diff --git a/flake.lock b/flake.lock
index 68d62d2..40b7e38 100644
--- a/flake.lock
+++ b/flake.lock
@@ -166,11 +166,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1684930100,
-        "narHash": "sha256-4Er+eDDOP5n0xZTRCzX6b3yXBELTQ4sL50DsoNyGTFs=",
+        "lastModified": 1685189241,
+        "narHash": "sha256-XgQ/Tz73zkJPcI6xKj2GKL21Rbw6gfQ0DSybziJlsVE=",
         "owner": "mitchellh",
         "repo": "zig-overlay",
-        "rev": "e790ca67626dc23cbab19ab66e394ed1e9960046",
+        "rev": "93206e0ae7ca779609d4a663d8e4d5bee3ae6fce",
         "type": "github"
       },
       "original": {
diff --git a/src/http_auth.zig b/src/http_auth.zig
index c62d40d..71ee4c6 100644
--- a/src/http_auth.zig
+++ b/src/http_auth.zig
@@ -468,6 +468,9 @@ pub fn UserPassSessionAuth(comptime Lookup: type, comptime lockedPwLookups: bool
                         return .AuthOK;
                     } else {
                         zap.debug("Auth: COKIE IS BAD!!!!: {s}\n", .{cookie.str});
+                        // this is not necessarily a bad thing. it could be a
+                        // stale cookie from a previous session. So let's check
+                        // if username and password are being sent and correct.
                     }
                 }
             } else |err| {
diff --git a/tools/pkghash.zig b/tools/pkghash.zig
index 9bb5561..6ce6a69 100644
--- a/tools/pkghash.zig
+++ b/tools/pkghash.zig
@@ -411,7 +411,7 @@ pub fn computePackageHashExcludingDirectories(
         }
     }
 
-    std.sort.sort(*HashedFile, all_files.items, {}, HashedFile.lessThan);
+    std.mem.sort(*HashedFile, all_files.items, {}, HashedFile.lessThan);
 
     var hasher = Manifest.Hash.init(.{});
     var any_failures = false;
@@ -469,7 +469,7 @@ pub fn computePackageHashForFileList(
         }
     }
 
-    std.sort.sort(*HashedFile, all_files.items, {}, HashedFile.lessThan);
+    std.mem.sort(*HashedFile, all_files.items, {}, HashedFile.lessThan);
 
     var hasher = Manifest.Hash.init(.{});
     var any_failures = false;