Description

Since commits 923539a46b80, 60fd4b7d16c4, and 823b6d08ed1a (April 19), web/package-lock.json has been modified without updating the npmDepsHash in nix/web.nix. This breaks the Nix build:

error: hash mismatch in fixed-output derivation npm-deps
  specified: sha256-Y0pOzdFG8BLjfvCLmsvqYpjxFjAQabXp1i7X9W/cCU4=
  got:       sha256-Kh7lX3iWMM25E2kotpJFouZxtAx0n0fOsHeyPllqDDg=

Last working commit: b05d30418d1a (before the package-lock.json changes).

Suggested fix

1. Run update_web_lockfile (the helper already bundled in web.nix) to regenerate the hash.

2. Add a CI job that detects web/package-lock.json changes and either:

   • Automatically regenerates the hash via update_web_lockfile
   • Or fails the PR check if nix/web.nix hash is stale

This would prevent the same class of breakage in the future, similar to how nix/scripts/update-nix-hashes.ts already maintains the node_modules hashes for the main package.