8 files changed, 40 insertions, 19 deletions
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index ea4fbbb0a6ca9..1590dc2a85434 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.148";
+  version = "3.2.156";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-lmMmKdxNN1pnMETuO7WZ9oKIVK89Cf9/5n89xfwNRZ4=";
+    hash = "sha256-RcYDvxqAyvXFdVo3NqISNJ2aDCUsRwN73r3ilc3IjCk=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/development/tools/analysis/tfsec/default.nix b/pkgs/development/tools/analysis/tfsec/default.nix
index 28aa1e39e89e1..3a97b63216b59 100644
--- a/pkgs/development/tools/analysis/tfsec/default.nix
+++ b/pkgs/development/tools/analysis/tfsec/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "tfsec";
-  version = "1.28.6";
+  version = "1.28.9";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = "tfsec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Dc6eXw1qGr2KxRoG3Odfa07s2SYdnxVbJHeVQdETBIs=";
+    hash = "sha256-Dulbo5ZTw4+1XxjpnZ1aIsVPLVEqwQKdNMv+L9/j1wc=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
     # "-extldflags '-fno-PIC -static'"
   ];
 
-  vendorHash = "sha256-RxsoTNj/V1UgcMq7vbjGlkJCMEVyvfmSz2IPncs53hY=";
+  vendorHash = "sha256-Hu530cBJWGtvMmQ6gbROXf5JBfkOfc4nwznsKBTegUk=";
 
   subPackages = [
     "cmd/tfsec"
diff --git a/pkgs/development/tools/build-managers/scala-cli/sources.json b/pkgs/development/tools/build-managers/scala-cli/sources.json
index 27db1b9db55e1..676c8eebb07bf 100644
--- a/pkgs/development/tools/build-managers/scala-cli/sources.json
+++ b/pkgs/development/tools/build-managers/scala-cli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.3.2",
+  "version": "1.4.0",
   "assets": {
     "aarch64-darwin": {
       "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "0xs60pnqsxxkamcq0n0am4jbnx4lgnr91ngcwxk0ccfpqf24jpk8"
+      "sha256": "1k9yc868lh7yjvxf81pg9n1sdyb2c566i6qwrf7kxczn0s9sa12h"
     },
     "aarch64-linux": {
       "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "1419s6dnwk703mkp209m5fxqphx8g65h0b2kam3zs9z9rii3mjvs"
+      "sha256": "08chhm364m5lbl1wr5xiww3mmm8d31hfw07s4jdsrmpjvxx0yrhg"
     },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "0ms7yggldckkyayz8wksyg79kgk6xl13g47a2jc7q66syzr495yw"
+      "sha256": "1a1ng800aaydvp83wrvxdxw3x6zcdgl2g7fa3zz5h2ba208xjv62"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "1jy5xz8n79ck8gxcmy14ldsaj7dfrwrqgdfhp5h39hzvgcs1mjvl"
+      "sha256": "1cav0c0bhag64mic1c37l9zb21zyasshcyl3r12y939fmc9icnww"
     }
   }
 }
diff --git a/pkgs/development/tools/misc/hound/default.nix b/pkgs/development/tools/misc/hound/default.nix
index b906456116c56..6e3124556f547 100644
--- a/pkgs/development/tools/misc/hound/default.nix
+++ b/pkgs/development/tools/misc/hound/default.nix
@@ -6,6 +6,7 @@
 , git
 , openssh
 , nixosTests
+, fetchpatch
 }:
 
 buildGoModule rec {
@@ -19,6 +20,19 @@ buildGoModule rec {
     sha256 = "sha256-Qdk57zLjTXLdDEmB6K+sZAym5s0BekJJa/CpYeOBOcY=";
   };
 
+  patches = [
+    # add check config flag
+    # https://github.com/hound-search/hound/pull/485/files
+    (fetchpatch {
+      url = "https://github.com/MarcelCoding/hound/commit/b2f1cef335eff235394de336593687236a3b88bb.patch";
+      hash = "sha256-3+EBvnA8JIx2P6YM+8LpojDIX7hNXJ0vwVN4oSAouZ4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/MarcelCoding/hound/commit/f917a457570ad8659d02fca4311cc91cadcadc00.patch";
+      hash = "sha256-CGvcIoSbgiayli5B8JRjvGfLuH2fscNpNTEm7xwkfpo=";
+    })
+  ];
+
   vendorHash = "sha256-0psvz4bnhGuwwSAXvQp0ju0GebxoUyY2Rjp/D43KF78=";
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 83972abf8b08a..eb8b847960c53 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -1,17 +1,17 @@
 {
+  lib,
   stdenvNoCC,
-  fetchurl,
   callPackage,
   jq,
   moreutils,
   cacert,
   makeSetupHook,
   pnpm,
+  yq,
 }:
 {
   fetchDeps =
     {
-      src,
       hash ? "",
       pname,
       ...
@@ -36,15 +36,22 @@
         name = "${pname}-pnpm-deps";
 
         nativeBuildInputs = [
+          cacert
           jq
           moreutils
           pnpm
-          cacert
+          yq
         ];
 
         installPhase = ''
           runHook preInstall
 
+          lockfileVersion="$(yq -r .lockfileVersion pnpm-lock.yaml)"
+          if [[ ''${lockfileVersion:0:1} -gt ${lib.versions.major pnpm.version} ]]; then
+            echo "ERROR: lockfileVersion $lockfileVersion in pnpm-lock.yaml is too new for the provided pnpm version ${lib.versions.major pnpm.version}!"
+            exit 1
+          fi
+
           export HOME=$(mktemp -d)
           pnpm config set store-dir $out
           # Some packages produce platform dependent outputs. We do not want to cache those in the global store
diff --git a/pkgs/development/tools/pyenv/default.nix b/pkgs/development/tools/pyenv/default.nix
index 9f761ef0be276..57485de36f676 100644
--- a/pkgs/development/tools/pyenv/default.nix
+++ b/pkgs/development/tools/pyenv/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pyenv";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "pyenv";
     repo = "pyenv";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jYBKTrpc3KI1iW/VCw4Udk4TS8dXFGg5WgbEWZ+vWqE=";
+    hash = "sha256-ujbJrF7QDd2DIsZGEoJrM3VA2WNpkJNe4BZVcPokXRg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/twilio-cli/default.nix b/pkgs/development/tools/twilio-cli/default.nix
index fe0544b671378..a37c79b34f248 100644
--- a/pkgs/development/tools/twilio-cli/default.nix
+++ b/pkgs/development/tools/twilio-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "twilio-cli";
-  version = "5.21.0";
+  version = "5.21.1";
 
   src = fetchzip {
     url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-rtI89baKJS4itwTcHY9IjKeskQO6mz/c746wdVy4cG4=";
+    hash = "sha256-0hriMtxmqjQrR/gAdOk8RfyPQp2ZYCdyt/sMTUqC1/4=";
   };
 
   buildInputs = [ nodejs-slim ];
diff --git a/pkgs/development/tools/wails/default.nix b/pkgs/development/tools/wails/default.nix
index 9a158be022f39..8988424d7738a 100644
--- a/pkgs/development/tools/wails/default.nix
+++ b/pkgs/development/tools/wails/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "wails";
-  version = "2.8.2";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "wailsapp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-oJ/kxYphBTXxt7Da1x4GW/a78YV+m32iC/4N3MDjU/A=";
+    hash = "sha256-dtfFeNK7ZfqriK4S0/+Wor1hUJv5kgnRWURVqt+RrNU=";
   } + "/v2";
 
   vendorHash = "sha256-15Vo4AKmd9qOF0ea1klTlrXJOUs+IHvsNT2rw4R7ZiU=";