Skip to content

chore(deps): update dependency nx to v22 [security] - #1963

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nx-vulnerability
Open

chore(deps): update dependency nx to v22 [security]#1963
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nx-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
nx (source) 21.2.1 → 22.7.7 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

nx graph dev server permissive CORS policy

CVE-2026-54753 / GHSA-g2r8-wvmj-jf5w

More information

Details

Summary

The local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases.

Severity

Exploitation requires the developer to be running nx graph and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).

Affected & Patched Versions

Package: nx (npm).

  • Affected: >= 17.0.4, < 22.7.2 and >= 23.0.0-beta.0, < 23.0.0-beta.2
  • Patched: 22.7.2+ (backport) and 23.0.0 (first in 23.0.0-beta.2)

The wildcard CORS header was introduced in 17.0.4; the /help execution endpoint in 19.4.0. The 21.x line is not patched — 21.x users should upgrade to 22.7.2 or later.

Details

nx graph starts a local server (default http://127.0.0.1:4211). Before the fix, its request handler set a wildcard CORS header on every response:

res.setHeader('Access-Control-Allow-Origin', '*');

The /help endpoint runs a target's configured command:

const command = target.metadata?.help?.command;
return execSync(command, { cwd: target.options?.cwd ?? workspaceRoot }).toString();

A GET /help is a CORS "simple request", so a malicious page could fetch() it with no preflight, and the wildcard header let the page read the result. This exposes the project graph (project names, file paths, dependencies, build configuration) and the output of any configured help command.

The command is not attacker-controlled through the request — it comes from the workspace's project configuration, and first-party plugins (jest, vite, cypress) populate it with benign, read-only help commands. For /help to run anything malicious, a target carrying a malicious help.command must already exist in the project graph, which can only be introduced by installing a malicious package or by altering the workspace's own code/configuration — both of which already grant code execution independent of this flaw.

The fix (#​35494) removes the header; the browser's same-origin policy then blocks cross-origin reads.

References
Credits

Thanks to Nozomu Sasaki (Paul) (@​morimori-dev) for finding and responsibly reporting this issue.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nx: Zip-Slip in the self-hosted remote cache

CVE-2026-71476 / GHSA-vp3h-ghgh-jr7g

More information

Details

Summary

The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path (MITM) — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache.

Affected Packages

[!IMPORTANT]
Nx's default local cache and Nx Cloud are NOT affected. The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, @nx/s3-cache, etc.) are affected.

Two self-hosted cache surfaces are affected:

  1. The built-in HTTP remote cache (NX_SELF_HOSTED_REMOTE_CACHE_SERVER, in nx) — fixed in the patched release.
  2. The self-hosted cache packages — @nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, @nx/shared-fs-cache (and their @nx/powerpack-* predecessors) — the same flaw in their own extractor. Deprecated (CVE-2025-36852) and not patched; migrate off (see Remediation).

The shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched nx release.

Remediation

Upgrade to Nx 22.7.7 or 23.0.2 (or later). The patched extractor is a drop-in — no configuration change is required.

If you use the S3, GCS, Azure, or shared-filesystem cache packages

@nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache (and their @nx/powerpack-* predecessors) are separately versioned packages and are already deprecated (see CVE-2025-36852). Upgrading nx hardens the shared restore step, but it does not fully secure these packages. The remediation for them is to migrate off — to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache — per the deprecation guidance: https://nx.dev/docs/reference/deprecated/self-hosted-cache-packages

Details

When Nx retrieves an artifact from the self-hosted HTTP remote cache, it downloads a gzipped tar archive and extracts it. The extractor joined each untrusted tar entry name directly onto the output directory and unpacked it with tar's unguarded Entry::unpack(), which performs no containment check:

// vulnerable
let path_on_disk = output_dir.join(entry_path); // entry_path is attacker-controlled
fs::create_dir_all(path_on_disk.parent()…)?;
entry.unpack(&path_on_disk)?;

In addition, restore now copies only the declared task outputs (never the whole cache directory), confined to the workspace root; parent directories are realized as real directories so a write can never traverse a symlink; declared outputs that resolve outside the workspace are rejected; and the malformed-input cases return errors instead of panicking.

References
Credits
  • Lidor B., Novee Security — Reporter
  • Assaf Levkovich, Novee Security — Reporter

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nrwl/nx (nx)

v22.7.7

Compare Source

22.7.7 (2026-07-10)
🩹 Fixes
  • core: prevent path traversal / zip-slip in self-hosted remote cache (#​36116)
  • core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#​36132, #​36116)
  • dotnet: declare obj as a publish output to fix sandbox violation (#​35858)
  • dotnet: declare directory build props input for analyzer dotnet tasks (df7540195a)
  • dotnet: declare directory build props on the separate release build target (6545ee2222)
  • dotnet: declare directory build props on the analyzer tests dotnet targets (e72ee0dd79)
❤️ Thank You

v22.7.6

Compare Source

22.7.6 (2026-06-23)
🩹 Fixes
  • misc: bump happy-dom, tmp, and form-data to patched versions (#​36013)
❤️ Thank You

v22.7.5

Compare Source

22.7.5 (2026-05-27)
🩹 Fixes
❤️ Thank You

v22.7.4

Compare Source

22.7.4 (2026-05-25)
🩹 Fixes
  • core: update brace-expansion and yaml (#​35790)
❤️ Thank You

v22.7.3

Compare Source

22.7.3 (2026-05-22)

🚀 Features
🩹 Fixes
  • angular: only add @​oxc-project/runtime on the vitest-analog path (#​35734)
  • angular-rspack: exclude eslint config from tailwind v4 source scan (#​35663)
  • core: warn before installing unknown npm packages as preset (#​35644)
  • core: preserve input order in createNodes plugin results (#​35595)
  • core: resolve local plugin subpath imports from source (#​35631)
  • core: treat undefined task parallelism as parallel when scheduling (#​35736)
  • core: handle object form of bin field in getPrettierPath (#​35680)
  • core: detect vscode copilot ai agent (#​35757)
  • core: allow local plugin subpath imports without custom conditions (#​35751, #​35631)
  • dotnet: include Directory.. files in inputs (#​35738)
  • gradle: add transitive:true to all tasks (#​35677)
  • gradle: pin generated e2e project toolchain to installed JDK (#​35703)
  • js: fall back to npm publish when bun publish fails with auth error (#​35756)
  • linter: improve convert-to-flat-config output fidelity (#​35330)
  • linter: only rewrite workspace-package peer deps to workspace:* (#​35423, #​35318, #​33417)
  • misc: stop inferring projects: 'self' in dependsOn entries (#​35686)
  • misc: skip $ escaping in file paths on windows (#​35692)
  • repo: run dotnet restore before publish (#​35771)
  • repo: run dotnet restore before macos e2e job (#​35774)
  • rsbuild: infer build outputs from distPath.root directly (#​35707)
  • rsbuild: lazy-require @​rsbuild/core in plugin so spec mocks work after jest.resetModules (#​35707)
  • testing: correct yargs-parser import in getJestProjectsAsync (#​35672, #​35654)
❤️ Thank You

v22.7.2

Compare Source

22.7.2 (2026-05-14)

🚀 Features
  • gradle: stream batch task results to nx as they finish (#​35487)
  • nx-dev: track docs analytics for code copy, LLM prompt, YouTube (#​35526)
  • testing: add migration for Jest 30 snapshot guide link (#​35629)
🩹 Fixes
  • angular: disable vitest watch by default (#​35493)
  • angular-rspack: keep root-scoped assets out of per-locale i18n emit (#​35621)
  • bundling: include tsconfig solution input for rollup (#​35476)
  • bundling: include tsconfig solution input for webpack (#​35477, #​35476)
  • core: bump axios to 1.16.0 for all packages (#​35568)
  • core: add provenance check in nx console status path (#​35485)
  • core: remove access control header from graph app (#​35494)
  • core: ensure verbose logs go to stderr and daemon logs are properly decorated (#​34358)
  • core: show flaky-task count in run summary (#​35491)
  • core: unique telemetry user_id; expose workspace_id dimension (#​35553)
  • core: update minimatch to 10.2.5 (#​35569, #​34660)
  • core: restore use-legacy-versioning shim for @​nx/js@​21 ensurePackage path (#​35574)
  • core: isolate NX_PARALLEL env var in parallel-related specs (#​35579)
  • core: skip handleimport miss path when nx key packages are absent (#​35596)
  • core: use gethostuuid(3) instead of ioreg on macOS (#​35599)
  • core: isolate cache env vars in splitArgs spec (#​35584)
  • core: enable node's native v8 compile cache support (#​35415, #​20454)
  • core: support skipped batch tasks end-to-end and fix TUI double logs (#​35617)
  • core: keep TUI task selection on the in-progress section (#​35640)
  • core: allow nx mcp to run outside of an Nx workspace (#​35655)
  • core: cast perf entries to PerformanceMeasure for detail access (43c0c821ba)
  • devkit: exclude dist from jest module path scan (#​35615)
  • devkit: expand @​nx/devkit/internal re-exports for cherry-picked v23 deep-import migration (#​35541)
  • dotnet: correct output paths for Web SDK and centralized dist setups (#​35398)
  • gradle: exclude batch-runner from jest haste-map crawl (#​35501)
  • gradle: exclude project-graph from jest module path scan (#​35609)
  • gradle: support Windows file paths (#​35184, #​34987)
  • js: strip glob from inferred outputs before resolving as path (#​35463, #​35452)
  • js: reference vitest.config in eslint dep-checks for vitest libs (#​35460, #​33670, #​35450)
  • js: include transitive workspace deps in pruned pnpm lockfile (#​35532, #​35347, #​34655)
  • linter: prevent ENOENT crash in getRelativeImportPath for unresolvable paths (#​35007, #​13872, #​34066, #​30491, #​16716, #​35006, #​21889, #​32190)
  • maven: skip attached artifacts that fail to materialize in batch record (#​35473)
  • maven: serialize Maven 4 build state recording (#​35555)
  • maven: widen runCLI timeout for --no-batch maven.test.ts cases (#​35589)
  • nx-dev: document nested CLI subcommands beyond two levels (#​35519)
  • nx-dev: short-circuit bot probes in framer rewrite edge function (#​35527)
  • react: withSvgr migration preserves other properties (#​35484)
  • repo: clear NX_INVOCATION_ROOT_PID in run-native-target to avoid recursion false-positive (443dee0b22)
  • repo: revert deep-import rewrites that targeted v23-only @​nx/devkit/internal entry (ac8187963d)
  • repo: unblock 22.7.x cargo tests and nx-build e2e (#​34285)
  • repo: expand "..." spread token in graph typecheck inputs (#​34285, #​35458)
  • testing: pin jest to ~30.3.0 to avoid jest-runtime 30.4 RN incompat (#​35618)
  • testing: handle absolute cypress screenshotsFolder/videosFolder paths (#​35624)
  • testing: exclude dist and out-tsc from default jest module path scan (#​35619)
  • testing: update remaining snapshot guide links missed by migration (cd350c1140)
❤️ Thank You

v22.7.1

Compare Source

22.7.1 (2026-04-28)
🩹 Fixes
  • core: prevent spinner flicker when sync applying (#​35445)
  • core: exclude hyperfine env vars from daemon env reflection (5095b4be7d)
  • core: provide actionable feedback when running migrations and pre-install fails with npm peer dep errors (#​33961, #​33942)
  • core: consider virtual trees in multiGlobWithWorkspaceContext (#​35447, #​31805, #​35373, #​32588)
  • core: surface ./nx --version stderr and force devDeps install (#​35469)
  • core: keep continuous children alive when nx:noop orchestrator completes (#​35388)
  • core: start TUI event reader synchronously in enter() to prevent stdin race (#​35465, #​34619, #​34144)
  • core: use require for global to local Nx handoff so Windows drive paths work (#​35478)
  • core: prevent daemon shutdown from cache-poisoned in-process nx loads (#​35482, #​35444, #​34463, #​34111)
  • detox: generate valid JSON in .detoxrc for non-expo apps (eb2fa8ced4)
  • js: include extended tsconfigs from project references in typecheck inputs (#​35457)
  • linter: detect root lint target added in same generator run (#​35296, #​23147, #​34531)
  • misc: exclude stories and specs from tailwind content scanning (#​35470)
  • misc: resolve pnpm catalog: refs in version lookups (#​35459, #​35453)
  • nextjs: use cached project graph in withNx (#​35475, #​34518, #​32880)
  • node: include tsconfig input in node-app esbuild scaffold (#​35466)
  • release: handle short and full project names in commit scopes (#​34219)
  • testing: convert executor-based jest.config.ts and preserve type-only imports (#​35286, #​34593)
❤️ Thank You

v22.7.0

Compare Source

22.7.0 (2026-04-24)
🚀 Features
  • core: add .nx/self-healing to .gitignore (#​34855)
  • core: decouple DB version from Nx version and share DB across worktrees (#​34942)
  • core: auto-open browser for Cloud setup URL during create-nx-workspace (#​35014)
  • core: allow generate command to skip project graph creation (#​35170)
  • core: remove polygraph cloud passthrough (#​35153)
  • core: use CNW variant 1 cloud prompt in nx init (#​35155)
  • core: add source map annotations to nx show target (#​35225)
  • core: prompt for setup mode when running nx init in empty git directory (#​35226)
  • core: add json input type for selective JSON field hashing (#​35248)
  • core: update nx-set-shas usage to v5 (#​34934)
  • core: add NX_BAIL environment variable (#​34711)
  • core: add page up/down to tui shortcuts (#​34525)
  • core: add logging and progress message types to daemon (#​35342)
  • dotnet: add ci-workflow generator (#​33321)
  • js: support nx.sync.ignoredDependencies in typescript-sync (#​35401)
  • misc: a/b test cloud prompt copy in create-nx-workspace (#​35039)
  • misc: update nx init telemetry meta from CSV to JSON format (#​35076)
  • misc: lock in CNW cloud prompt A/B winner and add new variants (#​35154)
  • nx-dev: add conditional blog/changelog proxy in edge function (#​35043)
  • nx-dev: add nx-blog sitemap to root sitemap index (#​35363)
  • repo: add nx-labs repo target and use glob pattern for update-all-repos (#​34999)
  • repo: enable tsgo compiler for nx package (#​35047)
  • repo: enforce no-disabled-tests via ESLint with per-project warning caps (#​35122)
  • repo: add e2e test for nx build process verification (#​35119)
  • vite: add compiler option to vite plugin for tsgo support (#​35429, #​33821, #​35047, #​35167)
🩹 Fixes
  • angular: update duplicate migration keys (#​34961)
  • angular: add storybook and playwright as implicit dependencies (#​35224)
  • angular: preserve specific file paths in tsconfig when adding secondary entry point (#​35254, #​33051)
  • angular: fall back to addUndefinedDefaults when addUndefinedObjectDefaults is unavailable (#​35290)
  • angular-rspack: ensure rebuild chunks emitted summary accurate (#​34979, #​34936)
  • angular-rspack: normalize Windows path separators for i18n (#​35252, #​32864)
  • angular-rspack: add fileReplacements to resolve.alias (#​34197)
  • angular-rspack: fixes issues with angular-rspack hmr (#​35294, #​35040)
  • bundling: disable swc input source map resolution (#​35010, #​32671)
  • bundling: bump esbuild for new projects to a version compatible with vite 8 (#​35132)
  • bundling: declare tsconfig.json as input for esbuild targets (#​35432)
  • core: skip analytics and DB connection when global bin hands off to local (#​34914)
  • core: properly quote shell metacharacters in CLI args passed to tasks (#​34491, #​32305, #​26682)
  • core: avoid redundant project graph requests in ngcli adapter (#​34907)
  • core: ensure postTasksExecution fires on SIGINT for continuous tasks (#​34876, #​34623, #​34869)
  • core: improve error handling in nx migrate registry fetching (#​34926, #​33014, #​33135)
  • core: remove CRA migration logic from nx init (#​34912)
  • core: pass collectInputs flag through daemon IPC for task hashing (#​34915)
  • core: prevent DB corruption from concurrent initialization (#​34861)
  • core: set windowsHide: true on all child process spawns (#​34894, #​34455)
  • core: split-target should handle projects with colons in name better (#​34725)
  • core: prevent TUI crash when task output arrives after completion (#​34785, #​34677)
  • core: respect --parallel limit for discrete task concurrency (#​34721, #​34117, #​31494)
  • core: use scroll-offset-based scrollbar positioning in TUI (#​34689)
  • core: skip import-equals namespace aliases in native scanner (#​34947, #​34644)
  • core: include command name on all telemetry events (#​34949)
  • core: skip workspace context setup when global bin hands off to local (#​34953, #​34914)
  • core: add explicit exports entry for nx/src/native directory (#​34967, #​34111)
  • core: use upsert to prevent FK constraint violations in task DB (#​34977)
  • core: runtime inputs shouldn't be cached at task_hasher layer and filesets should be in the hash_plans layer (#​34971, #​30170)
  • core: suppress postinstall error output when nx is not yet built (#​34986)
  • core: show better log message when isolated plugin shuts down after hook completion (#​34922)
  • core: handle owners and conformance project refs on move/remove (#​34815)
  • core: resolve published nx migrate package resolution (#​35013, #​34111)
  • core: prevent batch executor error on prematurely completed tasks (#​35015)
  • core: add timeouts to GitHub push flow to prevent CLI hangs (#​35011, #​34482)
  • core: prevent nx watch infinite loop from overly broad output globs (#​34995)
  • core: add package export for nx/release/changelog-renderer (#​35033)
  • core: validate bundler option for Angular presets in create-nx-workspace (#​35074)
  • core: handle "." and absolute paths as workspace name in CNW (#​35083, #​1)
  • core: pin version of axios (#​35093)
  • core: preserve sibling dependency inputs in native hashing (#​35071)
  • core: restore nx package exports compatibility (#​35095)
  • core: sandbox exclusions, multi-line typeof import detection, global ensurePackage mock (#​35056)
  • core: restore metadata table for telemetry session tracking (#​35099)
  • core: no-interactive should disable prompts during migrate (#​35106)
  • core: reduce published nx package size with files allowlist (#​35109)
  • core: clean up legacy .gemini/skills during configure-ai-agents (#​35117)
  • core: copy pnpm install configuration to generated package.json (#​35016, #​30240)
  • core: improve migrate error reporting (#​34980)
  • core: display actual error message when plugin loading fails (#​35138, #​35137)
  • core: bump axios to 1.13.5 to resolve CVE-2026-25639 (#​35148, #​35145)
  • core: update and pin ejs to 5.0.1 (#​35157)
  • core: misc tui perf fixes (#​35187)
  • core: replace LGPL-licensed @​ltd/j-toml with BSD-3-Clause smol-toml (#​35188)
  • core: supply chain hardening via transitive dependency pinning (#​35159)
  • core: kill discrete tasks and use tree-kill for batch cleanup on SIGINT (#​35175)
  • core: support cross-file variable references in .env files (#​34956, #​34955)
  • core: disable Yarn scripts for temp nx@​latest installs (#​35210)
  • core: use fresh package manager cache for e2e tests (#​35211)
  • core: add missing inputs and sandbox exclusions for native tasks (#​35212)
  • core: prevent phantom connections and dead polling in plugin workers (#​34823, #​34388)
  • core: ensure build tasks use copyReadme named input (#​35217)
  • core: add prettier config inputs to astro-docs format target (#​35222)
  • core: add vale-changed.mjs script to vale target inputs (d4c55d806a)
  • core: add missing build inputs for angular-rspack example projects (fd0dff1078)
  • core: add run-native-target script input to dotnet build-analyzer (#​35221)
  • core: overwrite inferred script target when nx prop defines executor or command (#​35227)
  • core: exclude populate-local-registry-storage from sandbox I/O checks (#​35239)
  • core: replace exec() with spawn() to prevent maxBuffer crash on large command output (#​35256)
  • core: inline daemon status check, drop subprocess workaround (#​35273)
  • core: don't cache project graph errors on daemon (#​35088)
  • core: cap TUI parallel slots by total task count (#​35299)
  • core: don't hang when workspace contains a named pipe (#​35289)
  • core: optimize warm cache performance for task execution (#​35172, #​31067)
  • core: allow controlling migrate fallback installation concurrency (#​35312)
  • core: support pnpm multi-document lockfiles (#​35271)
  • core: await queued processTask promises before cache.getBatch (#​35322, #​35172)
  • core: use v8 serialization in pseudo-IPC channel (#​35332)
  • core: recognize json inputs in TS task hasher fallback (#​35334)
  • core: speed up nx --version by avoiding heavy imports (#​35326)
  • core: resolve native binary crash on aarch64 linux with 16K/64K page kernels (#​35356, #​145353, #​6541, #​1547, #​1549, #​35345)
  • core: normalize spawned run-commands output (#​35358)
  • core: create process report on fatal error in .nx/workspace-data (#​35193)
  • core: improve native TypeScript type definitions (#​35251)
  • core: don't spread plugin name into set constructor (#​35385)
  • core: allow --target/-t and -p flags for nx run with colon targets (#​35394, #​35098)
  • core: make nx version lookup bundle-safe (#​35430)
  • core: restore top-level schemas/ in published nx package (#​35427, #​34111, #​35109, #​35411)
  • core: wait for stdio drain before capturing task output (#​35422, #​35302)
  • core: prevent deferred spinner text update from causing early spinner appearance (#​35435)
  • devkit: prevent double install in generators for TS solution workspaces (#​34891)
  • devkit: add startTime and endTime to TaskResult interface (#​34996)
  • gradle: remove annotations from atomizer (#​34871)
  • gradle: ignore test enums when atomizing (#​34974)
  • gradle: increase project graph timeout defaults (#​35058)
  • gradle: use object notation for exclude tasks (#​35085)
  • gradle: detect @​Input provider-based dependencies (#​35090)
  • gradle: prevent Gradle and Maven daemon accumulation during project graph recalculation (#​35143)
  • gradle: infer input extensions on project graph generation (#​35160)
  • gradle: hoist shared task computation out of per-class loop in atomized CI target generation (#​35199)
  • gradle: patch 0.1.19 to beta.11 (#​35202)
  • gradle: recognize Kotlin compile tasks in inferred input extensions (#​35335)
  • gradle: resolve sandbox violations in e2e-gradle tests (#​35349, #​35315)
  • js: normalize cwd path separator in typescript plugin targets (#​34911)
  • js: preserve tsconfig fields in typescript plugin cache (#​34908)
  • js: pass configName to typecheck command in TS plugin (#​34989, #​34274)
  • js: add input on .d.ts files within dependency projects (#​34968)
  • js: add {projectRoot} prefix to d.ts fileset in typescript plugin (#​35037)
  • js: recognize tsgo in dependency-checks lint rule (#​35048)
  • js: narrow tsc build-base outputs to only tsc-produced file types (#​35041)
  • js: include tsbuildinfo in narrowed tsc build-base outputs (#​35086, #​35041)
  • js: use explicit nx/bin/nx path in start-local-registry (#​35127)
  • js: resolve ENOWORKSPACES test error in setupVerdaccio for @​nx/js:library generator (#​34755)
  • js: include npm overrides in generated lockfile (#​35192, #​34529)
  • js: stop generating baseUrl in tsconfig, use ./ prefix for path mappings (#​34965, #​32958)
  • js: suppress false swc-node/ts-node warning on Node 22.18+ (#​35247, #​32567)
  • js: avoid full source scan in readTsConfigPaths (#​35300)
  • js: resolve project tsconfig for inferred tsc run-commands targets in dependency-checks (#​35291)
  • js: declare .d.cts/.d.mts as typecheck inputs and outputs (#​35357)
  • js: resolve build output dir from globbed outputs in node executor (#​35288, #​35041, #​35198, #​35301)
  • js: avoid double-prefixing node executor output paths (#​35050, #​35044, #​33577)
  • js: add npm workspace support to prune-lockfile executor (#​35383, #​33523)
  • linter: detect require() calls in enforce-module-boundaries rule (#​34896, #​34096)
  • linter: use native nx.configs in convert-to-flat-config for Nx plugins (#​34897, #​31736)
  • linter: convert project-level eslint configs and log when skipped (#​34899, #​29458)
  • linter: use root config to determine ESLint class in plugin (#​34900, #​32110)
  • linter: prepend framework configs before baseConfig in flat config generation (#​34898, #​28381, #​32923)
  • linter: remove custom eslint hasher (d64aeef5df)
  • linter: infer extended tsconfig files as task inputs (#​35190)
  • linter: add missing inputs to eslint executor target defaults (#​35236)
  • maven: prevent batch executor hang from premature worker exit (#​35001, #​34757)
  • maven: make install targets noop when maven.install.skip=true (#​35009)
  • maven: log analyzer startup under verbose instead of stdout (#​35361)
  • maven: honor settings.xml in Maven 3 batch runner (#​35216)
  • misc: make webinar banner theme-aware with light mode support (#​35029)
  • misc: handle non-interactive mode and add template shorthand names for CNW (#​35045)
  • misc: use workspace root for package manager detection and normalize paths in plugins (#​35116)
  • misc: stream Framer proxy responses and add edge function timing (#​35215)
  • misc: bump axios to 1.15.0 for all packages (#​35237)
  • misc: allow create-nx-workspace . --no-interactive in empty directory (#​35281)
  • misc: remove process exit handlers when child process exits (#​35279)
  • module-federation: enable ESM output for Angular rspack MF plugin (#​34839, #​34584, #​33992)
  • module-federation: bump @​module-federation/enhanced to ^2.3.3 (#​35314, #​35311)
  • nextjs: align nx-dev build inputs and update plugin defaults (#​35238)
  • nextjs: add semver to required packages in update-package-json (#​35384, #​34095)
  • node: split package-manager exec command for VS Code launch.json ([#​35295](https://redirect.github.com/nrwl/nx/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner August 1, 2026 01:05
@changeset-bot

changeset-bot Bot commented Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: c522f3a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/npm-nx-vulnerability branch from 7626012 to d06db68 Compare August 4, 2026 18:52
cursor[bot]
cursor Bot reviewed Aug 4, 2026
View reviewed changes
Comment thread package.json Outdated
@renovate
renovate Bot force-pushed the renovate/npm-nx-vulnerability branch 4 times, most recently from 22daf32 to e972e3a Compare August 11, 2026 15:39
cursor[bot]
cursor Bot reviewed Aug 11, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit e972e3a. Configure here.

Comment thread package.json
@renovate
renovate Bot force-pushed the renovate/npm-nx-vulnerability branch from e972e3a to c522f3a Compare August 14, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants