Change:
bypassCache = true; reconstructLock = true; }; <del> musescore-downloader = nodeEnv.buildNodePackage { name = "musescore-downloader"; packageName = "musescore-downloader"; version = "0.26.0"; src = fetchurl { url = "https://registry.npmjs.org/musescore-downloader/-/musescore-downloader-0.26.0.tgz"; sha512 = "AHA5wSaEJLwfEEQDl8kLfin7l4uejXYTzWtn/BgUiyWKw4AbuUK2/xfDmULW2KxUfsK2RoLl0bFtIvdvvm4CNA=="; }; dependencies = [ sources."@librescore/fonts-0.4.1" sources."@librescore/sf3-0.3.0" sources."ansi-escapes-4.3.2" sources."ansi-regex-5.0.1" sources."ansi-styles-4.3.0" sources."base64-js-1.5.1" sources."bl-4.1.0" sources."buffer-5.7.1" sources."chalk-4.1.2" sources."chardet-0.7.0" sources."cli-cursor-3.1.0" sources."cli-spinners-2.9.0" sources."cli-width-3.0.0" sources."clone-1.0.4" sources."color-convert-2.0.1" sources."color-name-1.1.4" sources."defaults-1.0.4" sources."detect-node-2.1.0" sources."emoji-regex-8.0.0" (sources."encoding-0.1.13" // { dependencies = [ sources."iconv-lite-0.6.3" ]; }) sources."escape-string-regexp-1.0.5" sources."external-editor-3.1.0" sources."figures-3.2.0" sources."has-flag-4.0.0" sources."iconv-lite-0.4.24" sources."ieee754-1.2.1" sources."inherits-2.0.4" sources."inquirer-7.3.3" sources."is-fullwidth-code-point-3.0.0" sources."is-interactive-1.0.0" sources."is-unicode-supported-0.1.0" sources."lodash-4.17.21" sources."log-symbols-4.1.0" sources."mimic-fn-2.1.0" sources."mute-stream-0.0.8" sources."node-fetch-2.6.13" sources."onetime-5.1.2" sources."ora-5.4.1" sources."os-tmpdir-1.0.2" sources."readable-stream-3.6.2" sources."restore-cursor-3.1.0" sources."run-async-2.4.1" sources."rxjs-6.6.7" sources."safe-buffer-5.2.1" sources."safer-buffer-2.1.2" sources."signal-exit-3.0.7" sources."string-width-4.2.3" sources."string_decoder-1.3.0" sources."strip-ansi-6.0.1" sources."supports-color-7.2.0" sources."through-2.3.8" sources."tmp-0.0.33" sources."tr46-0.0.3" sources."tslib-1.14.1" sources."type-fest-0.21.3" sources."util-deprecate-1.0.2" sources."wcwidth-1.0.1" sources."webidl-conversions-3.0.1" sources."webmscore-0.18.0" sources."whatwg-url-5.0.0" ]; buildInputs = globalBuildInputs; meta = { description = "download sheet music from musescore.com for free, no login or Musescore Pro required | 免登录、免 Musescore Pro，免费下载 musescore.com 上的曲谱"; homepage = "https://github.com/Xmader/musescore-downloader#readme"; license = "MIT"; }; production = true; bypassCache = true; reconstructLock = true; }; </del> near-cli = nodeEnv.buildNodePackage { name = "near-cli"; packageName = "near-cli";

Discussion:
I'm trying to package which directly depends on I get the following error: If I set , then I get the following error from npm: The error messages are good enough at explaining why it's a problem, but I don't know how to fix it. I'd appreciate some help! I cannot feasibly remove the pdfkit dependency because generating PDFs is essential functionality of this package. Steps to reproduce the behavior: to build the package from , e.g. by issuing: The package builds. cc
Setting should fix that problem specifically but there are more issues which the git deps error is warning will probably be the case So the problem specifically is: dl-librescore depends on pdfkit as a git dep rather than registry dep pdfkit doesn't have a npm lockfile (only a ) npm requires dev dependencies for git deps that have install scripts (which pdfkit has) npm does not lock transitive dev dependencies at all, so without an upstream npm lockfile then there just is no (npm) lock information for these required dev dependencies There's only so much we can do downstream about this, but we have had some ideas for how to deal with mixed lockfiles (like having a in a git dev dep with install scripts), but it'll be a good while before we get around to implementing such a thing (since it's more in the "nice to have" rather than "required for many packages" sort of thing) As for what you can do about it now, here are some options: to depend on only as a registry dep rather than git dep out install scripts from really needs an unreleased version, pester to make a new release and then have depend on as a registry dep similar to option 1 I wish I had better news for you, but npm is kinda hell in regards to git deps :(