diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index f5d7fd1dd9a5..95ced764836f 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -66,6 +66,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `borgbackup` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.borgbackup.jobs.<name>.inhibitsSleep`](#opt-services.borgbackup.jobs._name_.inhibitsSleep).
 
+- The `ssh` client tool now disables the `~C` escape sequence by default. This can be re-enabled by setting `EnableEscapeCommandline yes`
+
 - `podman` now uses the `netavark` network stack. Users will need to delete all of their local containers, images, volumes, etc, by running `podman system reset --force` once before upgrading their systems.
 
 - `git-bug` has been updated to at least version 0.8.0, which includes backwards incompatible changes. The `git-bug-migration` package can be used to upgrade existing repositories.
diff --git a/pkgs/applications/misc/zine/default.nix b/pkgs/applications/misc/zine/default.nix
index 0cf50c96ada9..3f62f3381c55 100644
--- a/pkgs/applications/misc/zine/default.nix
+++ b/pkgs/applications/misc/zine/default.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zine";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-hkBQ9WaWJrDhGAt35yueINutc7sAMbgbr8Iw5h0Ey4I=";
+    sha256 = "sha256-3xFJ7v/IZQ3yfU0D09sFXV+4XKRau+Mj3BNxkeUjbbU=";
   };
 
-  cargoSha256 = "sha256-rY7WHgd5wyx7TUgJamzre8HjeI0BRtaM14V3doCkfVY=";
+  cargoHash = "sha256-3Sw/USfGJuf6JGSR3Xkjnmm/UR7NK8rB8St48b4WpIM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
index f8a1e515db3b..2a77029d136e 100644
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix
@@ -4,29 +4,51 @@
 , autoPatchelfHook
 , cairo
 , cups
+, darwin
 , fontconfig
-, Foundation
 , glib
 , gtk3
-, gtkSupport ? stdenv.isLinux
 , makeWrapper
 , setJavaClassPath
 , unzip
 , xorg
 , zlib
-}:
-{ javaVersion
+  # extra params
+, javaVersion
 , meta ? { }
 , products ? [ ]
-, ... } @ args:
+, gtkSupport ? stdenv.isLinux
+, ...
+} @ args:
 
 let
+  extraArgs = builtins.removeAttrs args [
+    "lib"
+    "stdenv"
+    "alsa-lib"
+    "autoPatchelfHook"
+    "cairo"
+    "cups"
+    "darwin"
+    "fontconfig"
+    "glib"
+    "gtk3"
+    "makeWrapper"
+    "setJavaClassPath"
+    "unzip"
+    "xorg"
+    "zlib"
+    "javaVersion"
+    "meta"
+    "products"
+    "gtkSupport"
+  ];
   runtimeLibraryPath = lib.makeLibraryPath
     ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
-  mapProducts = key: default: (map (p: p.${key} or default) products);
+  mapProducts = key: default: (map (p: p.graalvmPhases.${key} or default) products);
   concatProducts = key: lib.concatStringsSep "\n" (mapProducts key "");
 
-  graalvmXXX-ce = stdenv.mkDerivation (args // {
+  graalvmXXX-ce = stdenv.mkDerivation ({
     pname = "graalvm${javaVersion}-ce";
 
     unpackPhase = ''
@@ -71,7 +93,7 @@ let
       ++ lib.optional stdenv.isLinux autoPatchelfHook;
 
     propagatedBuildInputs = [ setJavaClassPath zlib ]
-      ++ lib.optional stdenv.isDarwin Foundation;
+      ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Foundation;
 
     buildInputs = lib.optionals stdenv.isLinux [
       alsa-lib # libasound.so wanted by lib/libjsound.so
@@ -109,6 +131,12 @@ let
     installCheckPhase = ''
       runHook preInstallCheck
 
+      ${# broken in darwin
+        lib.optionalString stdenv.isLinux ''
+        echo "Testing Jshell"
+        echo '1 + 1' | $out/bin/jshell
+      ''}
+
       echo ${
         lib.escapeShellArg ''
           public class HelloWorld {
@@ -136,7 +164,6 @@ let
     };
 
     meta = with lib; ({
-      inherit platforms;
       homepage = "https://www.graalvm.org/";
       description = "High-Performance Polyglot VM";
       license = with licenses; [ upl gpl2Classpath bsd3 ];
@@ -144,5 +171,6 @@ let
       mainProgram = "java";
       maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
     } // meta);
-  });
-in graalvmXXX-ce
+  } // extraArgs);
+in
+graalvmXXX-ce
diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
index e4b55cc756b7..aad60e13d308 100644
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
@@ -1,20 +1,42 @@
 { lib
 , stdenv
 , autoPatchelfHook
+, graalvm-ce
 , makeWrapper
 , perl
 , unzip
 , zlib
-}:
-{ product
+  # extra params
+, product
 , javaVersion
-, extraNativeBuildInputs ? [ ]
 , extraBuildInputs ? [ ]
+, extraNativeBuildInputs ? [ ]
+, graalvmPhases ? { }
 , meta ? { }
 , passthru ? { }
-, ... } @ args:
+, ...
+} @ args:
 
-stdenv.mkDerivation (args // {
+let
+  extraArgs = builtins.removeAttrs args [
+    "lib"
+    "stdenv"
+    "autoPatchelfHook"
+    "graalvm-ce"
+    "makeWrapper"
+    "perl"
+    "unzip"
+    "zlib"
+    "product"
+    "javaVersion"
+    "extraBuildInputs"
+    "extraNativeBuildInputs"
+    "graalvmPhases"
+    "meta"
+    "passthru"
+  ];
+in
+stdenv.mkDerivation ({
   pname = "${product}-java${javaVersion}";
 
   nativeBuildInputs = [ perl unzip makeWrapper ]
@@ -55,19 +77,19 @@ stdenv.mkDerivation (args // {
   dontInstall = true;
   dontBuild = true;
   dontStrip = true;
-  # installCheckPhase is going to run in GraalVM main derivation (see buildGraalvm.nix)
-  # to make sure that it has everything it needs to run correctly.
-  # Other hooks like fixupPhase/installPhase are also going to run there for the
-  # same reason.
-  doInstallCheck = false;
 
-  passthru = { inherit product; } // passthru;
+  passthru = {
+    inherit product javaVersion;
+    # build phases that are going to run during GraalVM derivation build,
+    # since they depend in having the fully setup GraalVM environment
+    # e.g.: graalvmPhases.installCheckPhase will run the checks only after
+    # GraalVM+products is build
+    # see buildGraalvm.nix file for the available phases
+    inherit graalvmPhases;
+  } // passthru;
 
   meta = with lib; ({
-    homepage = "https://www.graalvm.org/";
+    inherit (graalvm-ce.meta) homepage license sourceProvenance maintainers platforms;
     description = "High-Performance Polyglot VM (Product: ${product})";
-    license = with licenses; [ upl gpl2Classpath bsd3 ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; teams.graalvm-ce.members ++ [ ];
   } // meta);
-})
+} // extraArgs)
diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index 0f9cec44f18f..9eafd12b97e9 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -2,12 +2,11 @@
 , stdenv
 , callPackage
 , fetchurl
-, Foundation
 }:
 
 let
-  buildGraalvm = callPackage ./buildGraalvm.nix { inherit Foundation; };
-  buildGraalvmProduct = callPackage ./buildGraalvmProduct.nix { };
+  buildGraalvm = callPackage ./buildGraalvm.nix;
+  buildGraalvmProduct = callPackage ./buildGraalvmProduct.nix;
   javaPlatform = {
     "aarch64-linux" = "linux-aarch64";
     "x86_64-linux" = "linux-amd64";
@@ -16,7 +15,8 @@ let
   };
   javaPlatformVersion = javaVersion:
     "${javaVersion}-${javaPlatform.${stdenv.system} or (throw "Unsupported platform: ${stdenv.system}")}";
-  source = product: javaVersion: (import ./hashes.nix).${product}.${javaPlatformVersion javaVersion};
+  source = product: javaVersion: (import ./hashes.nix).${product}.${javaPlatformVersion javaVersion}
+    or (throw "Unsupported product combination: product=${product} java=${javaVersion} system=${stdenv.system}");
 
 in
 rec {
@@ -30,12 +30,55 @@ rec {
     products = [ native-image-installable-svm-java11 ];
   };
 
+  # Mostly available for testing, not to be exposed at the top level
+  graalvm11-ce-full = graalvm11-ce.override {
+    products = [
+      js-installable-svm-java11
+      llvm-installable-svm-java11
+      native-image-installable-svm-java11
+      python-installable-svm-java11
+      ruby-installable-svm-java11
+      wasm-installable-svm-java11
+    ];
+  };
+
+  js-installable-svm-java11 = callPackage ./js-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "js-installable-svm" javaVersion);
+  };
+
+  llvm-installable-svm-java11 = callPackage ./llvm-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "llvm-installable-svm" javaVersion);
+  };
+
   native-image-installable-svm-java11 = callPackage ./native-image-installable-svm.nix rec {
     javaVersion = "11";
     version = "22.3.1";
     src = fetchurl (source "native-image-installable-svm" javaVersion);
   };
 
+  python-installable-svm-java11 = callPackage ./python-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "python-installable-svm" javaVersion);
+  };
+
+  ruby-installable-svm-java11 = callPackage ./ruby-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "ruby-installable-svm" javaVersion);
+    llvm-installable-svm = llvm-installable-svm-java11;
+  };
+
+  wasm-installable-svm-java11 = callPackage ./wasm-installable-svm.nix rec {
+    javaVersion = "11";
+    version = "22.3.1";
+    src = fetchurl (source "wasm-installable-svm" javaVersion);
+  };
+
   graalvm17-ce = buildGraalvm rec {
     version = "22.3.1";
     javaVersion = "17";
@@ -44,9 +87,52 @@ rec {
     products = [ native-image-installable-svm-java17 ];
   };
 
+  # Mostly available for testing, not to be exposed at the top level
+  graalvm17-ce-full = graalvm17-ce.override {
+    products = [
+      js-installable-svm-java17
+      llvm-installable-svm-java17
+      native-image-installable-svm-java17
+      python-installable-svm-java17
+      ruby-installable-svm-java17
+      wasm-installable-svm-java17
+    ];
+  };
+
+  js-installable-svm-java17 = callPackage ./js-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "js-installable-svm" javaVersion);
+  };
+
+  llvm-installable-svm-java17 = callPackage ./llvm-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "llvm-installable-svm" javaVersion);
+  };
+
   native-image-installable-svm-java17 = callPackage ./native-image-installable-svm.nix rec {
     javaVersion = "17";
     version = "22.3.1";
     src = fetchurl (source "native-image-installable-svm" javaVersion);
   };
+
+  python-installable-svm-java17 = callPackage ./python-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "python-installable-svm" javaVersion);
+  };
+
+  ruby-installable-svm-java17 = callPackage ./ruby-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "ruby-installable-svm" javaVersion);
+    llvm-installable-svm = llvm-installable-svm-java17;
+  };
+
+  wasm-installable-svm-java17 = callPackage ./wasm-installable-svm.nix rec {
+    javaVersion = "17";
+    version = "22.3.1";
+    src = fetchurl (source "wasm-installable-svm" javaVersion);
+  };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
index c0353e033ae2..c67702db82b9 100644
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@@ -1,5 +1,133 @@
 # Generated by pkgs/development/compilers/graalvm/community-edition/update.sh script
 {
+  "llvm-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "0h8xkvsixcwak5dymkj3jgjv11w3ivnd6d45v5pdbymd0m2ifia8";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "1zww45z7m3mvzg47fwc3jgqz3hkra220isf4ih8sv6kjg1jc4y14";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "133m9vg9rlp2xkndh3d6b8ybq8vwch99rj1b50xr6bz8r6306ara";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0nz09idp8wawm3yinsplzvxhld8yav06l1nqj02gxrc1kxd5nsr1";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "0ngcm3ara7g1xz4kh515igpyrjhr1k5z9nf4vsaw4lpa5sqljv7z";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "1lr8kk82c3l9hx7wc5hqmpqfgvpk72xg1h07b6cgibry1bm6baj6";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "058pzrd90xx4yi7mm2fvs2npqcdkb2nzhqfwfz5v202038igi61g";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "10rfz8ddq82zpf6cy2y0gx1bx0zhjzm3gwwdb1j7mll0hvwp84sg";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/llvm-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "wasm-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "1d67jm41psypkhpy77cb2l00smhni3pgkybwx79z7dzcyid7p2l1";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "1cg9zxyjirfl0afr9cppg2h17j8qdidi4llbal2g5w1p2v9zq78b";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "19v7jqhvijmzzb0i9q6hbvrmqnmmzbyvai3il9f357qvv6r6lylb";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0sfnsy0r4qf7ni9mh437dad1d8sidajcra2azsmy5qdmh091zhj5";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "0764d97mla5cii4iyvyb43v62dk8ff3plqjmdc69qqxx8mdzpwqv";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "1ip6ybm7p28bs2lifxqhq6fyvfm3wmacv6dqziyl2v7v7yl0iw4i";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/wasm-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "js-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "1b8vnjjsa548c6j3dycxp57i9xmyvndiz2xhv7fm10izcplyspxq";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "1kcy3mjk908zs7f3k95awp6294cwr06hand4cbw1lsnfvp0qwhk7";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "0sq80a4nnvik560whgv5vwlsszi8z02idvpd92p0caf03bra9x2b";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0fd160yxsi09m97z7vqh5kwf1g0p0hn4niy48glj9jhirfqzzw0c";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "18g0xixzk45yrxv3zfs7qrdyj0b3ksp59jhbcis0vwy9gx8094wq";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "0cf4iivkniilvbqyniqxcz1qf49cs4lxi0axjsk9sz1zmxcq0bnk";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "0ibcz6ivx068ndf45j9pghm8qwq287glqxf0xx08kjxnhms67p52";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "16q7whnvdrk8lb4fp96qr3p567kggyk9q5iqcn081qk8xjkbx0zv";
+      url = "https://github.com/graalvm/graaljs/releases/download/vm-22.3.1/js-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
+  "python-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "1yl36x5svld7qnm3m6vmacm2n4d6l9vhdxhaypvlv2bbfbnym3c5";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "0ggx5rwz3qnnxgz407r8yx12556pcbirhnc44972l77r320rdmqc";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "11c19a20v3ff83dxzs9hf1z89kh0qich41b03gx8mancf12jfwnl";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "0pga44whhvm98d8j2v2bpl9rkbvr9bv947rc4imlbf01cyxjwl71";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "0qnh8i9nazrv25jhn13wp7qqm9wwhcz4kpp2ygvsdmf9s3d2f5lf";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "0j13xvy9d19glipz4wdma2y02g0cnksg1iij4247fjhpqh0axkdz";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "1ny5664h7pibvskmm51mlxrxkbbj2dvxsv2yqbq6v51a57wm1yzn";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "01jjncx8jm1yrps2nj217vgcmjaqclmpb27rdp3qn7k64w5wzipg";
+      url = "https://github.com/graalvm/graalpython/releases/download/vm-22.3.1/python-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
   "native-image-installable-svm" = {
     "11-linux-aarch64" = {
       sha256 = "0z9rbmci6yz7f7mqd3xzsxc5ih4hq72lyzqfchan7fr6mh38d6gw";
@@ -68,4 +196,38 @@
       url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.3.1/graalvm-ce-java17-darwin-amd64-22.3.1.tar.gz";
     };
   };
+  "ruby-installable-svm" = {
+    "11-linux-aarch64" = {
+      sha256 = "10wm1sq7smywy63mzlsbn21kzd65yaqj8yismpq8bz19h9skas7w";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java11-linux-aarch64-22.3.1.jar";
+    };
+    "17-linux-aarch64" = {
+      sha256 = "0kh1w49yp3kpfvhqw19bbx51ay1wgzq80gsrfqax4zm5ixz4wsbz";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java17-linux-aarch64-22.3.1.jar";
+    };
+    "11-linux-amd64" = {
+      sha256 = "0avsawgfkqbgqc2hm8zmz37qg9ag3ddni3my8g73kvzfkghsdabh";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java11-linux-amd64-22.3.1.jar";
+    };
+    "17-linux-amd64" = {
+      sha256 = "1ib00pqdhzl24y97j16mm86qwrijqjnmhjmk3g5vdhyhh099vjp1";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java17-linux-amd64-22.3.1.jar";
+    };
+    "11-darwin-aarch64" = {
+      sha256 = "1im75qad89xa2nbl80csnwn56k6n11zv5g91xlkqq4xk300v1saj";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java11-darwin-aarch64-22.3.1.jar";
+    };
+    "17-darwin-aarch64" = {
+      sha256 = "1pfzsisf4sgzxmk3r1p4apzqkwipjpf8naly3v94i5v3b5gbnczx";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java17-darwin-aarch64-22.3.1.jar";
+    };
+    "11-darwin-amd64" = {
+      sha256 = "1jfls71y92hw09s869v2qw8pypgl1fciqz3m9zcd2602hikysq6c";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java11-darwin-amd64-22.3.1.jar";
+    };
+    "17-darwin-amd64" = {
+      sha256 = "03x2h4sw72l05xxg73xj9mzzkxffbjpv8hdi59rgxxljnz0ai6rx";
+      url = "https://github.com/oracle/truffleruby/releases/download/vm-22.3.1/ruby-installable-svm-java17-darwin-amd64-22.3.1.jar";
+    };
+  };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/js-installable-svm.nix b/pkgs/development/compilers/graalvm/community-edition/js-installable-svm.nix
new file mode 100644
index 000000000000..0ab20c0e1dfe
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/js-installable-svm.nix
@@ -0,0 +1,18 @@
+{ lib
+, stdenv
+, graalvm-ce
+, graalvmCEPackages
+, javaVersion
+, src
+, version
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "js-installable-svm";
+
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing GraalJS"
+    echo '1 + 1' | $out/bin/js
+  '';
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/llvm-installable-svm.nix b/pkgs/development/compilers/graalvm/community-edition/llvm-installable-svm.nix
new file mode 100644
index 000000000000..96b9ee9635a5
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/llvm-installable-svm.nix
@@ -0,0 +1,22 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, javaVersion
+, src
+, version
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "llvm-installable-svm";
+
+  postUnpack = ''
+    ln -s $out/languages/llvm/native/lib/*.so $out/lib
+  '';
+
+  # TODO: improve this test
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing llvm"
+    $out/bin/lli --help
+  '';
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix b/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
index 393a226df19c..427c5ffef5b5 100644
--- a/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/native-image-installable-svm.nix
@@ -27,19 +27,20 @@ graalvmCEPackages.buildGraalvmProduct rec {
   inherit src javaVersion version;
   product = "native-image-installable-svm";
 
-  postInstall = lib.optionalString stdenv.isLinux ''
+  graalvmPhases.postInstall = lib.optionalString stdenv.isLinux ''
     wrapProgram $out/bin/native-image \
       --prefix PATH : ${binPath} \
       ${lib.concatStringsSep " "
         (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
   '';
 
-  installCheckPhase = ''
+  graalvmPhases.installCheckPhase = ''
     echo "Ahead-Of-Time compilation"
     $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
     ./helloworld | fgrep 'Hello World'
 
-    ${lib.optionalString (stdenv.isLinux && !useMusl) ''
+    ${# --static is only available in Linux
+      lib.optionalString (stdenv.isLinux && !useMusl) ''
       echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
       $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
       ./helloworld | fgrep 'Hello World'
@@ -49,7 +50,8 @@ graalvmCEPackages.buildGraalvmProduct rec {
       ./helloworld | fgrep 'Hello World'
     ''}
 
-    ${lib.optionalString (stdenv.isLinux && useMusl) ''
+    ${# --static is only available in Linux
+      lib.optionalString (stdenv.isLinux && useMusl) ''
       echo "Ahead-Of-Time compilation with --static and --libc=musl"
       $out/bin/native-image --static HelloWorld --libc=musl
       ./helloworld | fgrep 'Hello World'
diff --git a/pkgs/development/compilers/graalvm/community-edition/python-installable-svm.nix b/pkgs/development/compilers/graalvm/community-edition/python-installable-svm.nix
new file mode 100644
index 000000000000..43d6e85ef560
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/python-installable-svm.nix
@@ -0,0 +1,18 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, javaVersion
+, src
+, version
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "python-installable-svm";
+
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing GraalPython"
+    $out/bin/graalpy -c 'print(1 + 1)'
+    echo '1 + 1' | $out/bin/graalpy
+  '';
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/ruby-installable-svm.nix b/pkgs/development/compilers/graalvm/community-edition/ruby-installable-svm.nix
new file mode 100644
index 000000000000..a5c8f718b278
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/ruby-installable-svm.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, graalvmCEPackages
+, openssl
+, javaVersion
+, musl
+, src
+, version
+, llvm-installable-svm
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "ruby-installable-svm";
+
+  extraBuildInputs = [
+    llvm-installable-svm
+    openssl
+  ];
+
+  preFixup = lib.optionalString stdenv.isLinux ''
+    patchelf $out/languages/ruby/lib/mri/openssl.so \
+      --replace-needed libssl.so.10 libssl.so \
+      --replace-needed libcrypto.so.10 libcrypto.so
+  '';
+
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing TruffleRuby"
+    # Fixup/silence warnings about wrong locale
+    export LANG=C
+    export LC_ALL=C
+    $out/bin/ruby -e 'puts(1 + 1)'
+    ${# broken in darwin with sandbox enabled
+      lib.optionalString stdenv.isLinux ''
+      echo '1 + 1' | $out/bin/irb
+    ''}
+  '';
+}
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.sh b/pkgs/development/compilers/graalvm/community-edition/update.sh
index 476bd754ad50..fb1036cf8870 100755
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@@ -14,9 +14,10 @@ verlte() {
     [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
 }
 
+readonly hashes_nix="hashes.nix"
 readonly nixpkgs=../../../../..
 
-readonly current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm-ce.version | tr -d \")"
+readonly current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm-ce.version --json | jq -r)"
 
 if [[ -z "${1:-}" ]]; then
   readonly gh_version="$(curl \
@@ -39,10 +40,12 @@ fi
 
 declare -r -A products_urls=(
   [graalvm-ce]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/graalvm-ce-java@platform@-${new_version}.tar.gz"
+  [js-installable-svm]="https://github.com/graalvm/graaljs/releases/download/vm-${new_version}/js-installable-svm-java@platform@-${new_version}.jar"
+  [llvm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/llvm-installable-svm-java@platform@-${new_version}.jar"
   [native-image-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/native-image-installable-svm-java@platform@-${new_version}.jar"
-  # [ruby-installable-svm]="https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
-  # [wasm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
-  # [python-installable-svm]="https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
+  [python-installable-svm]="https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
+  [ruby-installable-svm]="https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
+  [wasm-installable-svm]="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
 )
 
 readonly platforms=(
@@ -65,11 +68,20 @@ for product in "${!products_urls[@]}"; do
   url="${products_urls["${product}"]}"
 echo_file "  \"$product\" = {"
   for platform in "${platforms[@]}"; do
-    if hash="$(nix-prefetch-url "${url//@platform@/$platform}")"; then
+    # Reuse cache as long the version is the same
+    if [[ "$current_version" == "$new_version" ]]; then
+        previous_hash="$(nix-instantiate --eval "$hashes_nix" -A "$product.$platform.sha256" --json | jq -r || true)"
+    else
+        previous_hash=""
+    fi
+    # Lack of quoting in $previous_hash is proposital
+    if hash="$(nix-prefetch-url "${url//@platform@/$platform}" $previous_hash)"; then
 echo_file "    \"$platform\" = {"
 echo_file "      sha256 = \"$hash\";"
 echo_file "      url = \"${url//@platform@/${platform}}\";"
 echo_file "    };"
+    else
+        info "Error while downloading '$product' for '$platform'. Skipping it..."
     fi
   done
 echo_file "  };"
@@ -81,6 +93,6 @@ info "Updating graalvm-ce version..."
 sed "s|$current_version|$new_version|" -i default.nix
 
 info "Moving the temporary file to hashes.nix"
-mv "$tmpfile" hashes.nix
+mv "$tmpfile" "$hashes_nix"
 
 info "Done!"
diff --git a/pkgs/development/compilers/graalvm/community-edition/wasm-installable-svm.nix b/pkgs/development/compilers/graalvm/community-edition/wasm-installable-svm.nix
new file mode 100644
index 000000000000..9a5bef7c1e35
--- /dev/null
+++ b/pkgs/development/compilers/graalvm/community-edition/wasm-installable-svm.nix
@@ -0,0 +1,22 @@
+{ lib
+, stdenv
+, graalvm-ce
+, graalvmCEPackages
+, javaVersion
+, src
+, version
+}:
+
+graalvmCEPackages.buildGraalvmProduct rec {
+  inherit src javaVersion version;
+  product = "wasm-installable-svm";
+
+  # TODO: improve this test
+  graalvmPhases.installCheckPhase = ''
+    echo "Testing wasm"
+    $out/bin/wasm --help
+  '';
+
+  # Not supported in aarch64-darwin yet as GraalVM 22.3.1 release
+  meta.platforms = builtins.filter (p: p != "aarch64-darwin") graalvm-ce.meta.platforms;
+}
diff --git a/pkgs/development/libraries/eccodes/default.nix b/pkgs/development/libraries/eccodes/default.nix
index d91cf9298071..5663652429a4 100644
--- a/pkgs/development/libraries/eccodes/default.nix
+++ b/pkgs/development/libraries/eccodes/default.nix
@@ -4,6 +4,7 @@
 , cmake
 , netcdf
 , openjpeg
+, libaec
 , libpng
 , gfortran
 , perl
@@ -15,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "eccodes";
-  version = "2.24.2";
+  version = "2.28.0";
 
   src = fetchurl {
     url = "https://confluence.ecmwf.int/download/attachments/45757960/eccodes-${version}-Source.tar.gz";
-    sha256 = "sha256-xgrQ/YnhGRis4NhMAUifISIrEdbK0/90lYVqCt1hBAM=";
+    sha256 = "sha256-KDE0exUXr569cN08rYiugYqESNTmyGcapyhhfnNDHNU=";
   };
 
   postPatch = ''
@@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     netcdf
     openjpeg
+    libaec
     libpng
   ];
 
@@ -60,9 +62,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   # Only do tests that don't require downloading 120MB of testdata
-  checkPhase = lib.optionalString (stdenv.isDarwin) ''
-    substituteInPlace "tests/include.sh" --replace "set -ea" "set -ea; export DYLD_LIBRARY_PATH=$(pwd)/lib"
-  '' + ''
+  checkPhase = ''
     ctest -R "eccodes_t_(definitions|calendar|unit_tests|md5|uerra|grib_2nd_order_numValues|julian)" -VV
   '';
 
diff --git a/pkgs/development/python-modules/aiohttp-jinja2/default.nix b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
index a9773ff498e1..6008b94179fb 100644
--- a/pkgs/development/python-modules/aiohttp-jinja2/default.nix
+++ b/pkgs/development/python-modules/aiohttp-jinja2/default.nix
@@ -52,6 +52,6 @@ buildPythonPackage rec {
     description = "Jinja2 support for aiohttp";
     homepage = "https://github.com/aio-libs/aiohttp_jinja2";
     license = licenses.asl20;
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/grad-cam/default.nix b/pkgs/development/python-modules/grad-cam/default.nix
new file mode 100644
index 000000000000..4e43915c86df
--- /dev/null
+++ b/pkgs/development/python-modules/grad-cam/default.nix
@@ -0,0 +1,65 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, matplotlib
+, numpy
+, opencv4
+, pillow
+, scikitlearn
+, torch
+, torchvision
+, ttach
+, tqdm
+}:
+
+buildPythonPackage rec {
+  pname = "grad-cam";
+  version = "1.4.6";
+  disabled = pythonOlder "3.6";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-sL4+UUfC60JWAgJPvXeVGUHAskuoceVYwYDrYlibUOE=";
+  };
+
+  postPatch = ''
+    substituteInPlace requirements.txt --replace "opencv-python" "opencv"
+  '';
+
+  propagatedBuildInputs = [
+    matplotlib
+    numpy
+    opencv4
+    pillow
+    scikitlearn
+    torchvision
+    ttach
+    tqdm
+  ];
+
+  # Let the user bring their own instance (as with torchmetrics)
+  buildInputs = [
+    torch
+  ];
+
+  doCheck = false;  # every nontrivial test tries to download a pretrained model
+
+  pythonImportsCheck = [
+    "pytorch_grad_cam"
+    "pytorch_grad_cam.metrics"
+    "pytorch_grad_cam.metrics.cam_mult_image"
+    "pytorch_grad_cam.metrics.road"
+    "pytorch_grad_cam.utils"
+    "pytorch_grad_cam.utils.image"
+    "pytorch_grad_cam.utils.model_targets"
+  ];
+
+  meta = with lib; {
+    description = "Advanced AI explainability for computer vision.";
+    homepage = "https://jacobgil.github.io/pytorch-gradcam-book";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/servers/static-web-server/default.nix b/pkgs/servers/static-web-server/default.nix
index 492f323d3845..0e0c84e97de6 100644
--- a/pkgs/servers/static-web-server/default.nix
+++ b/pkgs/servers/static-web-server/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "static-web-server";
-  version = "2.14.1";
+  version = "2.14.2";
 
   src = fetchFromGitHub {
     owner = "static-web-server";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1x9l39yf65a8ji8x84h583s82hlj6s99gj0fsm4sh2l4i8yrq2yb";
+    sha256 = "sha256-c+bPe1t7Nhpx5fwwpLYtsuzxleLd4b1SwBFBaySmLOg=";
   };
 
-  cargoSha256 = "sha256-Ox1mHjeBprxmuqPIVxeTXDyFcEuipSJ7UjXZjcLElIs=";
+  cargoSha256 = "sha256-K+YXl1SFVe6aBt663QXlQFD8jB5pvlLwNqUvUP+5aU8=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/shells/nix-your-shell/default.nix b/pkgs/shells/nix-your-shell/default.nix
index c5dfaab71505..98125cd4b41d 100644
--- a/pkgs/shells/nix-your-shell/default.nix
+++ b/pkgs/shells/nix-your-shell/default.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nix-your-shell";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "MercuryTechnologies";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kdZFwMHatnhdXGSIItuE3g27qqUKqT/Hkbz13Ba5eq4=";
+    sha256 = "sha256-W3MeApvqO3hBaHWu6vyrR6pniEMMKiXTAQ0bhUPbpx8=";
   };
 
-  cargoSha256 = "sha256-U4nN/N345XFRj0L9cLJAjRuND0W3OE6XEB/z3zXaUiQ=";
+  cargoSha256 = "sha256-M6yj4jTTWnembVX51/Xz+JtKhWJsmQ7SpipH8pHzids=";
 
   meta = with lib; {
     description = "A `nix` and `nix-shell` wrapper for shells other than `bash`";
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index d162774ed59b..2d7f00d2d649 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.70.0";
+  version = "0.71.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Dr0kVJk2LyyRFZq1fZBQSLb7z/AfCm8Y+tIMm8JmyJo=";
+    hash = "sha256-Q02WBUMwboGkXrSjCT2C3vLYH4UlnavIudvOSb5g2bA=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorHash = "sha256-UB0ltY4CYlsH4CyQZSOHDH8C9jSCL0TCri33H3oPH/0=";
+  vendorHash = "sha256-bUSQk4uJ4TAhjLS8pjqC486sa31z/MyZf5jDsnxhtSM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index f9ad037d55da..b7e1e879b060 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -6,11 +6,11 @@ in
 
   openssh = common rec {
     pname = "openssh";
-    version = "9.1p1";
+    version = "9.2p1";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-GfhQCcfj4jeH8CNvuxV4OSq01L+fjsX+a8HNfov90og=";
+      hash = "sha256-P2bb8WVftF9Q4cVtpiqwEhjCKIB7ITONY068351xz0Y=";
     };
 
     extraPatches = [ ./ssh-keysign-8.5.patch ];
@@ -37,6 +37,13 @@ in
         stripLen = 1;
         sha256 = "sha256-p3CmMqTgrqFZUo4ZuqaPLczAhjmPufkCvptVW5dI+MI=";
       })
+
+      (fetchpatch {
+        name = "CVE-2023-25136.patch";
+        url = "https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig";
+        stripLen = 1;
+        hash = "sha256-ol/YXXb2gJNBfvg9JKmIEdwGK8RaDfW53aKKT6HU++M=";
+      })
     ];
 
     extraNativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/tools/security/amber/default.nix b/pkgs/tools/security/amber/default.nix
index c2196cea686a..2b64480c4a00 100644
--- a/pkgs/tools/security/amber/default.nix
+++ b/pkgs/tools/security/amber/default.nix
@@ -3,16 +3,16 @@
 rustPlatform.buildRustPackage rec {
   # Renaming it to amber-secret because another package named amber exists
   pname = "amber-secret";
-  version = "0.1.3";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "fpco";
     repo = "amber";
     rev = "v${version}";
-    sha256 = "sha256-kPDNTwsfI+8nOgsLv2aONrLGSRZhw5YzNntJ2tbE0oI=";
+    sha256 = "sha256-11dqfOi/DdfFrFTeboPyFkixXG+fCJ2jpHM55qsQ1jw=";
   };
 
-  cargoSha256 = "sha256-fTdTgbeOQXEpLHq9tHiPLkttvaxS/WJ86h3jRdrfbJM=";
+  cargoHash = "sha256-u0vceIurenYnKfF3gWNw304hX4vVFoszZD7AMwffOmc=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
diff --git a/pkgs/tools/security/gotrue/supabase.nix b/pkgs/tools/security/gotrue/supabase.nix
index 0f1b461b9289..d7c158e6a004 100644
--- a/pkgs/tools/security/gotrue/supabase.nix
+++ b/pkgs/tools/security/gotrue/supabase.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gotrue";
-  version = "2.47.0";
+  version = "2.47.1";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ww3tiIIn2Vwhwa5IgkrybnWQQ3beihQhZzB1ysz4y1k=";
+    hash = "sha256-GBrdYlWvtlz/A/5Tn58EPYBL3X73D44GzbN1OrzwU8U=";
   };
 
   vendorHash = "sha256-FIl30sKmdcXayK8KWGFl+N+lYExl4ibKZ2tcvelw8zo=";
diff --git a/pkgs/tools/text/mdbook-open-on-gh/default.nix b/pkgs/tools/text/mdbook-open-on-gh/default.nix
index cba1e97591ef..29c6e54ee5f6 100644
--- a/pkgs/tools/text/mdbook-open-on-gh/default.nix
+++ b/pkgs/tools/text/mdbook-open-on-gh/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-open-on-gh";
-  version = "2.3.1";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "badboy";
     repo = pname;
     rev = version;
-    hash = "sha256-uXfvE34yRrTUjh/HTMvOeZVxX4Drt6sxziaazg0CR3I=";
+    hash = "sha256-K7SkfUxav/r8icrpdfnpFTSZdYV9qUEvYZ2dGSbaP0w=";
   };
 
-  cargoHash = "sha256-ol06ErggVLw2ThpXq9NRWEr7ymDSEBN4ae5zUmHKa7k=";
+  cargoHash = "sha256-Uvg0h0s3xtv/bVjqWLldvM/R5HQ6yoHdnBXvpUp/E3A=";
 
   meta = with lib; {
     description = "mdbook preprocessor to add a open-on-github link on every page";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4e0e0de327f2..9ab92fc82e35 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15019,9 +15019,7 @@ with pkgs;
   openjdk_headless = jdk_headless;
 
   graalvmCEPackages =
-    recurseIntoAttrs (callPackage ../development/compilers/graalvm/community-edition {
-      inherit (darwin.apple_sdk.frameworks) Foundation;
-    });
+    recurseIntoAttrs (callPackage ../development/compilers/graalvm/community-edition { });
   graalvm-ce = graalvm11-ce;
   graalvm11-ce = graalvmCEPackages.graalvm11-ce;
   graalvm17-ce = graalvmCEPackages.graalvm17-ce;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 267ceb9b8586..22f1620332f7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4065,6 +4065,8 @@ self: super: with self; {
 
   gql = callPackage ../development/python-modules/gql { };
 
+  grad-cam = callPackage ../development/python-modules/grad-cam { };
+
   gradient = callPackage ../development/python-modules/gradient { };
 
   gradient-utils = callPackage ../development/python-modules/gradient-utils { };