diff --git a/third_party/sandboxroot/BUILD.bazel b/third_party/sandboxroot/BUILD.bazel
index 9b30e24..1c29826 100644
--- a/third_party/sandboxroot/BUILD.bazel
+++ b/third_party/sandboxroot/BUILD.bazel
@@ -11,7 +11,7 @@
     name = "sandbox",
     rpms = [
         "@acpica-tools-0__20220331-4.fc37.x86_64//rpm",
-        "@alternatives-0__1.21-1.fc37.x86_64//rpm",
+        "@alternatives-0__1.22-1.fc37.x86_64//rpm",
         "@ansible-srpm-macros-0__1-8.1.fc37.x86_64//rpm",
         "@audit-libs-0__3.1-2.fc37.x86_64//rpm",
         "@authselect-0__1.4.2-1.fc37.x86_64//rpm",
@@ -25,15 +25,15 @@
         "@bzip2-libs-0__1.0.8-12.fc37.x86_64//rpm",
         "@ca-certificates-0__2023.2.60-1.0.fc37.x86_64//rpm",
         "@capstone-0__4.0.2-11.fc37.x86_64//rpm",
-        "@checkpolicy-0__3.4-3.fc37.x86_64//rpm",
-        "@clang-0__15.0.7-1.fc37.x86_64//rpm",
-        "@clang-libs-0__15.0.7-1.fc37.x86_64//rpm",
-        "@clang-resource-filesystem-0__15.0.7-1.fc37.x86_64//rpm",
+        "@checkpolicy-0__3.5-1.fc37.x86_64//rpm",
+        "@clang-0__15.0.7-2.fc37.x86_64//rpm",
+        "@clang-libs-0__15.0.7-2.fc37.x86_64//rpm",
+        "@clang-resource-filesystem-0__15.0.7-2.fc37.x86_64//rpm",
         "@coreutils-single-0__9.1-7.fc37.x86_64//rpm",
         "@cpp-0__12.2.1-4.fc37.x86_64//rpm",
         "@cracklib-0__2.9.7-30.fc37.x86_64//rpm",
         "@crypto-policies-0__20220815-1.gite4ed860.fc37.x86_64//rpm",
-        "@curl-minimal-0__7.85.0-7.fc37.x86_64//rpm",
+        "@curl-minimal-0__7.85.0-8.fc37.x86_64//rpm",
         "@cyrus-sasl-lib-0__2.1.28-8.fc37.x86_64//rpm",
         "@daxctl-libs-0__76.1-1.fc37.x86_64//rpm",
         "@dbus-1__1.14.6-1.fc37.x86_64//rpm",
@@ -43,7 +43,7 @@
         "@dwz-0__0.14-7.fc37.x86_64//rpm",
         "@e2fsprogs-libs-0__1.46.5-3.fc37.x86_64//rpm",
         "@ed-0__1.18-2.fc37.x86_64//rpm",
-        "@edk2-ovmf-0__20221117gitfff6d81270b5-14.fc37.x86_64//rpm",
+        "@edk2-ovmf-0__20230301gitf80f052277c8-1.fc37.x86_64//rpm",
         "@efi-srpm-macros-0__5-6.fc37.x86_64//rpm",
         "@elfutils-debuginfod-client-0__0.189-1.fc37.x86_64//rpm",
         "@elfutils-default-yama-scope-0__0.189-1.fc37.x86_64//rpm",
@@ -90,7 +90,7 @@
         "@gzip-0__1.12-2.fc37.x86_64//rpm",
         "@ipxe-roms-qemu-0__20220210-2.git64113751.fc37.x86_64//rpm",
         "@json-glib-0__1.6.6-3.fc37.x86_64//rpm",
-        "@kernel-headers-0__6.1.5-200.fc37.x86_64//rpm",
+        "@kernel-headers-0__6.2.6-200.fc37.x86_64//rpm",
         "@kernel-srpm-macros-0__1.0-15.fc37.x86_64//rpm",
         "@keyutils-libs-0__1.6.1-5.fc37.x86_64//rpm",
         "@kmod-libs-0__30-2.fc37.x86_64//rpm",
@@ -106,7 +106,7 @@
         "@libcap-0__2.48-5.fc37.x86_64//rpm",
         "@libcap-ng-0__0.8.3-3.fc37.x86_64//rpm",
         "@libcom_err-0__1.46.5-3.fc37.x86_64//rpm",
-        "@libcurl-minimal-0__7.85.0-7.fc37.x86_64//rpm",
+        "@libcurl-minimal-0__7.85.0-8.fc37.x86_64//rpm",
         "@libdb-0__5.3.28-53.fc37.x86_64//rpm",
         "@libeconf-0__0.4.0-4.fc37.x86_64//rpm",
         "@libedit-0__3.1-43.20221009cvs.fc37.x86_64//rpm",
@@ -133,10 +133,10 @@
         "@libpwquality-0__1.4.5-3.fc37.x86_64//rpm",
         "@librdmacm-0__41.0-1.fc37.x86_64//rpm",
         "@libseccomp-0__2.5.3-3.fc37.x86_64//rpm",
-        "@libselinux-0__3.4-5.fc37.x86_64//rpm",
-        "@libselinux-utils-0__3.4-5.fc37.x86_64//rpm",
-        "@libsemanage-0__3.4-5.fc37.x86_64//rpm",
-        "@libsepol-0__3.4-3.fc37.x86_64//rpm",
+        "@libselinux-0__3.5-1.fc37.x86_64//rpm",
+        "@libselinux-utils-0__3.5-1.fc37.x86_64//rpm",
+        "@libsemanage-0__3.5-1.fc37.x86_64//rpm",
+        "@libsepol-0__3.5-1.fc37.x86_64//rpm",
         "@libsigsegv-0__2.14-3.fc37.x86_64//rpm",
         "@libslirp-0__4.7.0-2.fc37.x86_64//rpm",
         "@libsmartcols-0__2.38.1-1.fc37.x86_64//rpm",
@@ -416,8 +416,8 @@
         "@pkgconf-0__1.8.0-3.fc37.x86_64//rpm",
         "@pkgconf-m4-0__1.8.0-3.fc37.x86_64//rpm",
         "@pkgconf-pkg-config-0__1.8.0-3.fc37.x86_64//rpm",
-        "@policycoreutils-0__3.4-6.fc37.x86_64//rpm",
-        "@policycoreutils-python-utils-0__3.4-6.fc37.x86_64//rpm",
+        "@policycoreutils-0__3.5-1.fc37.x86_64//rpm",
+        "@policycoreutils-python-utils-0__3.5-1.fc37.x86_64//rpm",
         "@popt-0__1.19-1.fc37.x86_64//rpm",
         "@protobuf-c-0__1.4.1-2.fc37.x86_64//rpm",
         "@pyproject-srpm-macros-0__1.6.3-1.fc37.x86_64//rpm",
@@ -427,15 +427,16 @@
         "@python-unversioned-command-0__3.11.2-1.fc37.x86_64//rpm",
         "@python3-0__3.11.2-1.fc37.x86_64//rpm",
         "@python3-audit-0__3.1-2.fc37.x86_64//rpm",
+        "@python3-distro-0__1.7.0-3.fc37.x86_64//rpm",
         "@python3-libs-0__3.11.2-1.fc37.x86_64//rpm",
-        "@python3-libselinux-0__3.4-5.fc37.x86_64//rpm",
-        "@python3-libsemanage-0__3.4-5.fc37.x86_64//rpm",
-        "@python3-policycoreutils-0__3.4-6.fc37.x86_64//rpm",
+        "@python3-libselinux-0__3.5-1.fc37.x86_64//rpm",
+        "@python3-libsemanage-0__3.5-1.fc37.x86_64//rpm",
+        "@python3-policycoreutils-0__3.5-1.fc37.x86_64//rpm",
         "@python3-pyparsing-0__3.0.9-2.fc37.x86_64//rpm",
         "@python3-setools-0__4.4.0-9.fc37.x86_64//rpm",
         "@python3-setuptools-0__62.6.0-2.fc37.x86_64//rpm",
-        "@qemu-common-2__7.0.0-14.fc37.x86_64//rpm",
-        "@qemu-system-x86-core-2__7.0.0-14.fc37.x86_64//rpm",
+        "@qemu-common-2__7.0.0-15.fc37.x86_64//rpm",
+        "@qemu-system-x86-core-2__7.0.0-15.fc37.x86_64//rpm",
         "@qt5-srpm-macros-0__5.15.8-1.fc37.x86_64//rpm",
         "@readline-0__8.2-2.fc37.x86_64//rpm",
         "@redhat-rpm-config-0__229-1.fc37.x86_64//rpm",
@@ -445,24 +446,24 @@
         "@rpmautospec-rpm-macros-0__0.3.5-1.fc37.x86_64//rpm",
         "@rsync-0__3.2.7-1.fc37.x86_64//rpm",
         "@rust-srpm-macros-0__24-1.fc37.x86_64//rpm",
-        "@seabios-bin-0__1.16.1-2.fc37.x86_64//rpm",
-        "@seavgabios-bin-0__1.16.1-2.fc37.x86_64//rpm",
+        "@seabios-bin-0__1.16.2-1.fc37.x86_64//rpm",
+        "@seavgabios-bin-0__1.16.2-1.fc37.x86_64//rpm",
         "@sed-0__4.8-11.fc37.x86_64//rpm",
         "@selinux-policy-0__37.19-1.fc37.x86_64//rpm",
         "@selinux-policy-minimum-0__37.19-1.fc37.x86_64//rpm",
         "@setup-0__2.14.1-2.fc37.x86_64//rpm",
         "@sgabios-bin-1__0.20180715git-9.fc37.x86_64//rpm",
-        "@shadow-utils-2__4.12.3-4.fc37.x86_64//rpm",
+        "@shadow-utils-2__4.12.3-6.fc37.x86_64//rpm",
         "@snappy-0__1.1.9-5.fc37.x86_64//rpm",
         "@sqlite-libs-0__3.40.0-1.fc37.x86_64//rpm",
         "@swtpm-0__0.7.3-2.20220427gitf2268ee.fc37.x86_64//rpm",
         "@swtpm-libs-0__0.7.3-2.20220427gitf2268ee.fc37.x86_64//rpm",
         "@swtpm-tools-0__0.7.3-2.20220427gitf2268ee.fc37.x86_64//rpm",
-        "@systemd-0__251.13-5.fc37.x86_64//rpm",
-        "@systemd-libs-0__251.13-5.fc37.x86_64//rpm",
-        "@systemd-pam-0__251.13-5.fc37.x86_64//rpm",
+        "@systemd-0__251.13-6.fc37.x86_64//rpm",
+        "@systemd-libs-0__251.13-6.fc37.x86_64//rpm",
+        "@systemd-pam-0__251.13-6.fc37.x86_64//rpm",
         "@systemtap-sdt-devel-0__4.8__tilde__pre16594741g5bdc37b9-1.fc37.x86_64//rpm",
-        "@tar-2__1.34-5.fc37.x86_64//rpm",
+        "@tar-2__1.34-6.fc37.x86_64//rpm",
         "@trousers-0__0.3.15-7.fc37.x86_64//rpm",
         "@trousers-lib-0__0.3.15-7.fc37.x86_64//rpm",
         "@tzdata-0__2022g-1.fc37.x86_64//rpm",
@@ -470,8 +471,8 @@
         "@unzip-0__6.0-58.fc37.x86_64//rpm",
         "@util-linux-0__2.38.1-1.fc37.x86_64//rpm",
         "@util-linux-core-0__2.38.1-1.fc37.x86_64//rpm",
-        "@xen-libs-0__4.16.3-3.fc37.x86_64//rpm",
-        "@xen-licenses-0__4.16.3-3.fc37.x86_64//rpm",
+        "@xen-libs-0__4.16.3-4.fc37.x86_64//rpm",
+        "@xen-licenses-0__4.16.3-4.fc37.x86_64//rpm",
         "@xxhash-libs-0__0.8.1-3.fc37.x86_64//rpm",
         "@xz-0__5.4.1-1.fc37.x86_64//rpm",
         "@xz-libs-0__5.4.1-1.fc37.x86_64//rpm",