chore(packages): bump pins to current upstream releases

- awg-tool 0.4.0 -> 0.5.0
- awgen 0.1 -> 0.2
- codeaf 0.7.1 -> 0.8.2
- ds4 -> ee7e840 (2026-10-21)
- freebuff 0.2.19 -> 0.2.34
- graphify 0.9.77 -> 0.9.95 (add pyyaml dependency)
- hipengine 0.6.1 -> 0.8.3
- kubernetes-mcp-server 0.0.67 -> 0.0.69 (build with go_1_27)
- kyojin 1.3 -> 1.7.1 (drop obsolete setup.py/pyproject patches, ship
  gr_mix_hip from the package, add ninja runtime dependency)
- marmel -> de3e99c (2026-10-23)
- omniroute 3.8.50 -> 3.8.52
- open-code-review 1.12.12 -> 1.13.3 (build with go_1_27)
- pilotdeck 2026.10.17 -> 2026.10.20
- radar 1.16.2 -> 1.18.0
- traycer 1.4.2 -> 1.5.1

Verified: nix build passes for every bumped package; kyojin.tests.jit
compiles all five JIT kernels.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

packages/awg-tool/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awg-tool";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "Vadim-Khristenko";
     repo = "awg-containers-and-tools";
     rev = "v${version}";
-    hash = "sha256-ggQjlHxNY3uXdLkE3CsSjsijFQScaJyCMhaXwASARSg=";
+    hash = "sha256-mO4xKUHee2zR14rFgJexeTr0kj9mdahg37tCtQUq2dI=";
   };
 
   # awg-core builds ssh2 with vendored-openssl, which compiles libssh2
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     perl
   ];
 
-  cargoHash = "sha256-2Vh9DXn6qdUT6wiITDID09j1iqpTHkZt/mpjAlYFA60=";
+  cargoHash = "sha256-NDTwo0j5ufuFM0BVYOtnju1G9y9M6SKuiWMWIb7idBY=";
 
   # Upstream tests exercise Docker/SSH targets; unit tests are already
   # covered by the upstream CI before a release is cut.

packages/awgen/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awgen";
-  version = "0.1";
+  version = "0.2";
 
   src = fetchFromGitea {
     domain = "git.millerson.name";
     owner = "alex";
     repo = "awgen";
     rev = "v${version}";
-    hash = "sha256-PTwOswKI08/oHTKZDZOQfPPBXhNNxot2+tpnUweZ8gg=";
+    hash = "sha256-hW8QONvwvhBcg2aHzOO1SNpLF7I+As4dxdYodGYHPUw=";
   };
 
-  cargoHash = "sha256-/ENWhp2SpcZcTk55xXsm/IHfyj86aNzH6PAb9VBtAX4=";
+  cargoHash = "sha256-Y7SKh0F7wOTejBesjQbLVBoZKjDDrVGUjGCVZRlP4lg=";
 
   passthru = {
     category = "Networking";

packages/codeaf/package.nix

@@ -22,16 +22,16 @@
 # unless one is on PATH.
 buildGoModule rec {
   pname = "codeaf";
-  version = "0.7.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Agent-Field";
     repo = "CodeAF";
     rev = "v${version}";
-    hash = "sha256-F4rRDNrTCF8/cj6g0KM41+gNdzvTWw5Vj2N0OJp+vCc=";
+    hash = "sha256-Gz/o32b/HeDsOJtC4nKL79ArPdNtD3kIq3nzp+vLffE=";
   };
 
-  vendorHash = "sha256-eIocnhp3uGk+wG0kprRie0Csms+Deqxy3K3HuI1vJyM=";
+  vendorHash = "sha256-stp2h8l3MkewQXuOVbExQu1LjKoET/jvCSqtqIGMItY=";
 
   env.CGO_ENABLED = 0;
 

packages/ds4/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "ds4";
-  version = "0-unstable-2026-09-20";
+  version = "0-unstable-2026-10-21";
 
   src = fetchFromGitHub {
     owner = "antirez";
     repo = "ds4";
-    rev = "0aaea5a238fb41a35106a551e73c8409dfb751ac";
-    hash = "sha256-Bo/td1HwVjw6bwz3BDwTP+ZSudkVFCo2aIVK4axvmXg=";
+    rev = "ee7e8405232c8971000cc7ba2b945b00bf6d20d3";
+    hash = "sha256-o2F3OA2eHIac2iRvck/z3Nj/YYijoSXfPi+1zbdd2tU=";
   };
 
   nativeBuildInputs = [

packages/freebuff/package.nix

@@ -9,11 +9,11 @@
 }:
 
 let
-  version = "0.2.19";
+  version = "0.2.34";
 
   freebuffSrc = fetchurl {
     url = "https://registry.npmjs.org/freebuff/-/freebuff-${version}.tgz";
-    hash = "sha256-vIypYxwCuA/PKpldhwuFVNqwtm4UXZM6xInKZ5A+u9w=";
+    hash = "sha256-oYthWoPDTbwOBNCdht1cQKzH7MLPkyzSKyQmM6KNer0=";
   };
 
   pkgTar = fetchurl {
@@ -48,14 +48,14 @@ let
 
   binarySrc = fetchurl {
     url = "https://github.com/CodebuffAI/codebuff-community/releases/download/freebuff-v${version}/freebuff-linux-x64.tar.gz";
-    hash = "sha256-8EfFlhc6k0fEDws3w4kw1rIPQr5RXZHtekjxwouWW7Q=";
+    hash = "sha256-XZ8YtaVqyA5FdUfKOFl2aij9jd0yw5ZJLyzbKLklB+I=";
   };
 
 in
 
 stdenv.mkDerivation rec {
   pname = "freebuff";
-  version = "0.2.19";
+  version = "0.2.34";
 
   src = freebuffSrc;
 

packages/graphify/package.nix

@@ -6,18 +6,18 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "graphify";
-  version = "0.9.77";
+  version = "0.9.95";
   pyproject = true;
 
   # Do not bump to the v1.0.0 tag: it is a stale branch 2126 commits behind
-  # v0.9.77 (tagged 2026-04-05, pyproject still says graphifyy 0.1.10) and was
-  # never published to PyPI, where 0.9.77 is the latest release. nix-update
-  # picks v1.0.0 as the highest tag, so check PyPI before taking its result.
+  # the v0.9.x releases (pyproject still says graphifyy 0.1.10) and was never
+  # published to PyPI, where 0.9.95 is the latest release. nix-update picks
+  # v1.0.0 as the highest tag, so check PyPI before taking its result.
   src = fetchFromGitHub {
     owner = "Graphify-Labs";
     repo = "graphify";
     rev = "v${version}";
-    hash = "sha256-CvJ6GoV1nSzFGfLQbzKSHDUNOuOPQZaYOf/idcSHkPw=";
+    hash = "sha256-/OdOq9RXzjflrFY2UFGxYVQBESh9PWUQjZFox0Q59hw=";
   };
 
   build-system = with python3Packages; [
@@ -29,6 +29,7 @@ python3Packages.buildPythonApplication rec {
   dependencies = with python3Packages; [
     networkx
     numpy
+    pyyaml
     rapidfuzz
     tree-sitter
     tree-sitter-python

packages/hipengine/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "hipengine";
-  version = "0.6.1";
+  version = "0.8.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "shisa-ai";
     repo = "hipEngine";
     rev = "v${version}";
-    hash = "sha256-7FQZuExTTqcMKZkCRzLC5nYLpGytswhEsBTUliQqoTI=";
+    hash = "sha256-T5mRTG0LGb6dbsyNjKuuqOK0H81cQtWPi2iZD6QTcwc=";
   };
 
   build-system = with python3Packages; [

packages/kubernetes-mcp-server/package.nix

@@ -2,20 +2,22 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  go_1_27,
 }:
 
-buildGoModule rec {
+# go.mod requires go >= 1.26.10; nixpkgs-latest still ships 1.26.x.
+(buildGoModule.override { go = go_1_27; }) rec {
   pname = "kubernetes-mcp-server";
-  version = "0.0.67";
+  version = "0.0.69";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "kubernetes-mcp-server";
     rev = "v${version}";
-    hash = "sha256-rejF9JsszB3ZirZhoK1VDbCH/P0Xzmh4TJw5j+okj+M=";
+    hash = "sha256-mvWFYxI1m8awaNl7p1utQ7lLwCwVdm+6e8K/lbpBSv4=";
   };
 
-  vendorHash = "sha256-TSB2jAWh2PlDHpvzA/rrBbjaR8sgyjivDO0vsbcuvgg=";
+  vendorHash = "sha256-iKexsARqV4pvYpjzd2nP79U6pzhEB7Ou5O6ET05iMQ4=";
 
   env.CGO_ENABLED = 0;
 

packages/kyojin/check-jit.py

@@ -30,7 +30,7 @@ if "--gpu" in sys.argv:
     lib.hipModuleUnload.argtypes = [ctypes.c_void_p]
 
 for module, function, args in [
-    ("gr_mix_hip", "compile_hsaco", ()),
+    ("exllamav3.modules.gr_fn.gr_mix_hip", "compile_hsaco", ()),
     ("exllamav3.modules.attention_fn.qsa_prefill_hip", "compile_hsaco", ()),
     ("exllamav3.modules.ple_fn.ple_hip", "compile_hsaco", ()),
     ("exllamav3.vendor.fla.hip.gdn_fused_h_hip", "_compile", ("", "gfx1151")),

packages/kyojin/package.nix

@@ -18,13 +18,13 @@ let
   # only supports AMD Strix Halo, so the kernels are built for gfx1151 alone.
   rocmArch = "gfx1151";
 
-  version = "1.3";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "Yamz-Labs";
     repo = "kyojin";
     rev = "v${version}";
-    hash = "sha256-/DPoqW/iaLXRAH8XF5RdE+K5YS4jZT6Sic6QeCDQMlU=";
+    hash = "sha256-84lRbN7H5eNG/RG8Ygvo9cByGOVOp7moFi0GS/YF+mU=";
   };
 
   # setup.py passes EXL3_ROCM_DEV_INCLUDE as -I to every translation unit. The
@@ -111,6 +111,7 @@ let
       jinja2
       llguidance
       marisa-trie
+      ninja
       numpy
       pillow
       pydantic
@@ -136,26 +137,9 @@ let
       EXL3_HIP_DEFINES = "EXL3_HIP_STG_PAD";
     };
 
-    # setup.py pulls the extension source list and the arch helper with
-    # `from exllamav3...import ...`, which runs the package __init__ and
-    # therefore exllamav3/ext.py. That module JIT-compiles the extension when no
-    # precompiled exllamav3_ext is importable, i.e. during every wheel build
-    # (and it wants a writable $HOME for it). Register an empty `exllamav3`
-    # package first so only the two leaf modules are imported, and load
-    # build_config without the package wrapper.
-    postPatch = ''
-      sed -i '1i import sys as _sys, types as _types; _exl3_pkg = _types.ModuleType("exllamav3"); _exl3_pkg.__path__ = ["exllamav3"]; _sys.modules.setdefault("exllamav3", _exl3_pkg)' setup.py
-      sed -i 's|^from exllamav3\.exllamav3_ext\.build_config import get_sources as _get_sources$|import sys as _exl3_sys; _exl3_sys.path.insert(0, "exllamav3/exllamav3_ext"); from build_config import get_sources as _get_sources; _exl3_sys.path.pop(0)|' setup.py
-      grep -q 'from build_config import' setup.py
-
-      # Upstream serves these from the checkout (pip install -e .); the wheel only
-      # packages what pyproject lists, and three things are read out of the
-      # installed package at run time: the .hip sources the JIT kernels compile,
-      # the qsa_proof marker gating the QSA prefill kernel, and the dense-GEMM
-      # tuning seed (without it every start re-tunes for ~7 minutes).
-      sed -i 's|^    "exllamav3_ext/\*\*/\*",$|&\n    "**/*.hip",\n    "**/*.ok",\n    "model/dense_gemm_tune_seed.txt",|' pyproject.toml
-      grep -q '"\*\*/\*.hip"' pyproject.toml
-    '';
+    # setup.py loads exllamav3/exllamav3_ext/build_config.py by path (and
+    # pyproject.toml ships the .hip sources, qsa_proof markers, and dense-GEMM
+    # tuning seed), so no source patches are needed.
 
     # tests/ needs a real gfx1151 GPU and the published model packs.
     doCheck = false;
@@ -189,10 +173,7 @@ stdenv.mkDerivation {
   # exllamav3 finds hipcc under $EXL3_ROCM_SDK, and hipclang only finds the
   # amdgcn bitcode through $HIP_DEVICE_LIB_PATH (hipcc's own DEVICE_LIB_PATH is
   # not enough for a --genco call). The ROCm paths stay out of LD_LIBRARY_PATH
-  # (upstream Trap 1/5: a second libhsa segfaults torch), and PYTHONPATH gets
-  # `gr/`: upstream env.sh puts the repo root there so `import gr_mix_hip` (the
-  # hand-written gated-residual WMMA kernel the server asks for with
-  # EXL3_GR_HIP=1) resolves, and it is not part of the wheel either.
+  # (upstream Trap 1/5: a second libhsa segfaults torch).
   dontConfigure = true;
   dontBuild = true;
 
@@ -210,7 +191,6 @@ stdenv.mkDerivation {
         --set HIP_DEVICE_LIB_PATH ${rocmPackages."rocm-device-libs"}/amdgcn/bitcode \
         --set EXL3_EXPANDABLE_SEGMENTS 0 \
         --prefix PATH : ${lib.makeBinPath [ stdenv.cc ]} \
-        --prefix PYTHONPATH : ${src}/gr \
         --add-flags "${src}/tools/$model/serve.py"
     done
 
@@ -229,7 +209,6 @@ stdenv.mkDerivation {
           # matmul; a custom hipcc must select its own bitcode in its subprocess.
           HIP_DEVICE_LIB_PATH = "${rocmPackages."rocm-device-libs"}/amdgcn/bitcode";
           EXL3_EXPANDABLE_SEGMENTS = "0";
-          PYTHONPATH = "${src}/gr";
           KYOJIN_REQUIRE_SDK = lib.boolToString (jitRocmSdk != null);
         }
         ''

packages/marmel/package.nix

@@ -11,16 +11,16 @@ rustPlatform.buildRustPackage rec {
   # says 1.0.0, so the version is meaningless and the source is tracked by
   # branch head, dated by nix-update's 0-unstable-* scheme. Bump with
   # nix-update (see passthru.updateScript).
-  version = "0-unstable-2026-10-19";
+  version = "0-unstable-2026-10-23";
 
   src = fetchFromGitHub {
     owner = "Na1w";
     repo = "marmel";
-    rev = "b08923eaef6057410140d80f5dad37b6b511c5af";
-    hash = "sha256-GkGjhsVCWNqaa6a5kwSSgiI69ZabkFLPWmnI9RfWXuQ=";
+    rev = "de3e99c89b18bf43fbb471930bd9f7a40e1ca1b2";
+    hash = "sha256-Z8qvzwSTpri9M05xZ07PJi9xSYIgBOos9bDh0NijSZg=";
   };
 
-  cargoHash = "sha256-etqW3xcxkiNfkiPxl/Emt5pQCkNnoIhHFkX0Zqfs4rc=";
+  cargoHash = "sha256-FbtY6K+0tG7JymhG/PnK+SU7SW/IFjG8Wswt+EnWPhg=";
 
   nativeCheckInputs = [ cacert ];
 

packages/omniroute/package.nix

@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "3.8.50";
+  version = "3.8.52";
   npmTarball = fetchurl {
     url = "https://registry.npmjs.org/omniroute/-/omniroute-${version}.tgz";
-    hash = "sha256-c4xYrx+q6MV+tkOpOdEZH41+CD2Sle9haH0r/wSHjCk=";
+    hash = "sha256-T7Vw99swmfwcwB0W9ON8DBoctDBJ/z6F+/v6hsZrhqc=";
   };
 in
 
@@ -23,7 +23,7 @@ buildNpmPackage (finalAttrs: {
     owner = "diegosouzapw";
     repo = "OmniRoute";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+2FMc9wrvPtQS3+mGsBVvKrd5RprYe/r/GJvjAVMBpc=";
+    hash = "sha256-k4+iy6aFWaFxVPcTStR4xNCJjw/UHeMqb5XnEvuqJZU=";
   };
 
   nodejs = nodejs_22;
@@ -32,7 +32,7 @@ buildNpmPackage (finalAttrs: {
   # v1 fetcher drops from the cache (npm then fails with ENOTCACHED).
   npmDepsFetcherVersion = 2;
 
-  npmDepsHash = "sha256-wa5vQMYugA8E7lXOh4lgNH7JNbKOinNaW6Zk8Mw2e8k=";
+  npmDepsHash = "sha256-F4q2JTPy1L33U6Hlh99Ehd2Cjwo9CET46JlKb2sGSWE=";
 
   # Skip Next.js build (requires network for Google Fonts).
   # Pre-built dist/ is copied from the npm tarball in preConfigure.

packages/open-code-review/package.nix

@@ -3,20 +3,22 @@
   buildGoModule,
   fetchFromGitHub,
   callPackage,
+  go_1_27,
 }:
 
-buildGoModule rec {
+# go.mod requires go >= 1.26.9; nixpkgs' default Go is older.
+(buildGoModule.override { go = go_1_27; }) rec {
   pname = "open-code-review";
-  version = "1.12.12";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "alibaba";
     repo = "open-code-review";
     rev = "v${version}";
-    hash = "sha256-U8C1LdO+6QQKDStitCDVypdNq5IkRgBlPbH4udpXLRM=";
+    hash = "sha256-dDKNxjI0pWoJGabUvsGTERYKvKtvEm3UGD/FLPKpfnw=";
   };
 
-  vendorHash = "sha256-f5Ty22wicf1J8+RKnHYcEO7flWn9gkWQODlfunn23EA=";
+  vendorHash = "sha256-LpqnNp6gxHatHH68pM59ESQICDDSVrkZm7AJLVvYTao=";
 
   env.CGO_ENABLED = 0;
 

packages/pilotdeck/package.nix

@@ -33,7 +33,7 @@
 }:
 
 let
-  version = "2026.10.17";
+  version = "2026.10.20";
 
   # apps/desktop/package.json carries the Electron application version used
   # by the UI build marker and the desktop package manifest.
@@ -84,7 +84,7 @@ let
       owner = "OpenBMB";
       repo = "PilotDeck";
       tag = "v${version}";
-      hash = "sha256-VgsMoaaAtLIieBr4TchP61u5xV3PnVqjviak6DN7TPY=";
+      hash = "sha256-y6U0aMiVT7Nt8g0+x5TUZ9gf/WbEDB5n0JM/DjUMS0w=";
     };
     dontConfigure = true;
     dontBuild = true;
@@ -105,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenBMB";
     repo = "PilotDeck";
     tag = "v${version}";
-    hash = "sha256-VgsMoaaAtLIieBr4TchP61u5xV3PnVqjviak6DN7TPY=";
+    hash = "sha256-y6U0aMiVT7Nt8g0+x5TUZ9gf/WbEDB5n0JM/DjUMS0w=";
   };
 
   pnpmDeps = fetchPnpmDeps {

packages/radar/package.nix

@@ -6,13 +6,13 @@
 }:
 
 let
-  version = "1.16.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "skyhook-io";
     repo = "radar";
     rev = "k8s-ui-v${version}";
-    hash = "sha256-OrG628fEXVRwH3W4EBUBeqzFUyp12m3Xt4qTC5r5kVE=";
+    hash = "sha256-7JvOB5jjwjqu4DIWAh2HM8TrkuuPaWAEla/gjq0Yw3w=";
   };
 
   # Build the frontend as a separate derivation.
@@ -26,7 +26,7 @@ let
     # Upstream lockfile ships complete resolved/integrity fields for all
     # packages since v1.9.x, so no lockfile patching is needed anymore.
 
-    npmDepsHash = "sha256-1wznZuUbDKQlqJZpuNU+s7l24OY9981ak66HroXUtLk=";
+    npmDepsHash = "sha256-jP1pTa/L48VeFsKndyTkVnYB5cuEGMb0GpnHTXyAC0U=";
     npmDepsFetcherVersion = 2;
     makeCacheWritable = true;
 
@@ -54,7 +54,7 @@ buildGoModule {
   pname = "radar";
   inherit version src;
 
-  vendorHash = "sha256-4xkFqa0hWN57bjfA0bgO8mcCsk3iVW45F8RJQnS2nm0=";
+  vendorHash = "sha256-tI0zurw7QCdeIdZgfn3D8yzecU2F4oYlLSO8VSkY6PQ=";
 
   # Copy pre-built frontend assets before Go compilation for go:embed
   preBuild = ''

packages/traycer/package.nix

@@ -5,10 +5,10 @@
 }:
 
 let
-  version = "1.4.2";
+  version = "1.5.1";
   src = fetchurl {
     url = "https://github.com/traycerai/traycer/releases/download/desktop-v${version}/traycer-desktop-linux-x86_64.AppImage";
-    hash = "sha256-OIJ2e+BAomg3Fq7zaxlVi5o8hpDECaVUYsPpLiYib1I=";
+    hash = "sha256-7aToaC9Dl8hjEzb4dKFNNhVjj5Er/QWzsb6B3/IiQIE=";
   };
   appimageContents = appimageTools.extractType2 {
     pname = "traycer";