I am working on adding this to nixpkgs to fix, at first, bruno using the postCheck parameter of fetchFromGitHub.

The problem is that without a release it's much harder to setup automatic bumps of the package (basically someone will need to manually update some values everytime this changes to be up to date).

In nixpkgs these automations are done using r-ryantm but a update is only triggered by a release, the release has a version that is associated with a git tag, that changes what is passed to fetchFromGitHub, that triggers a rebuild of the source code download pass, that triggers the automation that changes the hash.

Basically, releases == jidoka(https://en.wikipedia.org/?title=Jidoka&redirect=no)/[autonomation](https://en.wikipedia.org/wiki/Autonomation), no releases == full manual.

Just tagging a commit with git tag v0.1 and git push, for example, may solve the issue already (I am not sure if git push pushes all the tags by default).

For reference this is the PR I am working on, I may split up adding this package in another PR: NixOS/nixpkgs#261139

It seems to me that npm not generating all hashes for the lock file is a pretty big issue. Do you know if there's already a bug report for this? Or am I missing something that explains this behavior?