0.106.0";
  +  version = "0.108.0";
   
     src = fetchFromGitHub {
       owner = "returntocorp";
       repo = "semgrep";
       rev = "v${version}";
  -    sha256 = "sha256-/L8w8imvfjO3ICe0FBhfVrTivK58/9Y+j9Hc71tlpjA=";
  +    sha256 = "sha256-Vdrv7lVPsBsxkwwfviD5zRAdsD02RfWmM+IlaThduQs=";
     };
   
     # submodule dependencies
  
positive.code:   interfacesSrc = fetchFromGitHub {
      owner = "returntocorp";
      repo = "semgrep-interfaces";
      rev = "8bc79b2bca62c051e46a33fb65751357a71b87b6";
      sha256 = "sha256-k/rsTGYqHnw/4bsmeg7pQ/ckNglvuA0yhuz+OayXCdw=";
    };
  
    # fetch pre-built semgrep-core since the ocaml build is complex and relies on
    # the opam package manager at some point
    coreRelease = fetchzip {
      url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-ubuntu-16.04.tgz";
      sha256 = "sha256-ARf776uOJkCBGsJI8ul3IDWI24vFQxs2jlGEA6uXG+o=";
    };
  
    meta = with lib; {
  
negative.code:     license = licenses.lgpl21Plus;
      maintainers = with maintainers; [ jk ambroisie ];
      # limited by semgrep-core
      platforms = [ "x86_64-linux" "x86_64-darwin" ];
    };
  }
  