anchor.diff:  
   # Pinned versions of stuff we pull in
   ENV AUTOPEP8_VERSION=1.4.4
  -ENV YAMLLINT_VERSION=1.17.0
  +ENV YAMLLINT_VERSION=1.24.2
   ENV REQUESTS_VERSION=2.22.0
   ENV PYTHON_PROTOBUF_VERSION=3.11.2
   ENV PYYAML_VERSION=5.3.1
   ENV JWCRYPTO_VERSION=0.7
   
   # hadolint ignore=DL3008
  -RUN apt-get update && apt-get install -y --no-install-recommends \
  +RUN apt-get update && apt-get -y dist-upgrade && apt-get install -y --no-install-recommends \
       ca-certificates \
       curl \
       libc-dev \
  
positive.code: ENV BAZELISK_URL="${BAZELISK_BASE_URL}/${BAZELISK_VERSION}/${BAZELISK_BIN}"
  
  # hadolint ignore=DL3008
  RUN apt-get update && apt-get install -y --no-install-recommends \
      wget \
      ca-certificates \
   && apt-get clean \
  
negative.code: # required for general build: make, wget, curl, ssh
  # required for python: python3, pkg-config
  # hadolint ignore=DL3008
  RUN apt-get update && apt-get -y dist-upgrade && apt-get install -y --no-install-recommends \
      apt-transport-https \
      ca-certificates \
      curl \
  