diff --git a/nodejs20.spec b/nodejs20.spec
index 9adbc81..2d897f1 100644
--- a/nodejs20.spec
+++ b/nodejs20.spec
@@ -26,8 +26,8 @@
 # than a Fedora release lifecycle.
 %global nodejs_epoch 1
 %global nodejs_major 19
-%global nodejs_minor 8
-%global nodejs_patch 1
+%global nodejs_minor 9
+%global nodejs_patch 0
 # nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
 %global nodejs_soversion 111
 %global nodejs_abi %{nodejs_soversion}
@@ -97,7 +97,7 @@
 
 # npm - from deps/npm/package.json
 %global npm_epoch 1
-%global npm_version 9.5.1
+%global npm_version 9.6.3
 
 # In order to avoid needing to keep incrementing the release version for the
 # main package forever, we will just construct one for npm that is guaranteed
diff --git a/sources b/sources
index 41aa80d..353f411 100644
--- a/sources
+++ b/sources
@@ -1,7 +1,7 @@
-SHA512 (node-v19.8.1-stripped.tar.gz) = a28bc87d1fa92f08b3d26fbc09d20e2d7446ee1cfcb5b334f12ac7910bebeb6df1bb72f7bdabd0e2358e8ab826bb39468562b6f34e63e7383283b5b374229175
+SHA512 (node-v19.9.0-stripped.tar.gz) = f5eabf55bd4da81b85660df5916f271cb59737f138f4e95192d21c36f588b6111edde9e937e06c74341231f69e006406592062a7c5da628c39f00b598d7ace22
 SHA512 (icu4c-72_1-data-bin-b.zip) = ed0ce3ebd02f81cca7b3808abc72dc99962eb36bd123ebdf45c578b307b674566491191b6f7d261c679b2b5662b7084c61452b98968b35df3f749d413d5d7663
 SHA512 (icu4c-72_1-data-bin-l.zip) = cc9a8cf2a89dacde4fab4a68ca7a7ba1fd106b71ebc23318fb9293ab96001be825bf89b1daf3da02958ba201ca4f714a67a26db3a51dc03653b9970ebdd5ff56
-SHA512 (cjs-module-lexer-1.2.2-stripped.tar.gz) = 2adef1323ee3031756840ee1146323983571ababc51befb40e96a23b2880fdc7763e178bd3cd0488c575f728facbe36f83d39cd114c4f4f14914cdc7c90df42b
+SHA512 (cjs-module-lexer-1.2.2-stripped.tar.gz) = 0947b93da4febb7b885542b837bb4bb1a4c48e8a7b9beb8478d8d4e3f2fb9c3811fcff62b47bfad5c6996e8f95b299ea9a62a786a72830fec52472d9f41b21cc
 SHA512 (wasi-sdk-11.0-linux.tar.gz) = e3ed4597f7f2290967eef6238e9046f60abbcb8633a4a2a51525d00e7393df8df637a98a5b668217d332dd44fcbf2442ec7efd5e65724e888d90611164451e20
-SHA512 (undici-5.21.0-stripped.tar.gz) = a98db01c51018fa731cef87d2b1558f2e7bb1f93b7d498898d4e9b65a3379dceb1f8397430c676d523a8c1d0b95c482bb5201a50f7f6b2696e3c32ecc0ae2c55
+SHA512 (undici-5.21.0-stripped.tar.gz) = 5c5ce9e4c3f6dfa66612507cd0b6f78bb99a994ae0586d2ee9a40bc99bf45607a1f9029f3c67ac8b72121375dbd2ff0d1b80d0fe6c4c690df7dc2088186721bc
 SHA512 (wasi-sdk-14.0-linux.tar.gz) = 288a367e051f5b3f5853de97fabaedd3acf2255819d50c24f48f573897518500ea808342fd9aea832b2a5717089807bf1cbcf6d46b156b4eb60cc6b3c02ee997