n8n >= 2.37.0 demands pnpm >= 11.22.0 via engines.pnpm and serialises
patchedDependencies as plain scalars in pnpm-lock.yaml (same
lockfileVersion '9.0'), which pnpm 10 cannot install. The pinned nixpkgs
only ships pnpm_11 11.17.0, so:
- build with pnpm_11 + fetcherVersion 4 and relax the engines.pnpm gate
in package.json (relaxPnpmEngine) for both fetchPnpmDeps and the main
build; swap pnpm_10 -> pnpm_11 in nativeBuildInputs
- drop the workaround once nixpkgs ships pnpm >= 11.22
update.sh: detect ERR_PNPM_UNSUPPORTED_ENGINE /
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH with actionable hints, sync
tests/n8n-overlay-test.nix expectations (checks were stale at 2.32.6),
guard against leftover fake-hash sentinels, and run from the repo root
so the relative nix --expr paths resolve.
Verified: n8n-overlay check green, full n8n 2.37.9 build green.
n8n 2.32 replaced the sheetjs-CDN xlsx@0.20.2 tarball (which lacked an
integrity checksum and had to be patched into pnpm-lock.yaml) with the
regular npm package @e965/xlsx@0.20.3, which already carries an integrity
field. The patchXlsxLockfile workaround is therefore obsolete and actively
harmful: substituteInPlace --replace-fail no longer matches, making
fetchPnpmDeps fail with a build error (not a hash mismatch), which left the
fake-hash sentinel behind in n8n.nix on update.
- overlays/mods/n8n.nix: remove xlsx workaround; bump to 2.32.6 with real
src (sha256-wWm6...) and pnpmDeps (sha256-QzUJCF+...) hashes.
- tests/n8n-overlay-test.nix: update expectations to 2.32.6; drop the
obsolete checkXlsxIntegrityPatch.
- overlays/mods/update.sh: use a literal SRI sentinel instead of lib.fakeHash
(lib is not in scope inside the {prev}: overlay); add a snapshot-based EXIT
trap that restores n8n.nix on any failure (error/SIGINT/SIGTERM/killed
build) while preserving pre-existing working-tree edits; surface a clearer
message when fetchPnpmDeps fails for a non-hash reason.
- overlays/mods/n8n.nix: add passthru.updateScript pointing to ./update.sh
- overlays/mods/update.sh: self-contained updater that fetches the latest
stable n8n-io/n8n release, recomputes both src and pnpmDeps hashes
(src via nix-prefetch-url with --name workaround for the `@` in the tag,
pnpmDeps via the lib.fakeHash mismatch trick)
- .gitea/workflows/nix-update.yml: discover and run overlays/mods/*/update.sh
after the pkgs/ loop; verify step skips overlay/* entries (covered by flake check)
The test suite (tests/n8n-overlay-test.nix) forbids exporting a local n8n
package, so the overlay cannot be exposed via pkgs/n8n/ — the workflow gets
an explicit overlay-discovery block instead.
m3ta-chiron
m3tam3re