Use flake.nix/lock as a single source of truth for resolving dependencies NOTE: this patch implies a dependency update as well.
