From d370f2f8789ddf129418c20e3a75bd51a373feb9 Mon Sep 17 00:00:00 2001
From: Winter M <winter@antithesis.com>
Date: Wed, 18 Mar 2026 12:45:53 -0400
Subject: [PATCH] importNpmLock: handle commit in resolved git url

npm's locking process resolves Git dependencies to a given commit, separated
by a `#`. Before this change, any encounter of these URLs would cause `fetchGit`
to fail, as they're not valid repo URLs.
---
 pkgs/build-support/node/import-npm-lock/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/node/import-npm-lock/default.nix b/pkgs/build-support/node/import-npm-lock/default.nix
index c299ca46928d..8a863709996f 100644
--- a/pkgs/build-support/node/import-npm-lock/default.nix
+++ b/pkgs/build-support/node/import-npm-lock/default.nix
@@ -52,9 +52,17 @@ let
                 // fetcherOpts
               ))
             else if lib.hasPrefix "git" module.resolved then
+              let
+                url = elemAt mUrl 1;
+                urlParts = lib.splitString "#" url;
+                commit = if builtins.length urlParts == 2 then elemAt urlParts 1 else null;
+              in
               (fetchGit (
                 {
-                  url = module.resolved;
+                  url = "${scheme}://${elemAt urlParts 0}";
+                }
+                // lib.optionalAttrs (commit != null) {
+                  rev = commit;
                 }
                 // fetcherOpts
               ))