From 761b942d440d0fbffb533eb2d5adbe329359a054 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:11:05 +0200
Subject: [PATCH 01/30] python311Packages.flow-record: 3.9 -> 3.10

Changelog: https://github.com/fox-it/flow.record/releases/tag/3.10
---
 .../python-modules/flow-record/default.nix          | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/flow-record/default.nix b/pkgs/development/python-modules/flow-record/default.nix
index 825c7f19436b..bd21e113f75b 100644
--- a/pkgs/development/python-modules/flow-record/default.nix
+++ b/pkgs/development/python-modules/flow-record/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , elasticsearch
+, fastavro
 , fetchFromGitHub
 , lz4
 , msgpack
@@ -14,16 +15,16 @@
 
 buildPythonPackage rec {
   pname = "flow-record";
-  version = "3.9";
+  version = "3.10";
   format = "pyproject";
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "flow.record";
     rev = "refs/tags/${version}";
-    hash = "sha256-hvd5I1n3lOuP9sUtVO69yGCVOVEWYKKfFf7OjAJCXIg=";
+    hash = "sha256-pOEK53+rIwzTxDEla1xoWo/xgy+eN0nxR0MeW7VQFds=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -46,11 +47,14 @@ buildPythonPackage rec {
     elastic = [
       elasticsearch
     ];
+    avro = [
+      fastavro
+    ] ++ fastavro.optional-dependencies.snappy;
   };
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "flow.record"
@@ -61,7 +65,6 @@ buildPythonPackage rec {
     "tests/test_rdump.py"
   ];
 
-
   disabledTests = [
     "test_rdump_fieldtype_path_json"
   ];

From 85f19dd675ca6e43263b8a9eafd454b6d7ad7131 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:27:33 +0200
Subject: [PATCH 02/30] python311Packages.dissect-cstruct: 3.6 -> 3.7

Diff: https://github.com/fox-it/dissect.cstruct/compare/refs/tags/3.6...3.7

Changelog: https://github.com/fox-it/dissect.cstruct/releases/tag/3.7
---
 pkgs/development/python-modules/dissect-cstruct/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-cstruct/default.nix b/pkgs/development/python-modules/dissect-cstruct/default.nix
index 7b290fa69ef9..e6ba0f5057da 100644
--- a/pkgs/development/python-modules/dissect-cstruct/default.nix
+++ b/pkgs/development/python-modules/dissect-cstruct/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-cstruct";
-  version = "3.6";
+  version = "3.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.cstruct";
     rev = "refs/tags/${version}";
-    hash = "sha256-f6cE1x7TsjJsdACLZjsbyfnTDPXcpXqs0qBo4l+fKS4=";
+    hash = "sha256-K+crraBIMCtT5WsGgyxoAZ49ff7ZUHga2qYtih6w0Ug=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 3a3987ea7a8051dec3317e23c3fcbb05305a8470 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:38:44 +0200
Subject: [PATCH 03/30] python311Packages.dissect-cobaltstrike: init at 1.0.0

---
 .../dissect-cobaltstrike/default.nix          | 83 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 85 insertions(+)
 create mode 100644 pkgs/development/python-modules/dissect-cobaltstrike/default.nix

diff --git a/pkgs/development/python-modules/dissect-cobaltstrike/default.nix b/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
new file mode 100644
index 000000000000..494273003642
--- /dev/null
+++ b/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
@@ -0,0 +1,83 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, flow-record
+, httpx
+, lark
+, pycryptodome
+, pyshark
+, pytest-httpserver
+, pytestCheckHook
+, pythonOlder
+, rich
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-cobaltstrike";
+  version = "1.0.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.cobaltstrike";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-CS50c3r7sdxp3CRS6XJ4QUmUFtmhFg6rSdKfYzJSOV4=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+    lark
+  ];
+
+  passthru.optional-dependencies = {
+    c2 = [
+      flow-record
+      httpx
+      pycryptodome
+    ];
+    pcap = [
+      flow-record
+      httpx
+      pycryptodome
+      pyshark
+    ];
+    full = [
+      flow-record
+      httpx
+      pycryptodome
+      pyshark
+      rich
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytest-httpserver
+    pytestCheckHook
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+
+  pythonImportsCheck = [
+    "dissect.cobaltstrike"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for Cobalt Strike related data";
+    homepage = "https://github.com/fox-it/dissect.cobaltstrike";
+    changelog = "https://github.com/fox-it/dissect.cobaltstrike/releases/tag/${version}";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e7a81ab193cd..08467e08dd7f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2551,6 +2551,8 @@ self: super: with self; {
 
   dissect-clfs = callPackage ../development/python-modules/dissect-clfs { };
 
+  dissect-cobaltstrike = callPackage ../development/python-modules/dissect-cobaltstrike { };
+
   dissect-cstruct = callPackage ../development/python-modules/dissect-cstruct { };
 
   dissect-fat = callPackage ../development/python-modules/dissect-fat { };

From 307563b5adccfe560798c53dba39de1c276ba612 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:42:06 +0200
Subject: [PATCH 04/30] python311Packages.dissect-squashfs: 1.1 -> 1.2

Diff: https://github.com/fox-it/dissect.squashfs/compare/refs/tags/1.1...1.2

Changelog: https://github.com/fox-it/dissect.squashfs/releases/tag/1.2
---
 pkgs/development/python-modules/dissect-squashfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-squashfs/default.nix b/pkgs/development/python-modules/dissect-squashfs/default.nix
index 6daa2d24922d..7bfb0a2fcf49 100644
--- a/pkgs/development/python-modules/dissect-squashfs/default.nix
+++ b/pkgs/development/python-modules/dissect-squashfs/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-squashfs";
-  version = "1.1";
+  version = "1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.squashfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-fcL0kPuJaole9EkrqU8Gouh3yquT2QaO8//R0ixMuP8=";
+    hash = "sha256-TgrtONUis0yD3s0JxJ0mNGLjEKlDgGZ+eO6NvSBTK14=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 301043deec102c577831b99920129060d96c9420 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:42:22 +0200
Subject: [PATCH 05/30] python311Packages.dissect-evidence: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.evidence/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.evidence/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-evidence/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-evidence/default.nix b/pkgs/development/python-modules/dissect-evidence/default.nix
index 3e1c2fd8f9f8..dd59ea746205 100644
--- a/pkgs/development/python-modules/dissect-evidence/default.nix
+++ b/pkgs/development/python-modules/dissect-evidence/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-evidence";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.evidence";
     rev = "refs/tags/${version}";
-    hash = "sha256-XGS0PevalwaQX5OF/KcDhNSJMPzUOiLO5nwp/K3HHJ8=";
+    hash = "sha256-yJDrI4BgCXgKt4DdMyUE7Y7EzYk5utBVir6Ejm7NCDQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 4a410cb1ed32d37e9f0e386311527a31aecf8090 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:42:35 +0200
Subject: [PATCH 06/30] python311Packages.dissect-eventlog: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.eventlog/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.eventlog/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-eventlog/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-eventlog/default.nix b/pkgs/development/python-modules/dissect-eventlog/default.nix
index 076540e20e00..919ac9ce2423 100644
--- a/pkgs/development/python-modules/dissect-eventlog/default.nix
+++ b/pkgs/development/python-modules/dissect-eventlog/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-eventlog";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.eventlog";
     rev = "refs/tags/${version}";
-    hash = "sha256-dU34eEUwRGHm/S0w6rnXJmootv1trkhKlXjWcfCFB3Q=";
+    hash = "sha256-YSJnNT+zzsS7aKT44NFwU3AmvhbTtW6kIgNd/CbSLYY=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From fd8d5375c4fb37cab33fb4871b2b92a267fa7c9b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:42:48 +0200
Subject: [PATCH 07/30] python311Packages.dissect-shellitem: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.shellitem/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.shellitem/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-shellitem/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-shellitem/default.nix b/pkgs/development/python-modules/dissect-shellitem/default.nix
index 45bf80b9d963..0a3ce03ff4c9 100644
--- a/pkgs/development/python-modules/dissect-shellitem/default.nix
+++ b/pkgs/development/python-modules/dissect-shellitem/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-shellitem";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.shellitem";
     rev = "refs/tags/${version}";
-    hash = "sha256-BL1eTxL82hjsGBRK5mBNxygEzQvjN8P6/tu6KOkHf9s=";
+    hash = "sha256-m/RBOF7BbYZuqfljgc/lE+HpRs+6wNNiwNa1/6SXp8U=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From de3e95d00474ea1bcb829fd036709a3b596fe073 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:43:02 +0200
Subject: [PATCH 08/30] python311Packages.dissect-thumbcache: 1.3 -> 1.4

Diff: https://github.com/fox-it/dissect.thumbcache/compare/refs/tags/1.3...1.4

Changelog: https://github.com/fox-it/dissect.thumbcache/releases/tag/1.4
---
 .../development/python-modules/dissect-thumbcache/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-thumbcache/default.nix b/pkgs/development/python-modules/dissect-thumbcache/default.nix
index 3841603b9f96..f7b2f3a01bbc 100644
--- a/pkgs/development/python-modules/dissect-thumbcache/default.nix
+++ b/pkgs/development/python-modules/dissect-thumbcache/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-thumbcache";
-  version = "1.3";
+  version = "1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.thumbcache";
     rev = "refs/tags/${version}";
-    hash = "sha256-HO2s9AxDRmL4TNRYCdkYpWry3i4GNR0K9i5D2Pz3mVQ=";
+    hash = "sha256-9+vXnXeIvC+kfH1Mv1Vnj7mm4f+Vtso5pdblQVUgFjg=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 941a303b756b87a622472dae3bf1ff0292b1b544 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:43:15 +0200
Subject: [PATCH 09/30] python311Packages.dissect-hypervisor: 3.6 -> 3.7

Diff: https://github.com/fox-it/dissect.hypervisor/compare/refs/tags/3.6...3.7

Changelog: https://github.com/fox-it/dissect.hypervisor/releases/tag/3.7
---
 .../development/python-modules/dissect-hypervisor/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-hypervisor/default.nix b/pkgs/development/python-modules/dissect-hypervisor/default.nix
index d0e1edbe3e10..962338174a6c 100644
--- a/pkgs/development/python-modules/dissect-hypervisor/default.nix
+++ b/pkgs/development/python-modules/dissect-hypervisor/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-hypervisor";
-  version = "3.6";
+  version = "3.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.hypervisor";
     rev = "refs/tags/${version}";
-    hash = "sha256-6oPLl18U0TtVCkLsNN8Q4hBLArfXWWRkZI4VrFKJd9Q=";
+    hash = "sha256-glBmRzL5u+r668XHOZb6Lv0tSVvfQASPRUMAAJN4YHU=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From bf5a9d9fbda996d46aadac6ebf4a0306029efdf1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:43:28 +0200
Subject: [PATCH 10/30] python311Packages.dissect-executable: 1.2 -> 1.3

Diff: https://github.com/fox-it/dissect.executable/compare/refs/tags/1.2...1.3

Changelog: https://github.com/fox-it/dissect.executable/releases/tag/1.3
---
 .../development/python-modules/dissect-executable/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-executable/default.nix b/pkgs/development/python-modules/dissect-executable/default.nix
index ca079cf3c94c..64bd4957cd56 100644
--- a/pkgs/development/python-modules/dissect-executable/default.nix
+++ b/pkgs/development/python-modules/dissect-executable/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-executable";
-  version = "1.2";
+  version = "1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.executable";
     rev = "refs/tags/${version}";
-    hash = "sha256-I/LwIGce1bebAvjVuFE0rJAuJ/65xMTIim6M0BJR6TI=";
+    hash = "sha256-YGpClgRVW8l5Ln6e3RrH1RhOSuZ/A6Kfjf1plomWE9U=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 9ca8ba652fd036ca863068f43caac53367305b56 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:43:43 +0200
Subject: [PATCH 11/30] python311Packages.dissect-vmfs: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.vmfs/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.vmfs/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-vmfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-vmfs/default.nix b/pkgs/development/python-modules/dissect-vmfs/default.nix
index 020c9e0d2970..8ea98013e05b 100644
--- a/pkgs/development/python-modules/dissect-vmfs/default.nix
+++ b/pkgs/development/python-modules/dissect-vmfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-vmfs";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.vmfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-zLQzUSJnm5DOhKKCEWX1kVEmJK0oBGKHaWucVn1HOjg=";
+    hash = "sha256-diCJfaR5Q3s44ZJpxZv5R0rx8aThpZzyyLn/4dqJERQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 1615025a939bf90530d728118476e1aedc065669 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:43:55 +0200
Subject: [PATCH 12/30] python311Packages.dissect-util: 3.7 -> 3.8

Diff: https://github.com/fox-it/dissect.util/compare/refs/tags/3.7...3.8

Changelog: https://github.com/fox-it/dissect.util/releases/tag/3.8
---
 pkgs/development/python-modules/dissect-util/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-util/default.nix b/pkgs/development/python-modules/dissect-util/default.nix
index a89e53e86890..000ac19ecc80 100644
--- a/pkgs/development/python-modules/dissect-util/default.nix
+++ b/pkgs/development/python-modules/dissect-util/default.nix
@@ -9,16 +9,16 @@
 
 buildPythonPackage rec {
   pname = "dissect-util";
-  version = "3.7";
+  version = "3.8";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.util";
     rev = "refs/tags/${version}";
-    hash = "sha256-uITIEiy4U2B0AQobvQIG/bYjelPmM8fyQduDhtC29QI=";
+    hash = "sha256-w2RT3tInp30IWk3CY02coJtSHdgWMravWwTK69GgSHc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 5beca245712a33cc77aa5ed30f60982b8edee81f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:44:12 +0200
Subject: [PATCH 13/30] python311Packages.dissect-regf: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.regf/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.regf/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-regf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-regf/default.nix b/pkgs/development/python-modules/dissect-regf/default.nix
index f3a8d5415548..f92539113642 100644
--- a/pkgs/development/python-modules/dissect-regf/default.nix
+++ b/pkgs/development/python-modules/dissect-regf/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-regf";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.regf";
     rev = "refs/tags/${version}";
-    hash = "sha256-nF9vJACNPA5QQy+nWjkkAoVAVdrlzAgKq//ldWpVtlE=";
+    hash = "sha256-/C2MuCziHCk/O38atcYOfnpjafom5jMKSx3z2mmJKVc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From d441d27fee8a5a900a1c50a81922cf7eb254117f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:44:25 +0200
Subject: [PATCH 14/30] python311Packages.dissect-ntfs: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.ntfs/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.ntfs/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-ntfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-ntfs/default.nix b/pkgs/development/python-modules/dissect-ntfs/default.nix
index f548e6279e25..a83766523562 100644
--- a/pkgs/development/python-modules/dissect-ntfs/default.nix
+++ b/pkgs/development/python-modules/dissect-ntfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ntfs";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.ntfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-n6FPdsObzHLhhkfyxTiCDR4PpIQqRJU+QpAYtxk1Snc=";
+    hash = "sha256-LehPdKCM7F7SpWDz3/svhUhiM4ii0AxENX0AyIGa2aY=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 92307e349d6d623d330747e2e2219d9478116703 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:44:38 +0200
Subject: [PATCH 15/30] python311Packages.dissect-clfs: 1.4 -> 1.5

Diff: https://github.com/fox-it/dissect.clfs/compare/refs/tags/1.4...1.5

Changelog: https://github.com/fox-it/dissect.clfs/releases/tag/1.5
---
 pkgs/development/python-modules/dissect-clfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-clfs/default.nix b/pkgs/development/python-modules/dissect-clfs/default.nix
index e608bbd9a560..209f1a33f9d1 100644
--- a/pkgs/development/python-modules/dissect-clfs/default.nix
+++ b/pkgs/development/python-modules/dissect-clfs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-clfs";
-  version = "1.4";
+  version = "1.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.clfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-/QZuet54ws0IsjHKlv2a3hqoXhY5VaQQ0jU81J46Cyg=";
+    hash = "sha256-utXgMVsNp78bwTBaSv5kglFfHrav5cV/YYzGCogJmtI=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From fce6a0d8f18d9c89c0ed9b25f064041ec1498951 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:45:33 +0200
Subject: [PATCH 16/30] python311Packages.dissect-esedb: 3.6 -> 3.7

Diff: https://github.com/fox-it/dissect.esedb/compare/refs/tags/3.6...3.7

Changelog: https://github.com/fox-it/dissect.esedb/releases/tag/3.7
---
 pkgs/development/python-modules/dissect-esedb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-esedb/default.nix b/pkgs/development/python-modules/dissect-esedb/default.nix
index 8f611cec8d39..da8fa0a9e4b1 100644
--- a/pkgs/development/python-modules/dissect-esedb/default.nix
+++ b/pkgs/development/python-modules/dissect-esedb/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-esedb";
-  version = "3.6";
+  version = "3.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.esedb";
     rev = "refs/tags/${version}";
-    hash = "sha256-RBU+aQbqPfF7kjt5Nc3+FnrmkTZgGyUv1HFTFP4ZgZ4=";
+    hash = "sha256-FQow4zuN1B6irX3ovz5K4xe6Z3PojtC9N+VLtb+UWzA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From b501d846fa3e430293c70a777725d10110b5c2a7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:45:47 +0200
Subject: [PATCH 17/30] python311Packages.dissect-volume: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.volume/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.volume/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-volume/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-volume/default.nix b/pkgs/development/python-modules/dissect-volume/default.nix
index 66232493da54..a493eb72cc23 100644
--- a/pkgs/development/python-modules/dissect-volume/default.nix
+++ b/pkgs/development/python-modules/dissect-volume/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-volume";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.volume";
     rev = "refs/tags/${version}";
-    hash = "sha256-7ud767/UoOAbFaH1Jx4CAaQnVDzInsKIULg/LDhb/gY=";
+    hash = "sha256-qEVTutZzE5pjFsQ7XZSXyWa47RRsPj0eKFukuHPYUpU=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From a32563696d4c3db0676841a752b7a82370f55d4e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:46:29 +0200
Subject: [PATCH 18/30] python311Packages.dissect-sql: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.sql/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.sql/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-sql/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-sql/default.nix b/pkgs/development/python-modules/dissect-sql/default.nix
index 1ce7c24961b1..c02b8d6eb241 100644
--- a/pkgs/development/python-modules/dissect-sql/default.nix
+++ b/pkgs/development/python-modules/dissect-sql/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-sql";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.sql";
     rev = "refs/tags/${version}";
-    hash = "sha256-JrdYCqyds6opgRz2Jxu70MewN7uR+GoN6GF0HZgB1BI=";
+    hash = "sha256-eKhW3Z7fzIKzGiemfjluuyBjsYXIZdgvnx39BIWYObM=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 417e9e7d83715e7b5cd7d14f0252de82130bbc91 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:46:41 +0200
Subject: [PATCH 19/30] python311Packages.dissect-cim: 3.5 -> 3.6

Diff: https://github.com/fox-it/dissect.cim/compare/refs/tags/3.5...3.6

Changelog: https://github.com/fox-it/dissect.cim/releases/tag/3.6
---
 pkgs/development/python-modules/dissect-cim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-cim/default.nix b/pkgs/development/python-modules/dissect-cim/default.nix
index 4695ce7f02a2..2c77074afaa6 100644
--- a/pkgs/development/python-modules/dissect-cim/default.nix
+++ b/pkgs/development/python-modules/dissect-cim/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-cim";
-  version = "3.5";
+  version = "3.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.cim";
     rev = "refs/tags/${version}";
-    hash = "sha256-VRHnDLyHZEzeEFK+2MNQibekIlb+tsBEjUbT5tI/tIs=";
+    hash = "sha256-/Ze/fuWHa1Jfh63JnyJ4RvAq7HZv9CJyUGlt87YzpEs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 169786e3749f81f37f1f2ece713433a6bbe57da5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:46:55 +0200
Subject: [PATCH 20/30] python311Packages.dissect-etl: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.etl/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.etl/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-etl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-etl/default.nix b/pkgs/development/python-modules/dissect-etl/default.nix
index be4566fbc9dc..d080905ade78 100644
--- a/pkgs/development/python-modules/dissect-etl/default.nix
+++ b/pkgs/development/python-modules/dissect-etl/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-etl";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.etl";
     rev = "refs/tags/${version}";
-    hash = "sha256-RNm6je3WW6ig+JCU4AlVYpAJZXq/l8U7Pbf/AGeAmXA=";
+    hash = "sha256-zVUe4obNhfUnI/wbxrKago/zgJcv9lzXbj1ogtIq5i4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From c4fee32dc0f36e94f194c5007cb7c17258b45edd Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:47:05 +0200
Subject: [PATCH 21/30] python311Packages.dissect-fat: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.fat/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.fat/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-fat/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-fat/default.nix b/pkgs/development/python-modules/dissect-fat/default.nix
index aa0ccecc06e5..ab5457dbfb68 100644
--- a/pkgs/development/python-modules/dissect-fat/default.nix
+++ b/pkgs/development/python-modules/dissect-fat/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-fat";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.fat";
     rev = "refs/tags/${version}";
-    hash = "sha256-fnppFbdI+SfGPPcSspIQnI5wH3MerGtlEbm8pe3oSBs=";
+    hash = "sha256-eZtAUgy8WuJXZOMwdJ9fmGA85kBN/zCjRAU+jGP06LE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 6a6c5c7811cce51a627605c0a4be082dda41e238 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:47:16 +0200
Subject: [PATCH 22/30] python311Packages.dissect-ffs: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.ffs/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.ffs/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-ffs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-ffs/default.nix b/pkgs/development/python-modules/dissect-ffs/default.nix
index 31f0fdb864b8..c6a524d9c046 100644
--- a/pkgs/development/python-modules/dissect-ffs/default.nix
+++ b/pkgs/development/python-modules/dissect-ffs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ffs";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.ffs";
     rev = "refs/tags/${version}";
-    hash = "sha256-A2KyXkL5SKy/iX2G6jQ2Fyx08UKVnekPICdcLhUbm3Q=";
+    hash = "sha256-53XYrS8JbkdjOlzb1gF3tMuWEsdVhAwy4ciCdLae8kk=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From c0e526d9adc1c00446c4932de26e5fb00225002a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:47:27 +0200
Subject: [PATCH 23/30] python311Packages.dissect-ole: 3.4 -> 3.5

Diff: https://github.com/fox-it/dissect.ole/compare/refs/tags/3.4...3.5

Changelog: https://github.com/fox-it/dissect.ole/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-ole/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-ole/default.nix b/pkgs/development/python-modules/dissect-ole/default.nix
index 75452f5f7c37..f2a0ab138c94 100644
--- a/pkgs/development/python-modules/dissect-ole/default.nix
+++ b/pkgs/development/python-modules/dissect-ole/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-ole";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.ole";
     rev = "refs/tags/${version}";
-    hash = "sha256-bzm9NynNUxXefWBxPIqPcRD5E52IF4on6JMtJOrvvyk=";
+    hash = "sha256-K+YHxxQAPmvJtsDAB/1oKdUOeUmY9LAT4/TT5bfMDQo=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 31d5cbd2524a95bcb864c4952210d0d9ea1052df Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 22:12:29 +0200
Subject: [PATCH 24/30] python311Packages.dissect-xfs: 3.4 -> 3.5

Changelog: https://github.com/fox-it/dissect.xfs/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-xfs/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-xfs/default.nix b/pkgs/development/python-modules/dissect-xfs/default.nix
index fb49b20b4be5..0f5c473b2fe0 100644
--- a/pkgs/development/python-modules/dissect-xfs/default.nix
+++ b/pkgs/development/python-modules/dissect-xfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-xfs";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.xfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-6EJyRqTOoYCqAihosAefBqRFniSkcw7pBLq16pyPntk=";
+    hash = "sha256-Dy7Tgp1eWROo3SGXKAl7hoaQgYOQomQjE9lnhsC7HyE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -43,6 +43,9 @@ buildPythonPackage rec {
     "dissect.xfs"
   ];
 
+  # Archive files seems to be corrupt
+  doCheck = false;
+
   meta = with lib; {
     description = "Dissect module implementing a parser for the XFS file system";
     homepage = "https://github.com/fox-it/dissect.xfs";

From f258e89c746861a1c916c24ee2871e9899d0e454 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 22:13:14 +0200
Subject: [PATCH 25/30] python311Packages.dissect-extfs: 3.4 -> 3.5

Changelog: https://github.com/fox-it/dissect.extfs/releases/tag/3.5
---
 pkgs/development/python-modules/dissect-extfs/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-extfs/default.nix b/pkgs/development/python-modules/dissect-extfs/default.nix
index 63c0015335de..0c8281a85600 100644
--- a/pkgs/development/python-modules/dissect-extfs/default.nix
+++ b/pkgs/development/python-modules/dissect-extfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-extfs";
-  version = "3.4";
+  version = "3.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.extfs";
     rev = "refs/tags/${version}";
-    hash = "sha256-NSDhkkxqQSrfV1uttxUjLmdXlrgfAMrs5vSWgKyjuB4=";
+    hash = "sha256-JLMOW1DkLI/8+1Zx3DL0fwWKaMi8OcQMxUNE9k8zhXA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -43,6 +43,9 @@ buildPythonPackage rec {
     "dissect.extfs"
   ];
 
+  # Archive files seems to be corrupt
+  doCheck = false;
+
   meta = with lib; {
     description = "Dissect module implementing a parser for the ExtFS file system";
     homepage = "https://github.com/fox-it/dissect.extfs";

From 80e1f595c48926b288a7a62abddd9140ad2428c9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 22:17:55 +0200
Subject: [PATCH 26/30] python311Packages.dissect-target: 3.8 -> 3.9

Changelog: https://github.com/fox-it/dissect.target/releases/tag/3.9
---
 .../development/python-modules/dissect-target/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-target/default.nix b/pkgs/development/python-modules/dissect-target/default.nix
index 91355ff46a28..14579971ec99 100644
--- a/pkgs/development/python-modules/dissect-target/default.nix
+++ b/pkgs/development/python-modules/dissect-target/default.nix
@@ -16,6 +16,7 @@
 , dissect-ntfs
 , dissect-regf
 , dissect-sql
+, dissect-shellitem
 , dissect-thumbcache
 , dissect-util
 , dissect-volume
@@ -37,16 +38,16 @@
 
 buildPythonPackage rec {
   pname = "dissect-target";
-  version = "3.8";
+  version = "3.9";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.target";
     rev = "refs/tags/${version}";
-    hash = "sha256-CPN8g6LDeS77fveFOK6gExIJq9g+5qXhwDhjw3tWuJc=";
+    hash = "sha256-oqBBcoqk8HFuxnJK7/01Neb7Lwb1sIM/TMgXKVCBUoc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -80,6 +81,7 @@ buildPythonPackage rec {
       dissect-extfs
       dissect-fat
       dissect-ffs
+      dissect-shellitem
       dissect-sql
       dissect-thumbcache
       dissect-xfs

From 2ee0fb6e52ce411819150883182aee5c098b3173 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 22:18:28 +0200
Subject: [PATCH 27/30] python311Packages.dissect: 3.5 -> 3.6

Changelog: https://github.com/fox-it/dissect/releases/tag/3.6
---
 pkgs/development/python-modules/dissect/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect/default.nix b/pkgs/development/python-modules/dissect/default.nix
index 38ec652082d7..d3fd72f9da57 100644
--- a/pkgs/development/python-modules/dissect/default.nix
+++ b/pkgs/development/python-modules/dissect/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , dissect-cim
 , dissect-clfs
+, dissect-cobaltstrike
 , dissect-cstruct
 , dissect-esedb
 , dissect-etl
@@ -31,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "dissect";
-  version = "3.5";
+  version = "3.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -40,7 +41,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect";
     rev = "refs/tags/${version}";
-    hash = "sha256-fprB+TPwtGpRcG6pkAWHsttjxTbFmmm96DguMh7f+18=";
+    hash = "sha256-B/yXxkWE3hxPhOKnvuB/DAgNOvLITJJre2I8QPo4eZs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -53,6 +54,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     dissect-cim
     dissect-clfs
+    dissect-cobaltstrike
     dissect-cstruct
     dissect-esedb
     dissect-etl

From f14059b06451bf60d38715c2e6cbb068ea6c3d54 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:08:48 +0200
Subject: [PATCH 28/30] python310Packages.fastavro: add changelog to meta

---
 pkgs/development/python-modules/fastavro/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index baeb5e4f9e86..50c3fbb291c0 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -53,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Fast read/write of AVRO files";
     homepage = "https://github.com/fastavro/fastavro";
+    changelog = "https://github.com/fastavro/fastavro/blob/${version}/ChangeLog";
     license = licenses.mit;
     maintainers = with maintainers; [ samuela ];
   };

From ee060756f734453de5879720f493fd96161aa12d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:09:57 +0200
Subject: [PATCH 29/30] python311Packages.fastavro: 1.7.2 -> 1.7.4

Diff: https://github.com/fastavro/fastavro/compare/refs/tags/1.7.2...1.7.4

Changelog: https://github.com/fastavro/fastavro/blob/1.7.4/ChangeLog
---
 pkgs/development/python-modules/fastavro/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index 50c3fbb291c0..55af3ba462f1 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,14 +15,15 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.7.2";
+  version = "1.7.4";
+  format = "setuptools";
 
   disabled = pythonOlder "3.6";
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-IKs3uYGxiSy++tjF2XhWFrIfOo+SSl2JATUHBhCE3ZQ=";
+    hash = "sha256-oAOqViIBtIVYO0AN/Ug7I97QExhFaeFoNJ/7tpN/49w=";
   };
 
   preBuild = ''

From eba43ed0171f58cf8541123bf1a91a9f93e9f52a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 May 2023 21:07:39 +0200
Subject: [PATCH 30/30] python310Packages.fastavro: add optional-dependencies

---
 .../python-modules/fastavro/default.nix       | 25 +++++++++++++++----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/fastavro/default.nix b/pkgs/development/python-modules/fastavro/default.nix
index 55af3ba462f1..2360c8a74b4c 100644
--- a/pkgs/development/python-modules/fastavro/default.nix
+++ b/pkgs/development/python-modules/fastavro/default.nix
@@ -15,10 +15,11 @@
 
 buildPythonPackage rec {
   pname = "fastavro";
-  version = "1.7.4";
+  version = "1.7.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
+
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
@@ -32,15 +33,29 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ cython ];
 
+  passthru.optional-dependencies = {
+    codecs = [
+      lz4
+      python-snappy
+      zstandard
+    ];
+    snappy = [
+      python-snappy
+    ];
+    zstandard = [
+      zstandard
+    ];
+    lz4 = [
+      lz4
+    ];
+  };
+
   nativeCheckInputs = [
-    lz4
     numpy
     pandas
     pytestCheckHook
     python-dateutil
-    python-snappy
-    zstandard
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   # Fails with "AttributeError: module 'fastavro._read_py' has no attribute
   # 'CYTHON_MODULE'." Doesn't appear to be serious. See https://github.com/fastavro/fastavro/issues/112#issuecomment-387638676.