fix(nix): derive npm deps from lockfile via importNpmLock

.pre-commit-config.yaml

@@ -18,8 +18,3 @@ repos:
     - ts
     - json
     pass_filenames: false
-  - id: rehash
-    name: rehash
-    language: system
-    entry: just rehash-npm-nix
-    pass_filenames: false

Justfile

@@ -19,7 +19,6 @@ update:
     nix flake update
     nix develop --command pre-commit autoupdate
     nix develop --command npm update
-    nix develop --command just rehash-npm-nix
     nix develop --command just update-scanner-version
     nix develop --command pinact run -u --diff
 
@@ -31,6 +30,3 @@ update-scanner-version:
     echo "Latest: $latest"
     sd "(export const SCANNER_VERSION : string = ')[^']+(';)" "\${1}$latest\${2}" src/config/configScanner.ts
     echo "Version updated"
-
-rehash-npm-nix:
-    sd 'npmDepsHash = ".*";' "npmDepsHash = \"$(nix hash convert --to sri $(prefetch-npm-deps ./package-lock.json))\";" vsix.nix

flake.nix

@@ -76,7 +76,6 @@
                 nodejs
                 pinact
                 pre-commit
-                prefetch-npm-deps
                 sd
                 typescript
                 typescript-language-server

vsix.nix

@@ -1,6 +1,7 @@
 {
   buildNpmPackage,
   clang_20,
+  importNpmLock,
   lib,
   libsecret,
   pkg-config,
@@ -14,7 +15,12 @@ buildNpmPackage {
   pname = "${packageJson.name}-vsix";
   version = packageJson.version;
   src = ./.;
-  npmDepsHash = "sha256-07D441mHQIGb9kR6B/JVv/z+Y4bj5W7zI7+xgDP6qqI=";
+
+  # Derive npm dependencies directly from package-lock.json instead of pinning
+  # a fixed-output npmDepsHash. This way dependency bumps (e.g. Dependabot PRs)
+  # don't require manually updating a hash to keep the Nix build green.
+  npmDeps = importNpmLock { npmRoot = ./.; };
+  npmConfigHook = importNpmLock.npmConfigHook;
 
   nativeBuildInputs = [
     pkg-config