n8n 2.32 replaced the sheetjs-CDN xlsx@0.20.2 tarball (which lacked an
integrity checksum and had to be patched into pnpm-lock.yaml) with the
regular npm package @e965/xlsx@0.20.3, which already carries an integrity
field. The patchXlsxLockfile workaround is therefore obsolete and actively
harmful: substituteInPlace --replace-fail no longer matches, making
fetchPnpmDeps fail with a build error (not a hash mismatch), which left the
fake-hash sentinel behind in n8n.nix on update.
- overlays/mods/n8n.nix: remove xlsx workaround; bump to 2.32.6 with real
src (sha256-wWm6...) and pnpmDeps (sha256-QzUJCF+...) hashes.
- tests/n8n-overlay-test.nix: update expectations to 2.32.6; drop the
obsolete checkXlsxIntegrityPatch.
- overlays/mods/update.sh: use a literal SRI sentinel instead of lib.fakeHash
(lib is not in scope inside the {prev}: overlay); add a snapshot-based EXIT
trap that restores n8n.nix on any failure (error/SIGINT/SIGTERM/killed
build) while preserving pre-existing working-tree edits; surface a clearer
message when fetchPnpmDeps fails for a non-hash reason.
m3tam3re
8d9b0cf742