anchor.diff:  
   stdenv.mkDerivation rec {
     pname = "pwsafe";
  -  version = "3.56.0";
  +  version = "1.14.0"; # do NOT update to 3.x Windows releases
  +  # nixpkgs-update: no auto update
   
     src = fetchFromGitHub {
       owner = pname;
       repo = pname;
       rev = version;
  -    sha256 = "sha256-ZLX/3cs1cdia5+32QEwE6q3V0uFNkkmiIGboKW6Xej8=";
  +    hash = "sha256-s3IXe4gTwUOzQslNfWrcN/srrG9Jv02zfkGgiZN3C1s=";
     };
   
     nativeBuildInputs = [
  
positive.code: { lib, stdenv, fetchFromGitHub, cmake, pkg-config, zip, gettext, perl
  , wxGTK30, libXext, libXi, libXt, libXtst, xercesc
  , qrencode, libuuid, libyubikey, yubikey-personalization
  , curl, openssl, file
  
negative.code: 
    postPatch = ''
      # Fix perl scripts used during the build.
      for f in $(find . -type f -name '*.pl') ; do
        patchShebangs $f
      done
  
      # Fix hard coded paths.
      for f in $(grep -Rl /usr/share/ src) ; do
        substituteInPlace $f --replace /usr/share/ $out/share/
      done
  
      # Fix hard coded zip path.
      substituteInPlace help/Makefile.linux --replace /usr/bin/zip ${zip}/bin/zip
  
      for f in $(grep -Rl /usr/bin/ .) ; do
        substituteInPlace $f --replace /usr/bin/ ""
      done
    '';
  