2 files changed, 16 insertions, 6 deletions
diff --git a/pkgs/development/php-packages/castor/default.nix b/pkgs/development/php-packages/castor/default.nix
index 241980e93d6f..1b6b3f6be9d4 100644
--- a/pkgs/development/php-packages/castor/default.nix
+++ b/pkgs/development/php-packages/castor/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , installShellFiles
 , php
 , nix-update-script
@@ -8,16 +9,25 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "castor";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "jolicode";
     repo = "castor";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Sm6I306iKVr66sBp+ADeTZAKGToVMc+Y/BCymUdszNc=";
+    hash = "sha256-sSIkXNW6RR1mx15dKouQLMaHBr5FEkTTc/0QIkWV8sg=";
   };
 
-  vendorHash = "sha256-KbmovAnejShyVclF4IcZ9ckUOWysfEz3DFqE8OxlzI0=";
+  patches = [
+    # Upstream lock is invalid. https://github.com/jolicode/castor/issues/319
+    (fetchpatch {
+      name = "fix-invalid-lock.patch";
+      url = "https://github.com/jolicode/castor/commit/5ff0c3ecbdddad20146adbc2f055b83f5aadba0f.patch";
+      hash = "sha256-1a3Dpk/UXp92Ugw9zSoLPsbWOJEuP2FBWc/pQ/EKwaM=";
+    })
+  ];
+
+  vendorHash = "sha256-HfEjwlkozeuT4LDnYwiCu7T0spcf4GLhkd7Kc1VRnro=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index 63ced11f2351..8a094ce425cd 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -2,16 +2,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "phpstan";
-  version = "1.10.59";
+  version = "1.10.60";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan-src";
     rev = finalAttrs.version;
-    hash = "sha256-2+CQtpmh2r2+87zLhx7UkYlZ7sDQdDh4S8v67PGNjLM=";
+    hash = "sha256-DKrlR3ujHWfbhPMzZhhkUCeTtKW6hpGUe4z7xgzJ4qs=";
   };
 
-  vendorHash = "sha256-6Wea4iUSFq0xSWFq4er4lzFn2mgeoYBXG1zMGM3Y390=";
+  vendorHash = "sha256-8CEg1q3K1E9M6gaa5IlSYNPZb+evaY1oxbCnySXuFGE=";
   composerStrictValidation = false;
 
   meta = {