hermes - 💡(How to fix) Fix Nix build broken: web/package-lock.json updated without regenerating npmDepsHash

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Since commits 923539a46b80, 60fd4b7d16c4, and 823b6d08ed1a (April 19), web/package-lock.json has been modified without updating the npmDepsHash in nix/web.nix. This breaks the Nix build:

error: hash mismatch in fixed-output derivation npm-deps
  specified: sha256-Y0pOzdFG8BLjfvCLmsvqYpjxFjAQabXp1i7X9W/cCU4=
  got:       sha256-Kh7lX3iWMM25E2kotpJFouZxtAx0n0fOsHeyPllqDDg=

Last working commit: b05d30418d1a (before the package-lock.json changes).

Error Message

error: hash mismatch in fixed-output derivation npm-deps specified: sha256-Y0pOzdFG8BLjfvCLmsvqYpjxFjAQabXp1i7X9W/cCU4= got: sha256-Kh7lX3iWMM25E2kotpJFouZxtAx0n0fOsHeyPllqDDg=

Root Cause

Since commits 923539a46b80, 60fd4b7d16c4, and 823b6d08ed1a (April 19), web/package-lock.json has been modified without updating the npmDepsHash in nix/web.nix. This breaks the Nix build:

error: hash mismatch in fixed-output derivation npm-deps
  specified: sha256-Y0pOzdFG8BLjfvCLmsvqYpjxFjAQabXp1i7X9W/cCU4=
  got:       sha256-Kh7lX3iWMM25E2kotpJFouZxtAx0n0fOsHeyPllqDDg=

Last working commit: b05d30418d1a (before the package-lock.json changes).

Code Example

error: hash mismatch in fixed-output derivation npm-deps
  specified: sha256-Y0pOzdFG8BLjfvCLmsvqYpjxFjAQabXp1i7X9W/cCU4=
  got:       sha256-Kh7lX3iWMM25E2kotpJFouZxtAx0n0fOsHeyPllqDDg=
RAW_BUFFERClick to expand / collapse

Description

Since commits 923539a46b80, 60fd4b7d16c4, and 823b6d08ed1a (April 19), web/package-lock.json has been modified without updating the npmDepsHash in nix/web.nix. This breaks the Nix build:

error: hash mismatch in fixed-output derivation npm-deps
  specified: sha256-Y0pOzdFG8BLjfvCLmsvqYpjxFjAQabXp1i7X9W/cCU4=
  got:       sha256-Kh7lX3iWMM25E2kotpJFouZxtAx0n0fOsHeyPllqDDg=

Last working commit: b05d30418d1a (before the package-lock.json changes).

Suggested fix

  1. Run update_web_lockfile (the helper already bundled in web.nix) to regenerate the hash.

  2. Add a CI job that detects web/package-lock.json changes and either:

    • Automatically regenerates the hash via update_web_lockfile
    • Or fails the PR check if nix/web.nix hash is stale

This would prevent the same class of breakage in the future, similar to how nix/scripts/update-nix-hashes.ts already maintains the node_modules hashes for the main package.

extent analysis

TL;DR

Run update_web_lockfile to regenerate the npmDepsHash in nix/web.nix to fix the hash mismatch error.

Guidance

  • The error occurs because the npmDepsHash in nix/web.nix is not updated after modifying web/package-lock.json.
  • To fix the issue, run update_web_lockfile as suggested to regenerate the hash.
  • Consider adding a CI job to automatically detect web/package-lock.json changes and update the hash or fail the PR check if the hash is stale.
  • Verify the fix by checking if the Nix build succeeds after regenerating the hash.

Example

No code snippet is provided as it is not necessary for this specific issue.

Notes

This solution assumes that update_web_lockfile is a reliable helper script for regenerating the npmDepsHash. If this script is not trustworthy or does not work as expected, further investigation may be needed.

Recommendation

Apply the suggested fix by running update_web_lockfile to regenerate the npmDepsHash, as it directly addresses the root cause of the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - 💡(How to fix) Fix Nix build broken: web/package-lock.json updated without regenerating npmDepsHash