@depup/nx 23.1.1-depup.3 → 23.1.2-depup.0

package/README.md

@@ -13,10 +13,10 @@ npm install @depup/nx
 
 | Field | Value |
 |-------|-------|
-| Original | [nx](https://www.npmjs.com/package/nx) @ 23.1.1 |
-| Processed | 2026-08-26 |
+| Original | [nx](https://www.npmjs.com/package/nx) @ 23.1.2 |
+| Processed | 2026-08-27 |
 | Smoke test | failed |
-| Deps updated | 71 |
+| Deps updated | 70 |
 
 ## Dependency Changes
 
@@ -37,7 +37,6 @@ npm install @depup/nx
 | axios | 1.18.1 | ^1.20.0 |
 | balanced-match | 4.0.3 | ^4.0.4 |
 | bl | 4.1.0 | ^7.0.12 |
-| brace-expansion | 5.0.8 | ^5.0.9 |
 | buffer | 5.7.1 | ^6.0.3 |
 | chalk | 4.1.2 | ^6.0.0 |
 | cli-cursor | 3.1.0 | ^5.0.0 |

package/changes.json

@@ -60,10 +60,6 @@
       "from": "4.1.0",
       "to": "^7.0.12"
     },
-    "brace-expansion": {
-      "from": "5.0.8",
-      "to": "^5.0.9"
-    },
     "buffer": {
       "from": "5.7.1",
       "to": "^6.0.3"
@@ -285,6 +281,6 @@
       "to": "^22.0.0"
     }
   },
-  "timestamp": "2026-08-26T08:22:34.168Z",
-  "totalUpdated": 71
+  "timestamp": "2026-08-27T01:41:10.145Z",
+  "totalUpdated": 70
 }

package/dist/release/changelog-renderer/index.js

@@ -215,12 +215,11 @@ class DefaultChangelogRenderer {
                 if (!name || name.includes('[bot]')) {
                     continue;
                 }
-                if (_authors.has(name)) {
-                    const entry = _authors.get(name);
-                    entry.email.add(author.email);
+                if (!_authors.has(name)) {
+                    _authors.set(name, { email: new Set() });
                 }
-                else {
-                    _authors.set(name, { email: new Set([author.email]) });
+                if (author.email) {
+                    _authors.get(name).email.add(author.email);
                 }
             }
         }

package/dist/release/index.d.ts

@@ -1,4 +1,4 @@
 /**
  * @public Programmatic API for nx release
  */
-export { ReleaseClient, release, releaseChangelog, releasePublish, releaseVersion, VersionActions, AfterAllProjectsVersioned, } from '../src/command-line/release';
+export { ReleaseClient, release, releaseChangelog, releasePublish, releaseVersion, VersionActions, AfterAllProjectsVersioned, ResolveVersionForDependency, } from '../src/command-line/release';

package/dist/src/command-line/add/add.js

@@ -18,9 +18,14 @@ const semver_1 = require("semver");
 const configure_plugins_1 = require("../init/configure-plugins");
 const spinner_1 = require("../../utils/spinner");
 const analytics_1 = require("../../analytics");
+const client_1 = require("../../daemon/client/client");
 function addHandler(options) {
     return (0, handle_errors_1.handleErrors)(options.verbose, async () => {
         output_1.output.addNewline();
+        // Package managers write the lock file before node_modules is fully linked,
+        // so a live daemon restarts mid-install and caches a graph whose plugins,
+        // still being relinked, no longer resolve.
+        await client_1.daemonClient.stop();
         const [pkgName, version] = parsePackageSpecifier(options.packageSpecifier);
         (0, analytics_1.reportNxAddCommand)(pkgName, version);
         const nxJson = (0, nx_json_1.readNxJson)();

package/dist/src/command-line/affected/affected.js

@@ -49,6 +49,7 @@ async function affected(command, args, extraTargetDependencies = {}, extraOption
                 }
                 else {
                     const status = await (0, run_command_1.runCommand)(projectsWithTarget, projectGraph, { nxJson }, nxArgs, overrides, null, extraTargetDependencies, extraOptions);
+                    await output_1.output.drain();
                     process.exit(status);
                 }
                 break;

package/dist/src/command-line/configure-ai-agents/configure-ai-agents.js

@@ -11,7 +11,7 @@ const constants_1 = require("../../ai/constants");
 const detect_ai_agent_1 = require("../../ai/detect-ai-agent");
 const utils_1 = require("../../ai/utils");
 const client_1 = require("../../daemon/client/client");
-const devkit_internals_1 = require("../../devkit-internals");
+const package_json_1 = require("../../utils/package-json");
 const output_1 = require("../../utils/output");
 const package_manager_1 = require("../../utils/package-manager");
 const provenance_1 = require("../../utils/provenance");
@@ -44,7 +44,7 @@ async function configureAiAgentsHandler(args, inner = false) {
     let cleanup;
     try {
         await (0, provenance_1.ensurePackageHasProvenance)('nx', 'latest');
-        const packageInstallResults = (0, devkit_internals_1.installPackageToTmp)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
+        const packageInstallResults = (0, package_json_1.installPackageToTmp)('nx', 'latest', (0, package_manager_1.detectPackageManager)(workspace_root_1.workspaceRoot));
         cleanup = packageInstallResults.cleanup;
         let modulePath = require.resolve('nx/src/command-line/configure-ai-agents/configure-ai-agents.js', { paths: [packageInstallResults.tempDir] });
         const module = await (0, handle_import_1.handleImport)(modulePath);

package/dist/src/command-line/import/import.js

@@ -26,7 +26,6 @@ const configure_plugins_1 = require("../init/configure-plugins");
 const check_compatible_with_plugins_1 = require("../init/implementation/check-compatible-with-plugins");
 const native_1 = require("../../native");
 const ai_output_1 = require("./utils/ai-output");
-const init_v2_2 = require("../init/init-v2");
 const importRemoteName = '__tmp_nx_import__';
 async function importHandler(options) {
     process.env.NX_RUNNING_NX_IMPORT = 'true';
@@ -361,7 +360,7 @@ async function importHandler(options) {
             (0, ai_output_1.writeAiOutput)((0, ai_output_1.buildImportNeedsPluginSelectionResult)({
                 detectedPlugins: detectedButNotInstalled.map((name) => ({
                     name,
-                    reason: (0, init_v2_2.getPluginReason)(name),
+                    reason: (0, init_v2_1.getPluginReason)(name),
                 })),
                 sourceRepository,
                 ref,

package/dist/src/command-line/init/init-v2.js

@@ -11,6 +11,7 @@ const nx_json_1 = require("../../config/nx-json");
 const fileutils_1 = require("../../utils/fileutils");
 const get_package_name_from_import_path_1 = require("../../utils/get-package-name-from-import-path");
 const output_1 = require("../../utils/output");
+const package_json_1 = require("../../utils/package-json");
 const package_manager_1 = require("../../utils/package-manager");
 const versions_1 = require("../../utils/versions");
 const workspace_context_1 = require("../../utils/workspace-context");
@@ -26,14 +27,12 @@ const angular_1 = require("./implementation/angular");
 const add_nx_scripts_1 = require("./implementation/dot-nx/add-nx-scripts");
 const utils_1 = require("./implementation/utils");
 const provenance_1 = require("../../utils/provenance");
-const devkit_internals_1 = require("../../devkit-internals");
 const handle_import_1 = require("../../utils/handle-import");
 const native_1 = require("../../native");
 const detect_ai_agent_1 = require("../../ai/detect-ai-agent");
 const ab_testing_1 = require("../../utils/ab-testing");
 const analytics_prompt_1 = require("../../utils/analytics-prompt");
 const is_ci_1 = require("../../utils/is-ci");
-const package_manager_2 = require("../../utils/package-manager");
 const ai_output_1 = require("./utils/ai-output");
 async function initHandler(options, inner = false) {
     // Use environment variable to force local execution
@@ -43,7 +42,7 @@ async function initHandler(options, inner = false) {
     let cleanup;
     try {
         await (0, provenance_1.ensurePackageHasProvenance)('nx', 'latest');
-        const packageInstallResults = (0, devkit_internals_1.installPackageToTmp)('nx', 'latest', (0, package_manager_2.detectPackageManager)(process.cwd()));
+        const packageInstallResults = (0, package_json_1.installPackageToTmp)('nx', 'latest', (0, package_manager_1.detectPackageManager)(process.cwd()));
         cleanup = packageInstallResults.cleanup;
         let modulePath = require.resolve('nx/src/command-line/init/init-v2.js', {
             paths: [packageInstallResults.tempDir],
@@ -95,7 +94,7 @@ async function initHandlerImpl(options) {
     const baseMeta = {
         nodeVersion: process.versions.node,
         os: process.platform,
-        packageManager: (0, package_manager_2.detectPackageManager)(),
+        packageManager: (0, package_manager_1.detectPackageManager)(),
         aiAgent: (0, native_1.isAiAgent)(),
         isCI: (0, is_ci_1.isCI)(),
     };
@@ -368,7 +367,7 @@ async function runInit(options, baseMeta) {
             analyticsPrompt,
             nodeVersion: process.versions.node,
             os: process.platform,
-            packageManager: (0, package_manager_2.detectPackageManager)(),
+            packageManager: (0, package_manager_1.detectPackageManager)(),
             aiAgent: aiMode,
             isCI: (0, is_ci_1.isCI)(),
             pluginsInstalled: pluginsToInstall.join(','),

package/dist/src/command-line/migrate/migrate.d.ts

@@ -63,6 +63,8 @@ export declare class Migrator {
     private readonly packageUpdates;
     private readonly collectedVersions;
     private readonly promptAnswers;
+    private readonly pendingPackageJsonUpdates;
+    private readonly appliedPackageJsonUpdates;
     private readonly nxInstallation;
     private minVersionWithSkippedUpdates;
     constructor(opts: MigratorOptions);
@@ -85,6 +87,8 @@ export declare class Migrator {
     }>;
     private createMigrateJson;
     private buildPackageJsonUpdates;
+    private applyPackageJsonUpdate;
+    private applyPendingPackageJsonUpdates;
     private resolveVersionForCascade;
     private populatePackageJsonUpdatesAndGetPackagesToCheck;
     private getPackageJsonUpdatesFromMigrationConfig;

package/dist/src/command-line/migrate/migrate.js

@@ -110,6 +110,8 @@ class Migrator {
         this.packageUpdates = {};
         this.collectedVersions = {};
         this.promptAnswers = {};
+        this.pendingPackageJsonUpdates = new Map();
+        this.appliedPackageJsonUpdates = new Set();
         if ((opts.include === 'required' || opts.include === 'optional') &&
             !opts.requiredPackages) {
             throw new Error(`Error: 'requiredPackages' is required when 'include' is '${opts.include}'.`);
@@ -137,6 +139,7 @@ class Migrator {
             version: targetVersion,
             addToPackageJson: false,
         });
+        await this.applyPendingPackageJsonUpdates();
         this.applyIncludeFilter();
         const { migrations, promptContents } = await this.createMigrateJson();
         return {
@@ -182,29 +185,66 @@ class Migrator {
         for (const packageToCheck of packagesToCheck) {
             const filteredUpdates = {};
             for (const [packageUpdateKey, packageUpdate] of Object.entries(packageToCheck.updates)) {
-                if (this.areRequirementsMet(packageUpdate.requires) &&
-                    !this.areIncompatiblePackagesPresent(packageUpdate.incompatibleWith) &&
-                    (!this.interactive ||
-                        (await this.runPackageJsonUpdatesConfirmationPrompt(packageUpdate, packageUpdateKey, packageToCheck.package)))) {
-                    const updateEntries = Object.entries(packageUpdate.packages);
-                    // Validate all up front so invalid metadata fails fast, before any
-                    // resolution does I/O.
-                    for (const [name, update] of updateEntries) {
-                        this.validatePackageUpdateVersion(packageToCheck.package, name, update);
-                    }
-                    // Resolve serially: resolution can prompt (pnpm strict cooldown) and
-                    // append to minimumReleaseAgeExclude, so a serial loop avoids
-                    // overlapping prompts and keeps packageUpdates ordering stable.
-                    for (const [name, update] of updateEntries) {
-                        const resolvedUpdate = {
-                            ...update,
-                            version: await this.resolveVersionForCascade(name, update.version),
-                        };
-                        filteredUpdates[name] = resolvedUpdate;
-                        this.packageUpdates[name] = resolvedUpdate;
-                    }
+                Object.assign(filteredUpdates, await this.applyPackageJsonUpdate(packageToCheck.package, packageUpdateKey, packageUpdate));
+            }
+            await Promise.all(Object.entries(filteredUpdates).map(([name, update]) => this.buildPackageJsonUpdates(name, update)));
+        }
+    }
+    async applyPackageJsonUpdate(sourcePackage, packageUpdateKey, packageUpdate) {
+        const appliedKey = JSON.stringify([sourcePackage, packageUpdateKey]);
+        if (this.appliedPackageJsonUpdates.has(appliedKey)) {
+            this.pendingPackageJsonUpdates.delete(appliedKey);
+            return {};
+        }
+        if (!this.areRequirementsMet(packageUpdate.requires) ||
+            this.areIncompatiblePackagesPresent(packageUpdate.incompatibleWith)) {
+            this.pendingPackageJsonUpdates.set(appliedKey, {
+                package: sourcePackage,
+                key: packageUpdateKey,
+                update: packageUpdate,
+            });
+            return {};
+        }
+        this.pendingPackageJsonUpdates.delete(appliedKey);
+        if (this.interactive &&
+            !(await this.runPackageJsonUpdatesConfirmationPrompt(packageUpdate, packageUpdateKey, sourcePackage))) {
+            return {};
+        }
+        this.appliedPackageJsonUpdates.add(appliedKey);
+        const updateEntries = Object.entries(packageUpdate.packages);
+        // Validate all up front so invalid metadata fails fast, before any
+        // resolution does I/O.
+        for (const [name, update] of updateEntries) {
+            this.validatePackageUpdateVersion(sourcePackage, name, update);
+        }
+        const filteredUpdates = {};
+        // Resolve serially: resolution can prompt (pnpm strict cooldown) and append
+        // to minimumReleaseAgeExclude, so a serial loop avoids overlapping prompts
+        // and keeps packageUpdates ordering stable.
+        for (const [name, update] of updateEntries) {
+            const resolvedUpdate = {
+                ...update,
+                version: await this.resolveVersionForCascade(name, update.version),
+            };
+            this.addPackageUpdate(name, resolvedUpdate);
+            filteredUpdates[name] = this.packageUpdates[name];
+        }
+        return filteredUpdates;
+    }
+    async applyPendingPackageJsonUpdates() {
+        while (this.pendingPackageJsonUpdates.size) {
+            let applied = false;
+            const filteredUpdates = {};
+            for (const pending of [...this.pendingPackageJsonUpdates.values()]) {
+                const updates = await this.applyPackageJsonUpdate(pending.package, pending.key, pending.update);
+                if (Object.keys(updates).length) {
+                    applied = true;
+                    Object.assign(filteredUpdates, updates);
                 }
             }
+            if (!applied) {
+                return;
+            }
             await Promise.all(Object.entries(filteredUpdates).map(([name, update]) => this.buildPackageJsonUpdates(name, update)));
         }
     }
@@ -408,7 +448,7 @@ class Migrator {
     }
     addPackageUpdate(name, packageUpdate) {
         if (!this.packageUpdates[name] ||
-            this.gt(packageUpdate.version, this.packageUpdates[name].version)) {
+            !this.lt(packageUpdate.version, this.packageUpdates[name].version)) {
             this.packageUpdates[name] = packageUpdate;
         }
     }
@@ -1093,8 +1133,30 @@ async function getPackageMigrationsUsingRegistry(packageName, packageVersion) {
     // try to obtain the migrations from the registry directly
     return await downloadPackageMigrationsFromRegistry(packageName, packageVersion, migrationsConfig);
 }
+// Matched exactly: a hostname that merely contains one of these is a different
+// registry. registry.yarnpkg.com is npmjs' CNAME, so it serves the same
+// metadata; the two loopback literals are the spellings of a local registry
+// that the substring below cannot reach, since neither contains "localhost".
+const FULL_METADATA_REGISTRIES = [
+    'registry.npmjs.org',
+    'registry.yarnpkg.com',
+    '127.0.0.1',
+    '[::1]',
+];
+// Matched as substrings, since neither names a single host: a local registry
+// can sit on a subdomain of localhost, and an Artifactory instance is
+// identified only by that word appearing somewhere in its hostname.
+const FULL_METADATA_REGISTRY_MARKERS = [
+    'localhost',
+    'artifactory',
+];
 async function getPackageMigrationsConfigFromRegistry(packageName, packageVersion) {
-    const result = await (0, package_manager_1.packageRegistryView)(packageName, packageVersion, 'nx-migrations ng-update dist --json');
+    const result = await (0, package_manager_1.packageRegistryView)(packageName, packageVersion, [
+        'nx-migrations',
+        'ng-update',
+        'dist',
+        '--json',
+    ]);
     if (!result) {
         return null;
     }
@@ -1102,9 +1164,10 @@ async function getPackageMigrationsConfigFromRegistry(packageName, packageVersio
     if (!json['nx-migrations'] && !json['ng-update']) {
         const registry = new node_url_1.URL('dist' in json ? json.dist.tarball : json.tarball)
             .hostname;
-        // Registries other than npmjs and the local registry may not support full metadata via npm view
-        // so throw error so that fetcher falls back to getting config via install
-        if (!['registry.npmjs.org', 'localhost', 'artifactory'].some((v) => registry.includes(v))) {
+        // Other registries may not support full metadata via npm view; throw to
+        // trigger the install fallback.
+        if (!FULL_METADATA_REGISTRIES.includes(registry) &&
+            !FULL_METADATA_REGISTRY_MARKERS.some((v) => registry.includes(v))) {
             throw new Error(`Getting migration config from registry is not supported from ${registry}`);
         }
     }

package/dist/src/command-line/release/changelog.js

@@ -305,6 +305,11 @@ function createAPI(overrideReleaseConfig, ignoreNxJsonConfig) {
             const projectNodes = projects.map((name) => projectGraph.nodes[name]);
             if (releaseGroup.projectsRelationship === 'independent') {
                 for (const project of projectNodes) {
+                    if (!projectsVersionData[project.name] ||
+                        (projectsVersionData[project.name].newVersion === null &&
+                            !projectsVersionData[project.name].dockerVersion)) {
+                        continue;
+                    }
                     let changes = null;
                     if (releaseGroup.resolvedVersionPlans) {
                         changes = (0, version_plan_utils_1.createChangesFromProjectsVersionPlans)(releaseGroup.resolvedVersionPlans, project.name);

package/dist/src/command-line/release/index.d.ts

@@ -46,4 +46,4 @@ export declare const release: typeof defaultClient.release;
 /**
  * @public
  */
-export { AfterAllProjectsVersioned, VersionActions, } from './version/version-actions';
+export { AfterAllProjectsVersioned, ResolveVersionForDependency, VersionActions, } from './version/version-actions';

package/dist/src/command-line/release/utils/git.js

@@ -468,7 +468,7 @@ function getAllAuthorsForCommit(commit) {
 }
 // https://www.conventionalcommits.org/en/v1.0.0/
 // https://regex101.com/r/FSfNvA/1
-const ConventionalCommitRegex = /(?<type>[a-z]+)(\((?<scope>.+)\))?(?<breaking>!)?: (?<description>.+)/i;
+const ConventionalCommitRegex = /^(?<type>[^\s():!]+)(?:\s*\((?<scope>.+)\))?(?<breaking>!)?: (?<description>.+)$/u;
 const CoAuthoredByRegex = /co-authored-by:\s*(?<name>.+)(<(?<email>.+)>)/gim;
 // GitHub style PR references
 const PullRequestRE = /\([ a-z]*(#\d+)\s*\)/gm;

package/dist/src/command-line/release/utils/release-graph.d.ts

@@ -161,6 +161,23 @@ export declare class ReleaseGraph {
      * Resolve current versions for all projects that will be processed
      */
     private resolveCurrentVersionsForProjects;
+    /**
+     * Resolve the current version of a single project via its configured
+     * `currentVersionResolver` (honoring `fallbackCurrentVersionResolver`),
+     * performing the git-tag lookup when applicable.
+     *
+     * Extracted from `resolveCurrentVersionsForProjects` so it can also be
+     * invoked on-demand for projects that are NOT part of `allProjectsToProcess`.
+     */
+    private resolveCurrentVersionForProject;
+    /**
+     * Resolve and cache the current version of a dependency that is not already
+     * being versioned. Ecosystem-specific VersionActions call this lazily when
+     * they need a concrete version that is absent from `dependenciesToUpdate`.
+     *
+     * @internal
+     */
+    resolveCurrentVersionForDependency(tree: Tree, projectGraph: ProjectGraph, projectName: string, preid: string): Promise<string>;
     /**
      * Build dependency relationships between release groups
      */

package/dist/src/command-line/release/utils/release-graph.js

@@ -373,31 +373,79 @@ class ReleaseGraph {
     async resolveCurrentVersionsForProjects(tree, projectGraph, preid) {
         for (const [, releaseGroupNode] of this.groupGraph) {
             for (const projectName of releaseGroupNode.group.projects) {
-                const projectGraphNode = projectGraph.nodes[projectName];
                 if (!this.allProjectsToProcess.has(projectName)) {
                     continue;
                 }
-                const versionActions = this.projectsToVersionActions.get(projectName);
-                const finalConfigForProject = this.finalConfigsByProject.get(projectName);
-                let latestMatchingGitTag;
-                const releaseTagPattern = releaseGroupNode.group.releaseTag.pattern;
-                if (finalConfigForProject.currentVersionResolver === 'git-tag') {
-                    latestMatchingGitTag = await (0, git_1.getLatestGitTagForPattern)(releaseTagPattern, {
-                        projectName: (0, git_1.sanitizeProjectNameForGitTag)(projectGraphNode.name),
-                        releaseGroupName: releaseGroupNode.group.name,
-                    }, this.resolveRepositoryTags.bind(this), {
-                        checkAllBranchesWhen: releaseGroupNode.group.releaseTag.checkAllBranchesWhen,
-                        preid: preid,
-                        requireSemver: releaseGroupNode.group.releaseTag.requireSemver,
-                        strictPreid: releaseGroupNode.group.releaseTag.strictPreid,
-                    });
-                    this.cachedLatestMatchingGitTag.set(projectName, latestMatchingGitTag);
-                }
-                const currentVersion = await (0, resolve_current_version_1.resolveCurrentVersion)(tree, projectGraphNode, releaseGroupNode.group, versionActions, this.projectLoggers.get(projectName), this.currentVersionsPerFixedReleaseGroup, finalConfigForProject, releaseTagPattern, latestMatchingGitTag);
+                const currentVersion = await this.resolveCurrentVersionForProject(tree, projectGraph, releaseGroupNode.group, projectName, preid);
                 this.cachedCurrentVersions.set(projectName, currentVersion);
             }
         }
     }
+    /**
+     * Resolve the current version of a single project via its configured
+     * `currentVersionResolver` (honoring `fallbackCurrentVersionResolver`),
+     * performing the git-tag lookup when applicable.
+     *
+     * Extracted from `resolveCurrentVersionsForProjects` so it can also be
+     * invoked on-demand for projects that are NOT part of `allProjectsToProcess`.
+     */
+    async resolveCurrentVersionForProject(tree, projectGraph, releaseGroup, projectName, preid) {
+        const projectGraphNode = projectGraph.nodes[projectName];
+        const versionActions = this.projectsToVersionActions.get(projectName);
+        const finalConfigForProject = this.finalConfigsByProject.get(projectName);
+        let latestMatchingGitTag;
+        const releaseTagPattern = releaseGroup.releaseTag.pattern;
+        if (finalConfigForProject.currentVersionResolver === 'git-tag') {
+            latestMatchingGitTag = await (0, git_1.getLatestGitTagForPattern)(releaseTagPattern, {
+                projectName: (0, git_1.sanitizeProjectNameForGitTag)(projectGraphNode.name),
+                releaseGroupName: releaseGroup.name,
+            }, this.resolveRepositoryTags.bind(this), {
+                checkAllBranchesWhen: releaseGroup.releaseTag.checkAllBranchesWhen,
+                preid: preid,
+                requireSemver: releaseGroup.releaseTag.requireSemver,
+                strictPreid: releaseGroup.releaseTag.strictPreid,
+            });
+            this.cachedLatestMatchingGitTag.set(projectName, latestMatchingGitTag);
+        }
+        return (0, resolve_current_version_1.resolveCurrentVersion)(tree, projectGraphNode, releaseGroup, versionActions, this.projectLoggers.get(projectName), this.currentVersionsPerFixedReleaseGroup, finalConfigForProject, releaseTagPattern, latestMatchingGitTag);
+    }
+    /**
+     * Resolve and cache the current version of a dependency that is not already
+     * being versioned. Ecosystem-specific VersionActions call this lazily when
+     * they need a concrete version that is absent from `dependenciesToUpdate`.
+     *
+     * @internal
+     */
+    async resolveCurrentVersionForDependency(tree, projectGraph, projectName, preid) {
+        if (this.cachedCurrentVersions.has(projectName)) {
+            const currentVersion = this.cachedCurrentVersions.get(projectName);
+            if (currentVersion) {
+                return currentVersion;
+            }
+            const currentVersionResolver = this.finalConfigsByProject.get(projectName)?.currentVersionResolver;
+            throw new Error(`Cannot resolve a concrete current version for dependency project "${projectName}" because its "currentVersionResolver" is set to "${currentVersionResolver}" and did not resolve a version. Configure a resolver that can determine the current version.`);
+        }
+        const releaseGroup = this.projectToReleaseGroup.get(projectName);
+        if (!releaseGroup ||
+            !this.projectsToVersionActions.has(projectName) ||
+            !this.finalConfigsByProject.has(projectName)) {
+            throw new Error(`Cannot resolve a concrete current version for dependency project "${projectName}" because it is not configured for Nx Release. Include the project in an Nx Release group so that its current version resolver can be configured.`);
+        }
+        let currentVersion;
+        try {
+            currentVersion = await this.resolveCurrentVersionForProject(tree, projectGraph, releaseGroup, projectName, preid);
+        }
+        catch (err) {
+            const errorMessage = err instanceof Error ? err.message : String(err);
+            throw new Error(`Cannot resolve a concrete current version for dependency project "${projectName}". ${errorMessage}`);
+        }
+        if (!currentVersion) {
+            const finalConfigForProject = this.finalConfigsByProject.get(projectName);
+            throw new Error(`Cannot resolve a concrete current version for dependency project "${projectName}" because its "currentVersionResolver" is set to "${finalConfigForProject.currentVersionResolver}" and did not resolve a version. Configure a resolver that can determine the current version.`);
+        }
+        this.cachedCurrentVersions.set(projectName, currentVersion);
+        return currentVersion;
+    }
     /**
      * Build dependency relationships between release groups
      */
@@ -662,7 +710,11 @@ Valid values are: ${exports.validReleaseVersionPrefixes
             head: commit.shortHash,
         });
         // Use the same affected detection logic as `nx affected`
-        affectedGraph = await (0, affected_project_graph_1.filterAffected)(projectGraph, touchedFiles);
+        affectedGraph = await (0, affected_project_graph_1.filterAffected)(projectGraph, touchedFiles, undefined, undefined, 
+        // Release evaluates historical commits against the current project
+        // graph. A project configuration which no longer exists must not make
+        // every surviving release project relevant to that commit.
+        false);
         this.affectedGraphPerCommit.set(shortHash, affectedGraph);
         return affectedGraph;
     }

package/dist/src/command-line/release/utils/remote-release-clients/github.js

@@ -104,6 +104,12 @@ class GithubRemoteReleaseClient extends remote_release_client_1.RemoteReleaseCli
         await Promise.all([...authors.keys()].map(async (authorName) => {
             const meta = authors.get(authorName);
             for (const email of meta.email) {
+                // An empty email makes the URL `/users/find/`, so ungh attributes
+                // the commit to the "find" user rather than the real author.
+                // Non-emails just 404, but skip those too to avoid a wasted lookup.
+                if (!email || !email.includes('@')) {
+                    continue;
+                }
                 if (email.endsWith('@users.noreply.github.com')) {
                     const match = email.match(/^(\d+\+)?([^@]+)@users\.noreply\.github\.com$/);
                     if (match && match[2]) {

package/dist/src/command-line/release/version/release-group-processor.d.ts

@@ -42,6 +42,21 @@ export declare class ReleaseGroupProcessor {
      * processing them multiple times. Used during the group traversal.
      */
     private processedGroups;
+    /**
+     * Tracks release groups that have completed all version decisions. A group
+     * can reach this state before its dependency manifests are updated.
+     */
+    private groupsWithFinalizedVersionDecisions;
+    /**
+     * Tracks projects whose dependency manifests must wait until all release
+     * groups have completed their version decisions.
+     */
+    private projectsWithDeferredDependencyUpdates;
+    /**
+     * Indicates that every release group has completed its version decisions,
+     * so dependency manifests can use final versions safely.
+     */
+    private allVersionDecisionsFinalized;
     /**
      * Keeps track of which projects have already had their versions bumped.
      * This is used to avoid redundant version bumping and to determine which
@@ -96,6 +111,15 @@ export declare class ReleaseGroupProcessor {
     private getCachedFinalConfigForProject;
     private calculateNewVersion;
     private updateDependenciesForProject;
+    private finalizeVersionDecisionsForGroup;
+    private finalizeAllVersionDecisions;
+    /**
+     * Resolve a dependency version when `dependenciesToUpdate` does not contain
+     * a concrete version for a manifest entry.
+     *
+     * @internal
+     */
+    resolveVersionForDependency(dependencyProjectName: string): Promise<string>;
     private bumpVersionForProject;
     private updateDependenciesForDependents;
     private getOriginalDependentProjects;