From 4c482de9b9f18ee7e8486624cd22ba6e3de90be7 Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sat, 1 Aug 2026 21:17:37 +0200 Subject: [PATCH 1/8] bitwarden-desktop: use npmDepsFetcherVersion 2 There is no version 3 yet, hashes will break in the future if we add a new version. --- pkgs/by-name/bi/bitwarden-desktop/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix index d1dccec7b1ff..4422068fd053 100644 --- a/pkgs/by-name/bi/bitwarden-desktop/package.nix +++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix @@ -73,8 +73,8 @@ buildNpmPackage (finalAttrs: { ]; npmWorkspace = "apps/desktop"; - npmDepsFetcherVersion = 3; - npmDepsHash = "sha256-8wjt5wnJG4S4EeGWGxbo6Bwt76GIqrSiwqwwwQ17Y5Y="; + npmDepsFetcherVersion = 2; + npmDepsHash = "sha256-WRxlvkgWboO0ukUHgjC5CrfgfwnmUfDXI4r5dx9CKww="; cargoDeps = rustPlatform.fetchCargoVendor { inherit (finalAttrs) From c97d2b5476b90cb8217927612d97d2f66f11c15f Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sat, 1 Aug 2026 21:17:37 +0200 Subject: [PATCH 2/8] exo: use npmDepsFetcherVersion 2 There is no version 3 yet, hashes will break in the future if we add a new version. --- pkgs/by-name/ex/exo/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ex/exo/package.nix b/pkgs/by-name/ex/exo/package.nix index d8acacd3973a..7ecfe0f4644e 100644 --- a/pkgs/by-name/ex/exo/package.nix +++ b/pkgs/by-name/ex/exo/package.nix @@ -56,7 +56,7 @@ let inherit src version; sourceRoot = "${finalAttrs.src.name}/dashboard"; - npmDepsFetcherVersion = 3; + npmDepsFetcherVersion = 2; npmDeps = fetchNpmDeps { inherit (finalAttrs) @@ -65,8 +65,8 @@ let src sourceRoot ; - fetcherVersion = 3; - hash = "sha256-gBWJP0dF2zDEWLYxfKYQSn9O5hVRkcviDv9oP267pQQ="; + fetcherVersion = 2; + hash = "sha256-d/+54lpNe0tXrC+Mrhpc1cdXOMjYblE0QByIdiaDgU0="; }; }); in From cf8c0c8fc9f579c62c38694279395b51ac4e406c Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sat, 1 Aug 2026 21:17:37 +0200 Subject: [PATCH 3/8] ghui: use npmDepsFetcherVersion 2 There is no version 3 yet, hashes will break in the future if we add a new version. --- pkgs/by-name/gh/ghui/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gh/ghui/package.nix b/pkgs/by-name/gh/ghui/package.nix index bd4b30d000d5..418b8253b7a6 100644 --- a/pkgs/by-name/gh/ghui/package.nix +++ b/pkgs/by-name/gh/ghui/package.nix @@ -31,8 +31,8 @@ buildNpmPackage (finalAttrs: { cp ${./package-lock.json} package-lock.json ''; - npmDepsHash = "sha256-pg+USHnvcxaXG/floNItLXNFJOPvuDltQCcN1qT/nng="; - npmDepsFetcherVersion = 3; + npmDepsHash = "sha256-JxyG7qMJS7zchxLIxYCmsFajUVW4fONnqgeq2iKlt4A="; + npmDepsFetcherVersion = 2; nativeBuildInputs = [ bun ]; From d3edf45a0723454799c6a090b1903186ddb26b69 Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sat, 1 Aug 2026 21:17:37 +0200 Subject: [PATCH 4/8] glitchtip: use npmDepsFetcherVersion 2 There is no version 3 yet, hashes will break in the future if we add a new version. --- pkgs/by-name/gl/glitchtip/frontend.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gl/glitchtip/frontend.nix b/pkgs/by-name/gl/glitchtip/frontend.nix index 86c37d73d166..e3b4406c9d5f 100644 --- a/pkgs/by-name/gl/glitchtip/frontend.nix +++ b/pkgs/by-name/gl/glitchtip/frontend.nix @@ -21,11 +21,12 @@ buildNpmPackage (finalAttrs: { nodejs = nodejs_22; + npmDepsFetcherVersion = 2; npmDeps = fetchNpmDeps { name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps"; inherit (finalAttrs) src; - npmDepsFetcherVersion = 3; - hash = "sha256-V9aRKoJ6+BN/q7NS21eZBopzkWje8sOGGL1AgO4cUM0="; + fetcherVersion = 2; + hash = "sha256-xobZg0Hc+Yi9+q6kMwuKtBb4pjdYNS4T9VdFy5hARlw="; }; postPatch = '' From 780b418f01fa0664f380fbde52bbcdf9a5f9a792 Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sat, 1 Aug 2026 21:17:37 +0200 Subject: [PATCH 5/8] qwen-code: use npmDepsFetcherVersion 2 There is no version 3 yet, hashes will break in the future if we add a new version. --- pkgs/by-name/qw/qwen-code/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix index 50a1d4e02c9c..a4e253da3cb3 100644 --- a/pkgs/by-name/qw/qwen-code/package.nix +++ b/pkgs/by-name/qw/qwen-code/package.nix @@ -23,8 +23,8 @@ buildNpmPackage (finalAttrs: { hash = "sha256-XWhQ5GlAGW0WAyiPwBULLz1yQps2IdjVkusQ0a88tCs="; }; - npmDepsFetcherVersion = 3; - npmDepsHash = "sha256-dRc+hTk5ELw0rJhT71heFnLjTmjN1UpIOHUMXKt4YwU="; + npmDepsFetcherVersion = 2; + npmDepsHash = "sha256-2vr8Yspm6CCVnO6Jf8B3wiL6X+Tp6hZZEPr+WC/Dcak="; # npm 11 incompatible with fetchNpmDeps # https://github.com/NixOS/nixpkgs/issues/474535 From 9e6b82223843022cb9575f66a1a3d0c198db0d2b Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sat, 1 Aug 2026 21:17:37 +0200 Subject: [PATCH 6/8] snyk: use npmDepsFetcherVersion 2 There is no version 3 yet, hashes will break in the future if we add a new version. --- pkgs/by-name/sn/snyk/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sn/snyk/package.nix b/pkgs/by-name/sn/snyk/package.nix index 81bdd8ba7795..0d8a102d3ab3 100644 --- a/pkgs/by-name/sn/snyk/package.nix +++ b/pkgs/by-name/sn/snyk/package.nix @@ -24,9 +24,9 @@ buildNpmPackage (finalAttrs: { ''; }; - npmDepsFetcherVersion = 3; + npmDepsFetcherVersion = 2; - npmDepsHash = "sha256-AmJNFEw7IF9PjgeRma6vp3I7a60ZkekfRkPXJtjVIik="; + npmDepsHash = "sha256-e7C2ZG7SH9xjfU07lX8rzPeox6k2Fdz7AowOduLxvvs="; nodejs = nodejs_24; From ac8a2ab1a8fd71babdee1368a82fae59bfc3aacc Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sat, 1 Aug 2026 21:17:37 +0200 Subject: [PATCH 7/8] vaultwarden: use npmDepsFetcherVersion 2 There is no version 3 yet, hashes will break in the future if we add a new version. --- pkgs/by-name/va/vaultwarden/webvault.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/va/vaultwarden/webvault.nix b/pkgs/by-name/va/vaultwarden/webvault.nix index 55a2c15e16ab..c62c3087533d 100644 --- a/pkgs/by-name/va/vaultwarden/webvault.nix +++ b/pkgs/by-name/va/vaultwarden/webvault.nix @@ -19,8 +19,8 @@ buildNpmPackage rec { hash = "sha256-Uz0wPdhTVy2yOlKWAy5phr+30NmFaIPQQh5bsiWCDLA="; }; - npmDepsFetcherVersion = 3; - npmDepsHash = "sha256-PaDxqVsq00QIKDmhDhsEbKdM4QXfXn28PgpOyZjB60k="; + npmDepsFetcherVersion = 2; + npmDepsHash = "sha256-SkzEM54nMFqiYUqIRTbp3+yaZEJMgjFkjRLT5NZTN94="; nativeBuildInputs = [ python3 From 553fb879c3f8d84396b45e1b322924086356173e Mon Sep 17 00:00:00 2001 From: Marie Ramlow Date: Sat, 1 Aug 2026 21:23:02 +0200 Subject: [PATCH 8/8] fetchNpmDeps: assert fetcherVersion is not higher than latest version If we introduce version 3, current packages that use the non-existent version 3 will get their hashes broken. Prevent stupid LLMs from introducing more trouble when hallucinating more non-existent versions. --- .../node/prefetch-npm-deps/default.nix | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/pkgs/build-support/node/prefetch-npm-deps/default.nix b/pkgs/build-support/node/prefetch-npm-deps/default.nix index eb73907343de..2875c9291dec 100644 --- a/pkgs/build-support/node/prefetch-npm-deps/default.nix +++ b/pkgs/build-support/node/prefetch-npm-deps/default.nix @@ -300,8 +300,19 @@ NIX_NPM_REGISTRY_OVERRIDES = npmRegistryOverridesString; # Fetcher version controls which features are enabled in prefetch-npm-deps - # Version 2+ enables packument fetching for workspace support - NPM_FETCHER_VERSION = toString fetcherVersion; + NPM_FETCHER_VERSION = + let + # Increment when we introduce a new version. + validFetcherVersions = [ + 1 # Initial version + 2 # enables packument fetching for workspace support + ]; + in + assert lib.assertMsg (lib.elem fetcherVersion validFetcherVersions) + "fetchNpmDeps: fetcher version must be one of: ${ + lib.concatMapStringsSep ", " toString validFetcherVersions + }."; + (toString fetcherVersion); SSL_CERT_FILE = if