From 2c5281616010ee627abf04761500335941b4cc55 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Tue, 27 Jan 2026 16:11:01 +0000
Subject: [PATCH] prefetch-npm-deps: support file: scheme for dependencies

Fixes #484067
---
 .../node/prefetch-npm-deps/default.nix        | 22 +++++++++++++++++++
 .../node/prefetch-npm-deps/src/main.rs        | 10 +++++++++
 .../node/prefetch-npm-deps/src/parse/mod.rs   | 14 +++++++-----
 3 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/node/prefetch-npm-deps/default.nix b/pkgs/build-support/node/prefetch-npm-deps/default.nix
index bfa8fb863e4b..8bbbe4e10312 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/prefetch-npm-deps/default.nix
@@ -195,6 +195,28 @@
 
           hash = "sha256-QGObVDd9qVtf/U78+ayP6RHVWsU+HXhg70BFblQ1PZs=";
         };
+
+        # Test lockfiles with file: dependencies
+        fileDependenciesV1 = makeTest {
+          name = "file-dependencies-lockfile-v1";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/elbywan/wretch/970b19e0fcc3dd219b9f3fc247d8f34cc01979c6/package-lock.json";
+            hash = "sha256-3vTMxc9M2TeiclUFYbG5eTzavSAXjAzz6N5v/1VM4Bc=";
+          };
+
+          hash = "sha256-4wTohTVWF49iQvdaUxNhwplfTVb53yFnAaUVA2xIXrc=";
+        };
+        fileDependenciesV3 = makeTest {
+          name = "file-dependencies-lockfile-v3";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/alam00000/bentopdf/146e3f07d4111e309d0b29bb949e78e44454be3b/package-lock.json";
+            hash = "sha256-9Ea5ctJYbClxStYNhSfSpsO/P99/4CQK58PLK5e6PoQ=";
+          };
+
+          hash = "sha256-1xWkzAzZXd9f4sY9xFHLfj482ZCs2oKFJ79C+Iy7RFY=";
+        };
       };
 
     meta = {
diff --git a/pkgs/build-support/node/prefetch-npm-deps/src/main.rs b/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
index 2882aee9ec20..b65db0492c3e 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
+++ b/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
@@ -238,6 +238,7 @@ fn fixup_lockfile(
                 .values_mut()
             {
                 if let Some(Value::String(resolved)) = package.get("resolved")
+                    && !resolved.starts_with("file:")
                     && let Some(Value::String(integrity)) = package.get("integrity")
                 {
                     if resolved.starts_with("git+") {
@@ -286,6 +287,7 @@ fn fixup_v1_deps(
             .as_object()
             .expect("v1 dep must be object")
             .get("resolved")
+            && !resolved.starts_with("file:")
             && let Some(Value::String(integrity)) = dep
                 .as_object()
                 .expect("v1 dep must be object")
@@ -509,6 +511,10 @@ mod tests {
                     "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                     "integrity": "sha512-aaa"
                 },
+                "baz": {
+                    "resolved": "file:baz.tar.gz",
+                    "integrity": "sha512-bbb"
+                },
                 "foo-bad": {
                     "resolved": "foo",
                     "integrity": "sha1-foo"
@@ -534,6 +540,10 @@ mod tests {
                 "bar": {
                     "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                 },
+                "baz": {
+                    "resolved": "file:baz.tar.gz",
+                    "integrity": "sha512-bbb"
+                },
                 "foo-bad": {
                     "resolved": "foo",
                     "integrity": "sha512-foo"
diff --git a/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs b/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
index 3e6f5019ea33..6f76dd7f59df 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
+++ b/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
@@ -25,10 +25,10 @@ pub fn lockfile(
     let mut packages = lock::packages(content)
         .context("failed to extract packages from lockfile")?
         .into_par_iter()
-        .map(|p| {
+        .filter_map(|p| {
             let n = p.name.clone().unwrap();
 
-            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}"))
+            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}")).transpose()
         })
         .collect::<anyhow::Result<Vec<_>>>()?;
 
@@ -124,7 +124,7 @@ enum Specifics {
 }
 
 impl Package {
-    fn from_lock(pkg: lock::Package) -> anyhow::Result<Package> {
+    fn from_lock(pkg: lock::Package) -> anyhow::Result<Option<Package>> {
         let mut resolved = match pkg
             .resolved
             .expect("at this point, packages should have URLs")
@@ -133,6 +133,10 @@ impl Package {
             UrlOrString::String(_) => panic!("at this point, all packages should have URLs"),
         };
 
+        if resolved.scheme() == "file" {
+            return Ok(None);
+        }
+
         let specifics = match get_hosted_git_url(&resolved)? {
             Some(hosted) => {
                 let body = util::get_url_body_with_retry(&hosted)?;
@@ -174,12 +178,12 @@ impl Package {
             },
         };
 
-        Ok(Package {
+        Ok(Some(Package {
             name: pkg.name.unwrap(),
             version: pkg.version,
             url: resolved,
             specifics,
-        })
+        }))
     }
 
     pub fn tarball(&self) -> anyhow::Result<Vec<u8>> {