diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 1a55693b9afd..e8a21ad7661e 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -51,6 +51,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [hyprland](https://github.com/hyprwm/hyprland), a dynamic tiling Wayland compositor that doesn't sacrifice on its looks. Available as [programs.hyprland](#opt-programs.hyprland.enable).
 
+- [minipro](https://gitlab.com/DavidGriffith/minipro/), an open source program for controlling the MiniPRO TL866xx series of chip programmers. Available as [programs.minipro](options.html#opt-programs.minipro.enable).
+
 - [stevenblack-blocklist](https://github.com/StevenBlack/hosts), A unified hosts file with base extensions for blocking unwanted websites. Available as [networking.stevenblack](options.html#opt-networking.stevenblack.enable).
 
 - [Budgie Desktop](https://github.com/BuddiesOfBudgie/budgie-desktop), a familiar, modern desktop environment. Availabe as [services.xserver.desktopManager.budgie](options.html#opt-services.xserver.desktopManager.budgie).
diff --git a/nixos/modules/programs/minipro.nix b/nixos/modules/programs/minipro.nix
new file mode 100644
index 000000000000..a947f83f2ee0
--- /dev/null
+++ b/nixos/modules/programs/minipro.nix
@@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.programs.minipro;
+in
+{
+  options = {
+    programs.minipro = {
+      enable = lib.mkEnableOption (lib.mdDoc "minipro") // {
+        description = lib.mdDoc ''
+          Installs minipro and its udev rules.
+          Users of the `plugdev` group can interact with connected MiniPRO chip programmers.
+        '';
+      };
+
+      package = lib.mkPackageOptionMD pkgs "minipro" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups.plugdev = { };
+    environment.systemPackages = [ cfg.package ];
+    services.udev.packages = [ cfg.package ];
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ infinidoge ];
+  };
+}
diff --git a/pkgs/applications/editors/emacs/generic.nix b/pkgs/applications/editors/emacs/generic.nix
index 67dc7721baf5..53043294539a 100644
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@@ -262,6 +262,7 @@ in
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ lovek323 jwiegley adisbladis matthewbauer atemu ];
     platforms   = if withMacport then platforms.darwin else platforms.all;
+    broken      = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
 
     longDescription = ''
       GNU Emacs is an extensible, customizable text editor—and more.  At its
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index 768a01b3de83..5b75fc6d59b3 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.15.1";
+  version = "5.16.0";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    sha256 = "sha256-qCWKmn0buITZo86hQncXWuEDQq0rITrCz/aRVR1+Zt4=";
+    sha256 = "sha256-M5zTnzuei/sECvRe89Dau72iIUuMtaLJyYTGeEF4GPo=";
   };
 
   vendorHash = "sha256-3wtE2Cz+AVF+zfsLH/+6KMHPihYcuYsrzTguHNnwT+U=";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 7d6a8b58ed2f..be0ed012a39c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -73,11 +73,11 @@
     "vendorHash": "sha256-DqAHkNxfI1txtW9PadHzgWuRCiuV/CVqq/qba+e0O7M="
   },
   "argocd": {
-    "hash": "sha256-fmIbmjXOwIvtNMNQHtg3ucKzwXdh0do8DW5c6iYlil0=",
+    "hash": "sha256-IDPX+j9bxQGoBpG/XpLpsFx48iDLcCUzDso08xAsOf0=",
     "homepage": "https://registry.terraform.io/providers/oboukili/argocd",
     "owner": "oboukili",
     "repo": "terraform-provider-argocd",
-    "rev": "v5.0.1",
+    "rev": "v5.1.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-mKefDPwWPlUleoAkJpTvJwQeOb7pA80cZQ7fpwir6kk="
   },
@@ -327,13 +327,13 @@
     "vendorHash": "sha256-Ba4J6LUchqhdZTxcJxTgP20aZVioybIzKvF4j5TDQIk="
   },
   "dnsimple": {
-    "hash": "sha256-fLYaGjQy4NtXuVePYQ8/dI7W04QM6UV3h6f2qU8hM6k=",
+    "hash": "sha256-40ueiX2LrtTyiMgCgHRq07hMYrLKh6N+7wfrXr+MC7w=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v0.16.3",
+    "rev": "v0.17.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gARkcCVDxamHHyLhUaJ85OGDmUjeOW8LUxVyM348QUY="
+    "vendorHash": "sha256-LXRNq5nxoZ6xZdKioT6cjyLaYChRAN28PzKsJ5BRako="
   },
   "docker": {
     "hash": "sha256-UyHOI8C0eDV5YllAi9clHp/CEldHjIp3FHHMPy1rK58=",
@@ -539,11 +539,11 @@
     "vendorHash": "sha256-rxh8Me+eOKPCbfHFT3tRsbM7JU67dBqv2JOiWArI/2Y="
   },
   "huaweicloud": {
-    "hash": "sha256-oPwvZClbKk4fbYc+cVHINcxNBU55w8LK53oyTUsCrTw=",
+    "hash": "sha256-VK/b74pGB8vjaWmUi8Zz4K5utIUYlfeYk18YZF8J1jI=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.47.0",
+    "rev": "v1.47.1",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -764,13 +764,13 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-BGfIem4k0fQ6C5igNRBIOvd7ZRD7RKtTD59n5gdzht4=",
+    "hash": "sha256-/q1kKXdeVjxliE1HeGiusscLM4pYylgik88nxk5gPcs=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.20.1",
+    "rev": "v3.20.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-X/piLF1xMA/epnL/g0ZY0N+5PUjFZhNBV/lmsrwqwpA="
+    "vendorHash": "sha256-WF4AdTu6lxoNSCsFKLMeQbHgH6j+hM0VNBRsue+azJA="
   },
   "nomad": {
     "hash": "sha256-oHY+jM4JQgLlE1wd+/H9H8H2g0e9ZuxI6OMlz3Izfjg=",
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 0abb3ec0db05..48220b18a30b 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 (if stdenv.isDarwin then darwin.apple_sdk_11_0.clang14Stdenv else stdenv).mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20230329";
+  version = "20230404";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-i0slUBtJE3gYIKO7IxA0rDA4OOZYWYswuLOvece7Ejk=";
+    hash = "sha256-uDQeXEG3xTIXdzj9LaI+p5cLYy9nR2w7QTiZIJlZyQw=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
similarity index 99%
rename from pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
rename to pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
index 835e2197e181..ab8a24bb0931 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@@ -76,7 +76,6 @@ stdenv.mkDerivation rec {
   version = "4.7.1";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
-  # Telegram-Desktop with submodules
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
similarity index 100%
rename from pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
rename to pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/update.py
similarity index 100%
rename from pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
rename to pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/update.py
diff --git a/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
index 00f413b3d68e..32eaf8ada5ca 100644
--- a/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "whatsapp-for-linux";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "eneshecan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-oghO6DNVJqWFHRjUAkqfnoWc7qHJnK3givVLq6xGJeo=";
+    sha256 = "sha256-odE5syAFasGosc1WMU/pvQtk3YxuCci1YevZqNKfzYw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/kubo/default.nix b/pkgs/applications/networking/kubo/default.nix
index 9e6e87aca07f..0bedd4707b39 100644
--- a/pkgs/applications/networking/kubo/default.nix
+++ b/pkgs/applications/networking/kubo/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kubo";
-  version = "0.19.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.19.1"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "13"; # Also update kubo-migrator when changing the repo version
@@ -10,7 +10,7 @@ buildGoModule rec {
   # Kubo makes changes to it's source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-PAxWijTAGOJKRDIKaulNPr/4uOJkm+vqNWAY7AjhFUw=";
+    hash = "sha256-gQIJKV5MD0TZ0GYdLFWNePnExThqEjUmZKCAHhGwtMU=";
   };
 
   # tarball contains multiple files/directories
diff --git a/pkgs/applications/office/fava/default.nix b/pkgs/applications/office/fava/default.nix
index 0e24803028dc..cbbe40f08e4d 100644
--- a/pkgs/applications/office/fava/default.nix
+++ b/pkgs/applications/office/fava/default.nix
@@ -2,12 +2,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fava";
-  version = "1.24.3";
+  version = "1.24.4";
   format = "pyproject";
 
   src = python3.pkgs.fetchPypi {
     inherit pname version;
-    hash = "sha256-eK0JMwu+WN3s6isCt124Cu9fjtL7Lig3+mice4FkwwU=";
+    hash = "sha256-klRPe6NQMn3HVayfCGc05mB0afi3x4Wlj3EI0XdSkMc=";
   };
 
   nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];
diff --git a/pkgs/applications/terminal-emulators/alacritty/default.nix b/pkgs/applications/terminal-emulators/alacritty/default.nix
index f88a944fdb6c..d7f3c357150b 100644
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@@ -82,7 +82,7 @@ rustPlatform.buildRustPackage rec {
 
   outputs = [ "out" "terminfo" ];
 
-  postPatch = ''
+  postPatch = lib.optionalString (!xdg-utils.meta.broken) ''
     substituteInPlace alacritty/src/config/ui_config.rs \
       --replace xdg-open ${xdg-utils}/bin/xdg-open
   '';
@@ -102,7 +102,7 @@ rustPlatform.buildRustPackage rec {
       # patchelf generates an ELF that binutils' "strip" doesn't like:
       #    strip: not enough room for program headers, try linking with -N
       # As a workaround, strip manually before running patchelf.
-      strip -S $out/bin/alacritty
+      $STRIP -S $out/bin/alacritty
 
       patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/alacritty
     ''
diff --git a/pkgs/applications/virtualization/docker-slim/default.nix b/pkgs/applications/virtualization/docker-slim/default.nix
index bbefed66fae3..47cfa4d96cec 100644
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "docker-slim";
-  version = "1.40.0";
+  version = "1.40.1";
 
   src = fetchFromGitHub {
     owner = "slimtoolkit";
     repo = "slim";
     rev = version;
-    sha256 = "sha256-KbwkZIGkAdzPPo5CrWKnKzFsD8OUONk6JWo1wzwti3s=";
+    hash = "sha256-ec5Qedt6NrcWZilcN9dhosAN59orgS2xxjXWO9XDxVE=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   subPackages = [ "cmd/slim" "cmd/slim-sensor" ];
 
diff --git a/pkgs/build-support/fetchhg/default.nix b/pkgs/build-support/fetchhg/default.nix
index b3c28fb0e264..a5817f2c3050 100644
--- a/pkgs/build-support/fetchhg/default.nix
+++ b/pkgs/build-support/fetchhg/default.nix
@@ -4,11 +4,14 @@
 , rev ? null
 , md5 ? null
 , sha256 ? null
+, hash ? null
 , fetchSubrepos ? false
 , preferLocalBuild ? true }:
 
 if md5 != null then
-  throw "fetchhg does not support md5 anymore, please use sha256"
+  throw "fetchhg does not support md5 anymore, please use sha256 or hash"
+else if hash != null && sha256 != null then
+  throw "Only one of sha256 or hash can be set"
 else
 # TODO: statically check if mercurial as the https support if the url starts woth https.
 stdenvNoCC.mkDerivation {
@@ -20,9 +23,14 @@ stdenvNoCC.mkDerivation {
 
   subrepoClause = lib.optionalString fetchSubrepos "S";
 
-  outputHashAlgo = "sha256";
+  outputHashAlgo = if hash != null then null else "sha256";
   outputHashMode = "recursive";
-  outputHash = sha256;
+  outputHash = if hash != null then
+    hash
+  else if sha256 != null then
+    sha256
+  else
+    lib.fakeSha256;
 
   inherit url rev;
   inherit preferLocalBuild;
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 3ecc56cec5d4..6578160b967c 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20230320093818";
+    version = "20230407083123";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-KEA3hsrlDs+GpxBrc6CeNwoyXvu1OBJJ8UaB6iwFyyg=";
+      hash = "sha256-+TOZR8ty4BqjPpzKZtqzfgduRSf4PiHoUUx0eMkV0mk=";
     };
     vendorHash = "sha256-zkf2neI1HiPkCrcw+cYoZ2L/OGkM8HPIv5gUqc05Wak=";
     meta = with lib; {
diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index 622a2247b2a5..54a0c0320cea 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202303272340";
+  version = "202304060040";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "0473ff6f84b7bb926af68238489d05f683b87e1d";
-    sha256 = "sha256-76SsWF3jOi+I975C9WNVMGrLqvgtdM48n9bV0jevx3Q=";
+    rev = "8d65f1d075e077ffc5cdae297795c65f12b37159";
+    sha256 = "sha256-RGDHYgecNDcVwa9yXMgjml72QLf14oHtDGCjXOjeF5A=";
   };
 
   installPhase = ''
diff --git a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
index c9c718fb7da9..f5dfa0e36939 100644
--- a/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-desktop/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-desktop";
-  version = "5.6.1";
+  version = "5.6.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-h2Jl/4SreniZtxziDwM0iwHXgGBrnHu8NLkIX7VGP18=";
+    hash = "sha256-X4jf7+QFjoev1K6ywxN0n9MYUv7xI1/su+hHeesG02Y=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/desktops/deepin/library/gio-qt/default.nix b/pkgs/desktops/deepin/library/gio-qt/default.nix
index d00b5ffabe4f..c2ee51aaade5 100644
--- a/pkgs/desktops/deepin/library/gio-qt/default.nix
+++ b/pkgs/desktops/deepin/library/gio-qt/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gio-qt";
-  version = "0.0.11";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    sha256 = "sha256-dlY1CTlXywgGZUonBBe3cDwx8h2xXrPY6Ft/D59nlug=";
+    sha256 = "sha256-/wLaVR31T+EcT6D5Cw0QIjZasioPWC74KNmt1tckwXk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/hare/hare/000-disable-failing-test-cases.diff b/pkgs/development/compilers/hare/hare/000-disable-failing-test-cases.diff
deleted file mode 100644
index 4f8ba6056046..000000000000
--- a/pkgs/development/compilers/hare/hare/000-disable-failing-test-cases.diff
+++ /dev/null
@@ -1,37 +0,0 @@
-diff --git a/math/complex/+test.ha b/math/complex/+test.ha
-index a1cc0916..705a0a41 100644
---- a/math/complex/+test.ha
-+++ b/math/complex/+test.ha
-@@ -567,8 +567,8 @@ const TEST_COSSC: [](c128, c128) = [
- 		(math::INF, math::NAN)), // real sign unspecified
- 	((math::INF, math::NAN),
- 		(math::NAN, math::NAN)),
--	((math::NAN, 0f64),
--		(math::NAN, -0f64)), // imaginary sign unspecified
-+//	((math::NAN, 0f64),
-+//		(math::NAN, -0f64)), // imaginary sign unspecified
- 	((math::NAN, 1f64),
- 		(math::NAN, math::NAN)),
- 	((math::NAN, math::INF),
-@@ -583,8 +583,8 @@ const TEST_COSHSC: [](c128, c128) = [
- 		(1f64, 0f64)),
- 	((0f64, math::INF),
- 		(math::NAN, 0f64)), // imaginary sign unspecified
--	((0f64, math::NAN),
--		(math::NAN, 0f64)), // imaginary sign unspecified
-+//	((0f64, math::NAN),
-+//		(math::NAN, 0f64)), // imaginary sign unspecified
- 	((1f64, math::INF),
- 		(math::NAN, math::NAN)),
- 	((1f64, math::NAN),
-@@ -627,8 +627,8 @@ const TEST_EXPSC: [](c128, c128) = [
- 		(0f64, 0f64)), // real and imaginary sign unspecified
- 	((math::INF, math::INF),
- 		(math::INF, math::NAN)), // real sign unspecified
--	((-math::INF, math::NAN),
--		(0f64, 0f64)), // real and imaginary sign unspecified
-+//	((-math::INF, math::NAN),
-+//		(0f64, 0f64)), // real and imaginary sign unspecified
- 	((math::INF, math::NAN),
- 		(math::INF, math::NAN)), // real sign unspecified
- 	((math::NAN, 0f64),
diff --git a/pkgs/development/compilers/hare/hare/default.nix b/pkgs/development/compilers/hare/hare/default.nix
index 546bb61bbc63..297e5e6c82ca 100644
--- a/pkgs/development/compilers/hare/hare/default.nix
+++ b/pkgs/development/compilers/hare/hare/default.nix
@@ -23,10 +23,6 @@ stdenv.mkDerivation (self: {
     hash = "sha256-1cSXWD8jpW1VJZDTDOkIabczqbaDCOWsyaUSGtsKsUM=";
   };
 
-  patches = [
-    ./000-disable-failing-test-cases.diff
-  ];
-
   nativeBuildInputs = [
     binutils-unwrapped
     harec
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 60a413fe0edf..4643980a66ce 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -197,9 +197,9 @@ in {
       major = "3";
       minor = "12";
       patch = "0";
-      suffix = "a6";
+      suffix = "a7";
     };
-    hash = "sha256-KYRAJSxLa04SDgFMFdcp6vird5MA3Mph1CLFN+ToXso=";
+    hash = "sha256-oZrk3Fr+vf9eExI0bxYAYqEeDb1fnmimqYHqN7IWCOE=";
     inherit (darwin) configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index e7b6977be1d5..68373413b30f 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-iitEA/x9QpbQrYTcV0OzBgnY6bQFhIm+mVq1ryIQ3+0=";
   };
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Vulkan Header files and API registry";
     homepage    = "https://www.lunarg.com";
diff --git a/pkgs/development/libraries/vulkan-headers/update.sh b/pkgs/development/libraries/vulkan-headers/update.sh
new file mode 100755
index 000000000000..9857af699e2f
--- /dev/null
+++ b/pkgs/development/libraries/vulkan-headers/update.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-update
+
+set -euf -o pipefail
+
+NEW_VERSION=$(curl https://vulkan.lunarg.com/sdk/latest/linux.json | jq -r '.linux')
+
+VULKAN_SDK_PACKAGES=(
+    "vulkan-headers"
+    "spirv-headers"
+    "glslang"
+    "vulkan-loader"
+    "spirv-tools"
+    "spirv-cross"
+    "vulkan-validation-layers"
+    "vulkan-tools"
+    "vulkan-tools-lunarg"
+    "vulkan-extension-layer"
+)
+
+for P in "${VULKAN_SDK_PACKAGES[@]}"; do
+    nix-update "$P" --version "$NEW_VERSION" --commit
+done
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 71d63db00f99..7cad0a38779e 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -5,13 +5,12 @@ stdenv.mkDerivation rec {
   pname = "vulkan-loader";
   version = "1.3.243.0";
 
-  src = (assert version == vulkan-headers.version;
-    fetchFromGitHub {
-      owner = "KhronosGroup";
-      repo = "Vulkan-Loader";
-      rev = "sdk-${version}";
-      hash = "sha256-DqgIg0jZxzhoyYrATDQMoNN/Pav9deKdltB7L0XDqPE=";
-    });
+  src = fetchFromGitHub {
+    owner = "KhronosGroup";
+    repo = "Vulkan-Loader";
+    rev = "sdk-${version}";
+    hash = "sha256-DqgIg0jZxzhoyYrATDQMoNN/Pav9deKdltB7L0XDqPE=";
+  };
 
   patches = [ ./fix-pkgconfig.patch ];
 
@@ -41,5 +40,6 @@ stdenv.mkDerivation rec {
     platforms   = platforms.unix;
     license     = licenses.asl20;
     maintainers = [ maintainers.ralith ];
+    broken = (version != vulkan-headers.version);
   };
 }
diff --git a/pkgs/development/python-modules/ansible-doctor/default.nix b/pkgs/development/python-modules/ansible-doctor/default.nix
index 473625e67aad..fa2b21cbc64b 100644
--- a/pkgs/development/python-modules/ansible-doctor/default.nix
+++ b/pkgs/development/python-modules/ansible-doctor/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-doctor";
-  version = "2.0.3";
+  version = "2.0.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rhXhz6aUQ9hw83cfHmOLXMyyLQc7pSCGgurFhuglKjU=";
+    hash = "sha256-nZv1PdR0kGrke2AjcDWjDWBdsw64UpHYFNDFAe/UoJo=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/app-model/default.nix b/pkgs/development/python-modules/app-model/default.nix
index 1191be3c823d..14ed5bc4060a 100644
--- a/pkgs/development/python-modules/app-model/default.nix
+++ b/pkgs/development/python-modules/app-model/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "app-model";
-  version = "0.1.2";
+  version = "0.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "pyapp-kit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-W1DL6HkqXkfVE9SPD0cUhPln5FBW5vPICpbQulRhaWs=";
+    hash = "sha256-GvMPWIvDydJ8C7wDR5DjmEGhVt0jd5e4WzP10a7mGm8=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/bc-detect-secrets/default.nix b/pkgs/development/python-modules/bc-detect-secrets/default.nix
index dab2f6e5bbb5..1a927c5ecf44 100644
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.4.16";
+  version = "1.4.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     rev = "refs/tags/${version}";
-    hash = "sha256-PBpxhZPFO4X4dhSYWG2TtHgaNx/SCQlnr2D57uB0kr4=";
+    hash = "sha256-MIl0nobcQb8PRwLeam1tgP5JLHNAv3fP3wpwi64IJa4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/deepl/default.nix b/pkgs/development/python-modules/deepl/default.nix
new file mode 100644
index 000000000000..b3d4c747706f
--- /dev/null
+++ b/pkgs/development/python-modules/deepl/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, requests
+, poetry-core
+, keyring
+}:
+
+buildPythonPackage rec {
+  pname = "deepl";
+  version = "1.13.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Rq7L/rgfJJ3ZspuL1IfZv+x60t8cZRPkrVryJf12WLk=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    requests
+    keyring
+  ];
+
+  # Requires internet access and an API key
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "deepl"
+  ];
+
+  meta = with lib; {
+    description = "A language translation API that allows other computer programs to send texts and documents to DeepL's servers and receive high-quality translations";
+    homepage = "https://github.com/DeepLcom/deepl-python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ MaskedBelgian ];
+  };
+}
diff --git a/pkgs/development/python-modules/dsmr-parser/default.nix b/pkgs/development/python-modules/dsmr-parser/default.nix
index 89b6c23caf31..5cc301708736 100644
--- a/pkgs/development/python-modules/dsmr-parser/default.nix
+++ b/pkgs/development/python-modules/dsmr-parser/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dsmr-parser";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "ndokter";
     repo = "dsmr_parser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-giWchaiNuEN2m2XOpDigZKd0p0gOxp6RrIxPLHEvYOg=";
+    hash = "sha256-a02bpC9CVecAtIfWbLM74K4thaGI2GferEnJQKtIiu8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/lsassy/default.nix b/pkgs/development/python-modules/lsassy/default.nix
index ab422f709dab..b6b055c23066 100644
--- a/pkgs/development/python-modules/lsassy/default.nix
+++ b/pkgs/development/python-modules/lsassy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "lsassy";
-  version = "3.1.6";
+  version = "3.1.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Hackndo";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Rdgz9hU2un1CKX2dRI8tVzL2lG7Ufd5HwninOxOsxjM=";
+    hash = "sha256-q9zaKccgqj8haP7zQGS0rplfLylsPXggjzhN6VWV4/A=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nvchecker/default.nix b/pkgs/development/python-modules/nvchecker/default.nix
index c6ab97d9c8fa..0053b81d9a07 100644
--- a/pkgs/development/python-modules/nvchecker/default.nix
+++ b/pkgs/development/python-modules/nvchecker/default.nix
@@ -1,6 +1,6 @@
 { lib
 , aiohttp
-, appdirs
+, platformdirs
 , buildPythonPackage
 , docutils
 , fetchFromGitHub
@@ -20,8 +20,8 @@
 
 buildPythonPackage rec {
   pname = "nvchecker";
-  version = "2.10";
-  format = "setuptools";
+  version = "2.11";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "lilydjwg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NxHeHT56JCu8Gn/B4IcvPtgGcWH8V9CUQkJeKFcGk/Q=";
+    hash = "sha256-b/EGn26gTpnYuy2h6shnJI1dRwhl41eKJHzDJoFG1YI=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
-    appdirs
+    platformdirs
     packaging
     pycurl
     setuptools
diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index 9421d332f57b..c3ad116570e4 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.37.5";
+  version = "0.37.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     rev = "refs/tags/${version}";
-    hash = "sha256-k4uTLiSODjAbwVZjd35RckbDb2DxFCV/Ixo3ErG9FHQ=";
+    hash = "sha256-LZkAyfcDX48hR7lak2mc27lTQQR3VX1ozpdi2btDzbY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index 3ad88389cc17..937f76ee139c 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.5.10";
+  version = "0.5.11";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     rev = "refs/tags/${version}";
-    hash = "sha256-UZURGOfNPccXukVoo1m/gY3tkOvpT5jy0AegQHFJqEQ=";
+    hash = "sha256-vz4hkma/EzAUL9+I8umzyDkAUGcaiBUEtn+WysX6M7o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index bd2a9be69b67..4a365b86dadb 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -55,6 +55,9 @@ buildPythonPackage rec {
     export SKLEARN_BUILD_PARALLEL=$NIX_BUILD_CORES
   '';
 
+  # TODO: a proper fix?  See around PR #225220
+  NIX_LDFLAGS = if stdenv.cc.isGNU then "-L${stdenv.cc.cc.lib}/lib" else null;
+
   doCheck = !stdenv.isAarch64;
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index a3792cc91081..33dfcab92353 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.7.3";
+  version = "1.7.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Madz55RkI+SEtkBep1rcQt2iIwd/LqfzCCKP+4jRHUE=";
+    hash = "sha256-U0mfnTteVPYP7gxRci/+poUf1QTdZ0Kk+f59e9S/A+4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tensorflow/bin.nix b/pkgs/development/python-modules/tensorflow/bin.nix
index 3863fd88ba7a..a2e7b2d21e8a 100644
--- a/pkgs/development/python-modules/tensorflow/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/bin.nix
@@ -16,6 +16,7 @@
 , mock
 , scipy
 , wheel
+, jax
 , opt-einsum
 , backports_weakref
 , tensorflow-estimator-bin
@@ -66,6 +67,7 @@ in buildPythonPackage {
     protobuf
     numpy
     scipy
+    jax
     termcolor
     grpcio
     six
@@ -102,6 +104,7 @@ in buildPythonPackage {
       # - Relax flatbuffers, gast, protobuf, tensorboard, and tensorflow-estimator version requirements that don't match what we have packaged
       # - The purpose of python3Packages.libclang is not clear at the moment and we don't have it packaged yet
       # - keras and tensorlow-io-gcs-filesystem will be considered as optional for now.
+      # - numpy was pinned to fix some internal tests: https://github.com/tensorflow/tensorflow/issues/60216
       sed -i *.dist-info/METADATA \
         -e "/Requires-Dist: flatbuffers/d" \
         -e "/Requires-Dist: gast/d" \
@@ -110,7 +113,8 @@ in buildPythonPackage {
         -e "/Requires-Dist: protobuf/d" \
         -e "/Requires-Dist: tensorboard/d" \
         -e "/Requires-Dist: tensorflow-estimator/d" \
-        -e "/Requires-Dist: tensorflow-io-gcs-filesystem/d"
+        -e "/Requires-Dist: tensorflow-io-gcs-filesystem/d" \
+        -e "s/Requires-Dist: numpy (.*)/Requires-Dist: numpy/"
     )
     wheel pack ./unpacked/tensorflow*
     mv *.whl $orig_name # avoid changes to the _os_arch.whl suffix
@@ -199,26 +203,5 @@ in buildPythonPackage {
     license = licenses.asl20;
     maintainers = with maintainers; [ jyp abbradar cdepillabout ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    knownVulnerabilities = optionals (versionOlder packages.version "2.12.0") [
-      "CVE-2023-27579"
-      "CVE-2023-25801"
-      "CVE-2023-25676"
-      "CVE-2023-25675"
-      "CVE-2023-25674"
-      "CVE-2023-25673"
-      "CVE-2023-25671"
-      "CVE-2023-25670"
-      "CVE-2023-25669"
-      "CVE-2023-25668"
-      "CVE-2023-25667"
-      "CVE-2023-25665"
-      "CVE-2023-25666"
-      "CVE-2023-25664"
-      "CVE-2023-25663"
-      "CVE-2023-25662"
-      "CVE-2023-25660"
-      "CVE-2023-25659"
-      "CVE-2023-25658"
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/tensorflow/binary-hashes.nix b/pkgs/development/python-modules/tensorflow/binary-hashes.nix
index a59a31b57442..e2242ef76d98 100644
--- a/pkgs/development/python-modules/tensorflow/binary-hashes.nix
+++ b/pkgs/development/python-modules/tensorflow/binary-hashes.nix
@@ -1,51 +1,39 @@
 {
-version = "2.11.0";
-linux_py_37_cpu = {
-  url = "https://storage.googleapis.com/tensorflow/linux/cpu/tensorflow_cpu-2.11.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-  sha256 = "0m360pj7ix57d30s9inq9g5cbv7jrgnk2ryygj8irfw569rrzk7x";
-};
+version = "2.12.0";
 linux_py_38_cpu = {
-  url = "https://storage.googleapis.com/tensorflow/linux/cpu/tensorflow_cpu-2.11.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-  sha256 = "1kx4rj15fnbmznpyjjbkw5mf0b03gw97h7ijlqf1kcdjzmbm24la";
+  url = "https://storage.googleapis.com/tensorflow/linux/cpu/tensorflow_cpu-2.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+  sha256 = "1lqdb3n8dp2f1vignddfqfbbghidkbrq9g78fqkjir8g318zf1m4";
 };
 linux_py_39_cpu = {
-  url = "https://storage.googleapis.com/tensorflow/linux/cpu/tensorflow_cpu-2.11.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-  sha256 = "1isvyiwrhis8i2xjx5mmsrxv2i7fl0hg1jaa1pgw70c6sz5vqm0r";
+  url = "https://storage.googleapis.com/tensorflow/linux/cpu/tensorflow_cpu-2.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+  sha256 = "1k595l4gpmar9rg4kim2i41fv25i8p018fdmgxcb5v6836d5ns2m";
 };
 linux_py_310_cpu = {
-  url = "https://storage.googleapis.com/tensorflow/linux/cpu/tensorflow_cpu-2.11.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-  sha256 = "1ni7yrk33xdh6zpy840y3hbidmfgj9dxp690yxrjwarr3694465k";
-};
-linux_py_37_gpu = {
-  url = "https://storage.googleapis.com/tensorflow/linux/gpu/tensorflow_gpu-2.11.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-  sha256 = "14r2sa25gmpda6kysv7dbbrzmaxb47jq2fpy9dfcfbiwsrzszwhi";
+  url = "https://storage.googleapis.com/tensorflow/linux/cpu/tensorflow_cpu-2.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+  sha256 = "1mhq429j9v82jwyqk6dcaz0sh57n0kyf2bfjrjz13xjblssij6rn";
 };
 linux_py_38_gpu = {
-  url = "https://storage.googleapis.com/tensorflow/linux/gpu/tensorflow_gpu-2.11.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-  sha256 = "1z8g3j1a8bzpfl3cwf74wal9npfyzr89l14wrrjmd311w9c06z25";
+  url = "https://storage.googleapis.com/tensorflow/linux/gpu/tensorflow-2.12.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+  sha256 = "009wyvzdlzghb39mmrv36fvjrrrbllyadny9jzb7ixzry4r07193";
 };
 linux_py_39_gpu = {
-  url = "https://storage.googleapis.com/tensorflow/linux/gpu/tensorflow_gpu-2.11.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-  sha256 = "1nfhw5fwkvwyvcap41756avrg4c8xm0xrdgj8spqfjvamc3chcqp";
+  url = "https://storage.googleapis.com/tensorflow/linux/gpu/tensorflow-2.12.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+  sha256 = "0l1cwsfw91vfgx8xqwz7cdphj1dy6ppfifm7f7f0n0i6rda6l382";
 };
 linux_py_310_gpu = {
-  url = "https://storage.googleapis.com/tensorflow/linux/gpu/tensorflow_gpu-2.11.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
-  sha256 = "1vckr15ys8cks8pj9yld4zyhm8w7bjnc8yq6q1g3145fl99ygac1";
-};
-mac_py_37_cpu = {
-  url = "https://storage.googleapis.com/tensorflow/mac/cpu/tensorflow-2.11.0-cp37-cp37m-macosx_10_14_x86_64.whl";
-  sha256 = "12lk1wx5dqklc210xya3sbm3gl4163454k13d2nnk94z2iwi376j";
+  url = "https://storage.googleapis.com/tensorflow/linux/gpu/tensorflow-2.12.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl";
+  sha256 = "0dl3nvr4pk4zknx484qd2mqdkjkms6s4alqrxqkqv2hqa4l9sz9m";
 };
 mac_py_38_cpu = {
-  url = "https://storage.googleapis.com/tensorflow/mac/cpu/tensorflow-2.11.0-cp38-cp38-macosx_10_14_x86_64.whl";
-  sha256 = "1j4y6vhlpz27xllwr9n0gswmwld221ws8sl5wdn56hi347r2jv85";
+  url = "https://storage.googleapis.com/tensorflow/mac/cpu/tensorflow-2.12.0-cp38-cp38-macosx_10_15_x86_64.whl";
+  sha256 = "0jkxd9ccbq2czn16w3his6k1hxx0nhkrb56bkrskwzss9is4w6d7";
 };
 mac_py_39_cpu = {
-  url = "https://storage.googleapis.com/tensorflow/mac/cpu/tensorflow-2.11.0-cp39-cp39-macosx_10_14_x86_64.whl";
-  sha256 = "11ylm1a2mxf9lz958p39q2pag4mqss6zsfxagk3ybwj1lsy2bkyr";
+  url = "https://storage.googleapis.com/tensorflow/mac/cpu/tensorflow-2.12.0-cp39-cp39-macosx_10_15_x86_64.whl";
+  sha256 = "0n7rsrxlkn143y80579bm8wwsabg2a9x6sx1h7ksw3s2x4sjdz22";
 };
 mac_py_310_cpu = {
-  url = "https://storage.googleapis.com/tensorflow/mac/cpu/tensorflow-2.11.0-cp310-cp310-macosx_10_14_x86_64.whl";
-  sha256 = "1l6jnmi14sbxbrpwqw3bq6mv1mn5rhbkx9j3dxfnhh10dkn9y13c";
+  url = "https://storage.googleapis.com/tensorflow/mac/cpu/tensorflow-2.12.0-cp310-cp310-macosx_10_15_x86_64.whl";
+  sha256 = "18fj2jxl8b69jrzjkixhyyrml8qjwcid76y15ggzc5ksrkgw0jmy";
 };
 }
diff --git a/pkgs/development/python-modules/tensorflow/prefetcher.sh b/pkgs/development/python-modules/tensorflow/prefetcher.sh
index a4a7c5dfa57c..8cdc11e11fd9 100755
--- a/pkgs/development/python-modules/tensorflow/prefetcher.sh
+++ b/pkgs/development/python-modules/tensorflow/prefetcher.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-version="2.11.0"
+version="2.12.0"
 
 bucket="https://storage.googleapis.com/tensorflow"
 
@@ -8,18 +8,15 @@ bucket="https://storage.googleapis.com/tensorflow"
 # on the following page:
 # https://www.tensorflow.org/install/pip?lang=python3#package-location
 url_and_key_list=(
-"linux_py_37_cpu $bucket/linux/cpu/tensorflow_cpu-${version}-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
 "linux_py_38_cpu $bucket/linux/cpu/tensorflow_cpu-${version}-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
 "linux_py_39_cpu $bucket/linux/cpu/tensorflow_cpu-${version}-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
 "linux_py_310_cpu $bucket/linux/cpu/tensorflow_cpu-${version}-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
-"linux_py_37_gpu $bucket/linux/gpu/tensorflow_gpu-${version}-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
-"linux_py_38_gpu $bucket/linux/gpu/tensorflow_gpu-${version}-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
-"linux_py_39_gpu $bucket/linux/gpu/tensorflow_gpu-${version}-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
-"linux_py_310_gpu $bucket/linux/gpu/tensorflow_gpu-${version}-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
-"mac_py_37_cpu $bucket/mac/cpu/tensorflow-${version}-cp37-cp37m-macosx_10_14_x86_64.whl"
-"mac_py_38_cpu $bucket/mac/cpu/tensorflow-${version}-cp38-cp38-macosx_10_14_x86_64.whl"
-"mac_py_39_cpu $bucket/mac/cpu/tensorflow-${version}-cp39-cp39-macosx_10_14_x86_64.whl"
-"mac_py_310_cpu $bucket/mac/cpu/tensorflow-${version}-cp310-cp310-macosx_10_14_x86_64.whl"
+"linux_py_38_gpu $bucket/linux/gpu/tensorflow-${version}-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+"linux_py_39_gpu $bucket/linux/gpu/tensorflow-${version}-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+"linux_py_310_gpu $bucket/linux/gpu/tensorflow-${version}-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
+"mac_py_38_cpu $bucket/mac/cpu/tensorflow-${version}-cp38-cp38-macosx_10_15_x86_64.whl"
+"mac_py_39_cpu $bucket/mac/cpu/tensorflow-${version}-cp39-cp39-macosx_10_15_x86_64.whl"
+"mac_py_310_cpu $bucket/mac/cpu/tensorflow-${version}-cp310-cp310-macosx_10_15_x86_64.whl"
 )
 
 hashfile=binary-hashes.nix
diff --git a/pkgs/development/python-modules/textnets/default.nix b/pkgs/development/python-modules/textnets/default.nix
index da3da57d35d9..a63fa00e6400 100644
--- a/pkgs/development/python-modules/textnets/default.nix
+++ b/pkgs/development/python-modules/textnets/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , cairocffi
 , cython
-, fetchFromGitHub
+, fetchPypi
 , igraph
 , leidenalg
 , pandas
@@ -20,16 +20,14 @@
 
 buildPythonPackage rec {
   pname = "textnets";
-  version = "0.8.7";
+  version = "0.8.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
-  src = fetchFromGitHub {
-    owner = "jboynyc";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-BBndY+3leJBxiImuyRL7gMD5eocE4i96+97I9hDEwec=";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-rjXEiaPYctrONIZz1Dd5OSDw5z8D2FPXi5TneKizFUQ=";
   };
 
   nativeBuildInputs = [
@@ -50,12 +48,6 @@ buildPythonPackage rec {
     wasabi
   ];
 
-  # Deselect test of experimental feature that fails due to having an
-  # additional dependency.
-  disabledTests = [
-    "test_context"
-  ];
-
   nativeCheckInputs = [
     pytestCheckHook
     en_core_web_sm
diff --git a/pkgs/development/tools/database/sqlfluff/default.nix b/pkgs/development/tools/database/sqlfluff/default.nix
index 0bdca8889e84..836e1ec50e06 100644
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sqlfluff";
-  version = "2.0.2";
+  version = "2.0.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-iutlsB+qZ9/ix/UUnHspppsbiXclolXNcbiTChz3tQk=";
+    hash = "sha256-PG+4PibJE7mka+1ann88AgqNTI+BeE0IxHpVJRG4Iuk=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/development/tools/goda/default.nix b/pkgs/development/tools/goda/default.nix
index 0564cfa31577..65086bb44d58 100644
--- a/pkgs/development/tools/goda/default.nix
+++ b/pkgs/development/tools/goda/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "goda";
-  version = "0.5.5";
+  version = "0.5.6";
 
   src = fetchFromGitHub {
     owner = "loov";
     repo = "goda";
     rev = "v${version}";
-    sha256 = "sha256-yKhgk/DRcifh+exxTZFti1Aac/sgpvUsNKdioLAzmX0=";
+    sha256 = "sha256-l9ehpDAqZqNV+07ENXJ2GJEY6bb6W37Ls6UqjE9DEWQ=";
   };
 
   vendorSha256 = "sha256-BYYuB4ZlCWD8NILkf4qrgM4q72ZTy7Ze3ICUXdoI5Ms=";
diff --git a/pkgs/development/tools/misc/blackfire/php-probe.nix b/pkgs/development/tools/misc/blackfire/php-probe.nix
index 61ec33c7a169..e44e61da3398 100644
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -13,47 +13,47 @@
 let
   phpMajor = lib.versions.majorMinor php.version;
 
-  version = "1.86.5";
+  version = "1.86.6";
 
   hashes = {
     "x86_64-linux" = {
       system = "amd64";
       sha256 = {
-        "8.0" = "N+SRigtolwNjxdH5/jWazPq7oBh2dxoT6tNBugyVdL0=";
-        "8.1" = "MCxZcIduGTbGJsUR16wwUlxc1CbeSAIvNTfI76WQUrs=";
-        "8.2" = "OoQt4zAPUQTPCLnNxnc0/e0osjo0eDP7I6sn2n90ZgQ=";
+        "8.0" = "DbaawNIl1ZbSaITFUZE0GC0RgrJrjn0Wlb+o3OMhsAc=";
+        "8.1" = "VM7RljXwdGgF2ZVvsJ00YIGVfM5JqdRNrALSw+pMJks=";
+        "8.2" = "hrFNkAX4Am+78xxFfoSWn+bUZIklhb5uKRo1rGWumOA=";
       };
     };
     "i686-linux" = {
       system = "i386";
       sha256 = {
-        "8.0" = "Vv/rqRvt9ganet4z84rN2uJ6LCvn8rop9jFQdlnYMB8=";
-        "8.1" = "lFRY2yWOuWY4Zu3Y7FYbvTSmpZl4epgPKzHffncwXpk=";
-        "8.2" = "VSRaPib7RfA5W0FG3JgaXTlGTnOLKaw3tz8p/Mkmpx8=";
+        "8.0" = "FdM+HsVytE5XdjlXDV6mrdylLDQdzCYjxkFrqWwTMbI=";
+        "8.1" = "Z6RZShh/Gcu9qLcj/yKJu7qy0RnA+nNFwz1IXCEZlKg=";
+        "8.2" = "mytoRBpSCR4Gibpi7AptgbTq+axBXlpfag9LAnVzUM4=";
       };
     };
     "aarch64-linux" = {
       system = "arm64";
       sha256 = {
-        "8.0" = "XvLZrfYbyiAV0q/S3ANcafyLGQWkcJuRa1RUWSpaNH8=";
-        "8.1" = "msezMA7yhC16ATxN7c4xDdy6PrZ7HVito4x1L3mzh70=";
-        "8.2" = "Q7LTst4OBPrQ91vI/V9eN9MHo0qxTD1ZCWMFeYXT21s=";
+        "8.0" = "6sl3RXgBfXlJpmUDRGCmpLRKSmf1dy0vbRVHFnl7TyI=";
+        "8.1" = "hDv6G2L+fJylaqmOle0ND9iO28BA2ZPDfDlIhL2gqBQ=";
+        "8.2" = "ASm65Jwsc2x6R0sfWHyDWTw/FTeQap+SckG4Jdg2Zn8=";
       };
     };
     "aarch64-darwin" = {
       system = "arm64";
       sha256 = {
-        "8.0" = "OSnjO2nmcqy+vytRNWFYMi8Y20n7AwAwmhDBS7K5MBQ=";
-        "8.1" = "VyPY1Gj6q4PpXDLPS9ARt9LUmYIG3hsGlEJjh9944Hc=";
-        "8.2" = "M+8Lwx2nzlxLEP+F1vcjB9HgInsz5vOc3AIEzQHrC2I=";
+        "8.0" = "zEAd+8v7j1mFOIMc2dThOY7e1XKHyMOx9dYWnJlJWAE=";
+        "8.1" = "ZaGwlLcBUSwGoAypw42rIkeXaeVegh05xwVMXfaAtgg=";
+        "8.2" = "gz8eKNLHlje3gUiXSIyE2csnOq9blS3GWZscTZbA9W4=";
       };
     };
     "x86_64-darwin" = {
       system = "amd64";
       sha256 = {
-        "8.0" = "1xRcZic2XQLFkBhh2H9ZgCpG+1xq4oqhef7qEjhSeLQ=";
-        "8.1" = "MmI3TjvmLymRxo/Iy9s49A6le+pZiiflGq+CfU/xmW0=";
-        "8.2" = "n0Cy59tVUO70oTidB9lIPUXMkQ8ndzYHtYfXuQYQ2Mc=";
+        "8.0" = "yUcxwya/oTmu0acbuhe2ft2pyKroeWHQMouE2ch94EM=";
+        "8.1" = "u14WbwGRsDDhd6oZsvGKOgXpTQw3KMVeV1i9wl/vI+I=";
+        "8.2" = "oYYgo2qSkCuwNjUrJdhFziWyyWfwm1g+ZyqhudDuuoA=";
       };
     };
   };
diff --git a/pkgs/development/tools/misc/patchelf/unstable.nix b/pkgs/development/tools/misc/patchelf/unstable.nix
index 3f20cb7834f5..d90c6ef4a8c3 100644
--- a/pkgs/development/tools/misc/patchelf/unstable.nix
+++ b/pkgs/development/tools/misc/patchelf/unstable.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "patchelf";
-  version = "unstable-2023-03-18";
+  version = "unstable-2023-03-27";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "patchelf";
-    rev = "265b31ae22c6e1d20b01295aaa7bcf28fd31a5cf";
-    sha256 = "sha256-+iGvdjXvhk5mN8jp3u+M9fICKFqbtyZCx+WjQszaB1o=";
+    rev = "99db062953e88c26e1b1ae5120b8f8bd9f8d9b90";
+    sha256 = "sha256-6UQR7pmaeIv4G/eymgrFXXfrh3ODfsqIIAu0A44N/6g=";
   };
 
   # Drop test that fails on musl (?)
diff --git a/pkgs/development/tools/rbspy/default.nix b/pkgs/development/tools/rbspy/default.nix
index 0e66f21a5ccb..d54d52e139ef 100644
--- a/pkgs/development/tools/rbspy/default.nix
+++ b/pkgs/development/tools/rbspy/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rbspy";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-yM3bE79flvFSZvpkHXhhEh1MJrSSJzqZcX9aVRmz1ew=";
+    hash = "sha256-NshDX7sbXnmK6k/EDD5thUcNKvSV4bNdJ5N2hNLlsnA=";
   };
 
-  cargoHash = "sha256-qvx5zPEIwvh2AIFCGNbVMNIRFtVjSLR9+exbSeQ9oXI=";
+  cargoHash = "sha256-JzspNL4T28awa/1Uajw0gLM3bYyUBYTjnfCXn9qG7SY=";
   doCheck = true;
 
   # The current implementation of rbspy fails to detect the version of ruby
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 8aa753e3e82f..5ffda91a460e 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -4,14 +4,12 @@ stdenv.mkDerivation rec {
   pname = "spirv-tools";
   version = "1.3.243.0";
 
-  src = (assert version == spirv-headers.version;
-    fetchFromGitHub {
-      owner = "KhronosGroup";
-      repo = "SPIRV-Tools";
-      rev = "sdk-${version}";
-      hash = "sha256-l44Ru0WjROQEDNU/2YQJGti1uDZP9osRdfsXus5EGX0=";
-    }
-  );
+  src = fetchFromGitHub {
+    owner = "KhronosGroup";
+    repo = "SPIRV-Tools";
+    rev = "sdk-${version}";
+    hash = "sha256-l44Ru0WjROQEDNU/2YQJGti1uDZP9osRdfsXus5EGX0=";
+  };
 
   nativeBuildInputs = [ cmake python3 ];
 
@@ -43,5 +41,6 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = [ maintainers.ralith ];
+    broken = (version != spirv-headers.version);
   };
 }
diff --git a/pkgs/development/tools/txtpbfmt/default.nix b/pkgs/development/tools/txtpbfmt/default.nix
index a4e26cfb4cb6..757e1e560bef 100644
--- a/pkgs/development/tools/txtpbfmt/default.nix
+++ b/pkgs/development/tools/txtpbfmt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "txtpbfmt";
-  version = "unstable-2023-01-18";
+  version = "unstable-2023-03-28";
 
   src = fetchFromGitHub {
     owner = "protocolbuffers";
     repo = "txtpbfmt";
-    rev = "fcc1fa29197ce17bc56812f84f5ff311f767fcd1";
-    hash = "sha256-U+Kk2tQw+rJX7Xa8b5Hd7x0xY/6PN6TTYsLJkpB1Osg=";
+    rev = "3462fbc510c07c0844c2e370719c9c18302f476f";
+    hash = "sha256-vvkZWDGrId164K6jhMXNa5BtOxQSgFDhMACGAH+9F08=";
   };
 
-  vendorHash = "sha256-shjcQ3DJQYeAW0bX3OuF/esgIvrQ4yuLEa677iFV82g=";
+  vendorHash = "sha256-IdD+R8plU4/e9fQaGSM5hJxyMECb6hED0Qg8afwHKbY=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 8fe813e63dfd..81be07fdcd0d 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -30,13 +30,12 @@ stdenv.mkDerivation rec {
   outputs = ["out" "headers"];
   outputInclude = "headers";
 
-  src = (assert (lib.all (pkg: pkg.version == version) [vulkan-headers glslang spirv-tools spirv-headers]);
-    fetchFromGitHub {
-      owner = "KhronosGroup";
-      repo = "Vulkan-ValidationLayers";
-      rev = "sdk-${version}";
-      hash = "sha256-viVceH8qFz6Cl/RlMMWZnMIdzULELlnIvtPZ87ySs2M=";
-    });
+  src = fetchFromGitHub {
+    owner = "KhronosGroup";
+    repo = "Vulkan-ValidationLayers";
+    rev = "sdk-${version}";
+    hash = "sha256-viVceH8qFz6Cl/RlMMWZnMIdzULELlnIvtPZ87ySs2M=";
+  };
 
   nativeBuildInputs = [
     cmake
@@ -85,5 +84,6 @@ stdenv.mkDerivation rec {
     platforms   = platforms.linux;
     license     = licenses.asl20;
     maintainers = [ maintainers.ralith ];
+    broken = (lib.all (pkg: pkg.version != version) [vulkan-headers glslang spirv-tools spirv-headers]);
   };
 }
diff --git a/pkgs/os-specific/linux/uhk-agent/default.nix b/pkgs/os-specific/linux/uhk-agent/default.nix
index 0b7739012eca..f75d8578833c 100644
--- a/pkgs/os-specific/linux/uhk-agent/default.nix
+++ b/pkgs/os-specific/linux/uhk-agent/default.nix
@@ -1,11 +1,11 @@
-{ appimageTools, lib, fetchurl, polkit, udev }:
+{ appimageTools, lib, fetchurl }:
 let
   pname = "uhk-agent";
-  version = "2.1.1";
+  version = "2.1.2";
   src = fetchurl {
     url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-NhDHwQeh+zbA7XykriSMaygNm1SorMd+yy/m6sPgAhg=";
+    sha256 = "sha256-G/UT1ec7rWl8xONZnT+dpHAFOQh6/s0Vq7MTqAcmJSA=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 7d0ab6ac4207..e81b2c68ecd7 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -17,7 +17,7 @@ outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , version
 , nginxVersion ? version
 , src ? null # defaults to upstream nginx ${version}
-, sha256 ? null # when not specifying src
+, hash ? null # when not specifying src
 , configureFlags ? []
 , nativeBuildInputs ? []
 , buildInputs ? []
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
 
   src = if src != null then src else fetchurl {
     url = "https://nginx.org/download/nginx-${version}.tar.gz";
-    inherit sha256;
+    inherit hash;
   };
 
   nativeBuildInputs = [ removeReferencesTo ]
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index 07990338e41f..5007defeed1e 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.23.3";
-  sha256 = "sha256-dctXh9u5+uGLFIEPkcxDQ/ZM5MJOJzAhNvtSSYBCulQ=";
+  version = "1.23.4";
+  hash = "sha256-1DMA42uySafm7cYLyhsPw3Kguvzi80bXas+2d6h5D8A=";
 }
diff --git a/pkgs/servers/http/nginx/quic.nix b/pkgs/servers/http/nginx/quic.nix
index 7af02ceb0e72..7248ad1c4c0b 100644
--- a/pkgs/servers/http/nginx/quic.nix
+++ b/pkgs/servers/http/nginx/quic.nix
@@ -9,7 +9,7 @@ callPackage ./generic.nix args {
   src = fetchhg {
     url = "https://hg.nginx.org/nginx-quic";
     rev = "0af598651e33"; # branch=quic
-    sha256 = "sha256-rG0jXA+ci7anUxZCBhXZLZKwnTtzzDEAViuoImKpALA=";
+    hash = "sha256-rG0jXA+ci7anUxZCBhXZLZKwnTtzzDEAViuoImKpALA=";
   };
 
   preConfigure = ''
diff --git a/pkgs/servers/http/nginx/stable.nix b/pkgs/servers/http/nginx/stable.nix
index eb3c90aa7c6c..904cbe3fadc0 100644
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@@ -2,5 +2,5 @@
 
 callPackage ./generic.nix args {
   version = "1.22.1";
-  sha256 = "sha256-nrszOp6CuVKs0+K0rrHU/2QG9ySRurbNn+afDepzfzE=";
+  hash = "sha256-nrszOp6CuVKs0+K0rrHU/2QG9ySRurbNn+afDepzfzE=";
 }
diff --git a/pkgs/shells/tcsh/default.nix b/pkgs/shells/tcsh/default.nix
index 1676d2f08450..72c97a46e3c2 100644
--- a/pkgs/shells/tcsh/default.nix
+++ b/pkgs/shells/tcsh/default.nix
@@ -1,9 +1,9 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , libxcrypt
 , ncurses
+, buildPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -16,19 +16,16 @@ stdenv.mkDerivation rec {
   };
 
   strictDeps = true;
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
   buildInputs = [
     libxcrypt
     ncurses
   ];
 
-  patches = lib.optional stdenv.hostPlatform.isMusl
-    # Use system malloc
-    (fetchpatch {
-      name = "sysmalloc.patch";
-      url = "https://git.alpinelinux.org/aports/plain/community/tcsh/001-sysmalloc.patch?id=184585c046cdd56512f1a76e426dd799b368f8cf";
-      sha256 = "1qc6ydxhdfizsbkaxhpn3wib8sfphrw10xnnsxx2prvzg9g2zp67";
-    });
-
   meta = with lib; {
     homepage = "https://www.tcsh.org/";
     description = "An enhanced version of the Berkeley UNIX C shell (csh)";
diff --git a/pkgs/tools/admin/bom/default.nix b/pkgs/tools/admin/bom/default.nix
index f80c153fb447..4a22212e8c5e 100644
--- a/pkgs/tools/admin/bom/default.nix
+++ b/pkgs/tools/admin/bom/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "bom";
-  version = "0.4.1";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HgBpEIUaeVCMkbu1KtBh0LGZQGFLyj3rF0cYDt8vDRk=";
+    sha256 = "sha256-/a+0kQn2m5JFxhlgs1pUeyWwwqVFrRbYCyUfcLsNGz8=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -25,7 +25,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorSha256 = "sha256-m5IK/+mbwGSX8tQUMED8+H52o89QOJk8mhUXumZm+wo=";
+  vendorSha256 = "sha256-+dFHVIE3YFQVgYwEDtUWJAfHSnBZox8qejJtuIMPS2I=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/audio/tts/default.nix b/pkgs/tools/audio/tts/default.nix
index 1c3cc91616c7..8b279a106fab 100644
--- a/pkgs/tools/audio/tts/default.nix
+++ b/pkgs/tools/audio/tts/default.nix
@@ -1,8 +1,8 @@
 { lib
 , python3
 , fetchFromGitHub
-, fetchpatch
 , espeak-ng
+, tts
 }:
 
 let
@@ -115,6 +115,10 @@ python.pkgs.buildPythonApplication rec {
     )
   '';
 
+  # tests get stuck when run in nixpkgs-review, tested in passthru
+  doCheck = false;
+  passthru.tests.pytest = tts.overridePythonAttrs (_: { doCheck = true; });
+
   nativeCheckInputs = with python.pkgs; [
     espeak-ng
     pytestCheckHook
diff --git a/pkgs/tools/filesystems/stratis-cli/default.nix b/pkgs/tools/filesystems/stratis-cli/default.nix
index cf60c13f0fe2..89f1eb81822f 100644
--- a/pkgs/tools/filesystems/stratis-cli/default.nix
+++ b/pkgs/tools/filesystems/stratis-cli/default.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "stratis-cli";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "stratis-storage";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IfvI8DVjm68SewHtQbhGGU1oku4eZnF7cRyeVPB/Ctk=";
+    hash = "sha256-aDWHXKmlKKJo+ckW1vA0bm4q5z2g/Zx5frVDR6Kwgjw=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index 7832b7216bdc..37de2d20aafc 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -4,13 +4,12 @@ stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
   version = "1.3.243.0";
 
-  src = (assert version == vulkan-headers.version;
-    fetchFromGitHub {
-      owner = "KhronosGroup";
-      repo = "Vulkan-ExtensionLayer";
-      rev = "sdk-${version}";
-      hash = "sha256-hxlfSnH4M3ui5nW0Ll5rhto0DnJIHW0tJzS+p4KV0R4=";
-    });
+  src = fetchFromGitHub {
+    owner = "KhronosGroup";
+    repo = "Vulkan-ExtensionLayer";
+    rev = "sdk-${version}";
+    hash = "sha256-hxlfSnH4M3ui5nW0Ll5rhto0DnJIHW0tJzS+p4KV0R4=";
+  };
 
   nativeBuildInputs = [ cmake jq ];
 
@@ -41,5 +40,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.asl20;
     maintainers = with maintainers; [ expipiplus1 ];
+    broken = (version != vulkan-headers.version);
   };
 }
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 578089fb44b2..0150f4e5c6fb 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -27,14 +27,13 @@ stdenv.mkDerivation rec {
   # The version must match that in vulkan-headers
   version = "1.3.243.0";
 
-  src = (assert version == vulkan-headers.version;
-    fetchFromGitHub {
-      owner = "LunarG";
-      repo = "VulkanTools";
-      rev = "sdk-${version}";
-      hash = "sha256-mvBP6wD1Z0VNLZ0mC4bA3i2IaBDtDr7K6XjHz4S3UA4=";
-      fetchSubmodules = true;
-    });
+  src = fetchFromGitHub {
+   owner = "LunarG";
+   repo = "VulkanTools";
+   rev = "sdk-${version}";
+   hash = "sha256-mvBP6wD1Z0VNLZ0mC4bA3i2IaBDtDr7K6XjHz4S3UA4=";
+   fetchSubmodules = true;
+ };
 
   nativeBuildInputs = [ cmake python3 jq which pkg-config ];
 
@@ -103,5 +102,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.asl20;
     maintainers = [ maintainers.expipiplus1 ];
+    broken = (version != vulkan-headers.version);
   };
 }
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 577e4e320d80..47a17158653f 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -23,16 +23,12 @@ stdenv.mkDerivation rec {
   pname = "vulkan-tools";
   version = "1.3.243.0";
 
-  # It's not strictly necessary to have matching versions here, however
-  # since we're using the SDK version we may as well be consistent with
-  # the rest of nixpkgs.
-  src = (assert (version) == vulkan-headers.version;
-    fetchFromGitHub {
-      owner = "KhronosGroup";
-      repo = "Vulkan-Tools";
-      rev = "sdk-${version}";
-      hash = "sha256-8XJON+iBEPRtuQWf1bPXyOJHRkuRLnLXgTIjk7gYQwE=";
-    });
+  src = fetchFromGitHub {
+    owner = "KhronosGroup";
+    repo = "Vulkan-Tools";
+    rev = "sdk-${version}";
+    hash = "sha256-8XJON+iBEPRtuQWf1bPXyOJHRkuRLnLXgTIjk7gYQwE=";
+  };
 
   nativeBuildInputs = [
     cmake
@@ -107,5 +103,6 @@ stdenv.mkDerivation rec {
     platforms   = platforms.unix;
     license     = licenses.asl20;
     maintainers = [ maintainers.ralith ];
+    broken = (version != vulkan-headers.version);
   };
 }
diff --git a/pkgs/tools/misc/interactsh/default.nix b/pkgs/tools/misc/interactsh/default.nix
index 75d92050aeed..82719663cf2d 100644
--- a/pkgs/tools/misc/interactsh/default.nix
+++ b/pkgs/tools/misc/interactsh/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "interactsh";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ELj80stWOwACsCGmjt2QR8TxBFpvlYmVN7hWDPee8YE=";
+    hash = "sha256-a/rJbBYRERujvy7HBRavLdv7NdG7ofCQec4Ia1WPflc=";
   };
 
-  vendorHash = "sha256-xm7Iup4+xhcJ+Bzv56A0C3+2Fxz53qY8fqlVsMtFLd8=";
+  vendorHash = "sha256-YfqprpftCFH+tuEhcK4xWwenjv8BjFhzlTRsy1rz5Ec=";
 
   modRoot = ".";
   subPackages = [
diff --git a/pkgs/tools/security/browserpass/default.nix b/pkgs/tools/security/browserpass/default.nix
index 31a0bd63db03..83f34e2f066f 100644
--- a/pkgs/tools/security/browserpass/default.nix
+++ b/pkgs/tools/security/browserpass/default.nix
@@ -1,4 +1,11 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, gnupg }:
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+, gnupg
+, makeWrapper
+}:
+
 buildGoModule rec {
   pname = "browserpass";
   version = "3.1.0";
@@ -14,7 +21,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-CjuH4ANP2bJDeA+o+1j+obbtk5/NVLet/OFS3Rms4r0=";
 
-  doCheck = false;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   postPatch = ''
     # Because this Makefile will be installed to be used by the user, patch
@@ -32,9 +39,11 @@ buildGoModule rec {
   '';
 
   buildPhase = ''
-    make
+    make browserpass
   '';
 
+  checkTarget = "test";
+
   installPhase = ''
     make install
 
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index b70c7c1e0a33..7956d01f8b20 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-04-06";
+  version = "2023-04-07";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Y+UdrSTmqLLLdUwv6ruAHEfqCCN7Sil8OGmIuVlPfRs=";
+    hash = "sha256-PcrnqlbhoE9clYCsGX6ttMr92a+2BhuDP8aT6wG9aN0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 37ec8cac900d..b3aa386ba88b 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.31.3";
+  version = "3.31.4";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ik2zAcjLvsJc1c7WntamruAT3oZqkFK7CabfRQ6BQzA=";
+    hash = "sha256-fZO2WU1gJsf3KRFNF/I8dX4YW7RPn5hmN0MfjQED98I=";
   };
 
   vendorHash = "sha256-PNEIuENQfSOTo4W4frx/e56OwphGZGSP6WBLLtQeS4M=";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f595980a54a3..308a7c6c00a8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1560,6 +1560,7 @@ mapAliases ({
   tangogps = foxtrotgps; # Added 2020-01-26
   taplo-cli = taplo; # Added 2022-07-30
   taplo-lsp = taplo; # Added 2022-07-30
+  tdesktop = telegram-desktop; # Added 2023-04-07
   tdm = throw "tdm has been removed because nobody can figure out how to fix OpenAL integration. Use precompiled binary and `steam-run` instead";
   teleconsole = throw "teleconsole is archived by upstream"; # Added 2022-04-05
   telepathy-qt = throw "telepathy-qt no longer supports Qt 4. Please use libsForQt5.telepathy instead"; # Added 2020-07-02
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e38b6d5e7426..98984e77933f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -31399,7 +31399,7 @@ with pkgs;
       then darwin.apple_sdk_11_0.stdenv
       else stdenv;
 
-    # tdesktop has random crashes when jemalloc is built with gcc.
+    # telegram-desktop has random crashes when jemalloc is built with gcc.
     # Apparently, it triggers some bug due to usage of gcc's builtin
     # functions like __builtin_ffsl by jemalloc when it's built with gcc.
     jemalloc = (jemalloc.override { stdenv = clangStdenv; }).overrideAttrs(_: {
@@ -33945,7 +33945,7 @@ with pkgs;
 
   taskopen = callPackage ../applications/misc/taskopen { };
 
-  tdesktop = qt6Packages.callPackage ../applications/networking/instant-messengers/telegram/tdesktop {
+  telegram-desktop = qt6Packages.callPackage ../applications/networking/instant-messengers/telegram/telegram-desktop {
     abseil-cpp = abseil-cpp_202206;
   };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6a378d7eb3a7..c739c5278574 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2382,6 +2382,8 @@ self: super: with self; {
 
   deepdish = callPackage ../development/python-modules/deepdish { };
 
+  deepl = callPackage ../development/python-modules/deepl { };
+
   deepmerge = callPackage ../development/python-modules/deepmerge { };
 
   deeptoolsintervals = callPackage ../development/python-modules/deeptoolsintervals { };