@depup/nx 23.2.0-depup.2 → 23.2.1-depup.1

package/README.md

@@ -13,32 +13,33 @@ npm install @depup/nx
 
 | Field | Value |
 |-------|-------|
-| Original | [nx](https://www.npmjs.com/package/nx) @ 23.2.0 |
-| Processed | 2026-09-08 |
+| Original | [nx](https://www.npmjs.com/package/nx) @ 23.2.1 |
+| Processed | 2026-09-16 |
 | Smoke test | failed |
-| Deps updated | 73 |
+| Deps updated | 75 |
 
 ## Dependency Changes
 
 | Dependency | From | To |
 |------------|------|-----|
-| @clack/core | 1.4.3 | ^1.5.0 |
-| @clack/prompts | 1.7.0 | ^1.8.0 |
+| @clack/core | 1.4.3 | ^1.5.1 |
+| @clack/prompts | 1.7.0 | ^1.8.1 |
 | @emnapi/core | 1.4.5 | ^1.11.3 |
 | @emnapi/runtime | 1.4.5 | ^1.11.3 |
 | @emnapi/wasi-threads | 1.0.4 | ^2.1.0 |
 | @jest/diff-sequences | 30.0.1 | ^30.5.0 |
-| @napi-rs/wasm-runtime | 0.2.4 | ^1.2.3 |
-| @tybys/wasm-util | 0.9.0 | ^0.10.3 |
+| @napi-rs/wasm-runtime | 0.2.4 | ^1.2.4 |
+| @tybys/wasm-util | 0.9.0 | ^0.10.4 |
 | @zkochan/js-yaml | 0.0.7 | ^0.0.11 |
 | agent-base | 6.0.2 | ^9.0.0 |
 | ansi-regex | 5.0.1 | ^6.3.0 |
 | ansi-styles | 4.3.0 | ^7.0.0 |
-| argparse | 2.0.1 | ^3.0.1 |
+| argparse | 2.0.1 | ^3.0.2 |
 | asynckit | 0.4.0 | ^0.5.0 |
 | axios | 1.18.1 | ^1.20.0 |
 | balanced-match | 4.0.3 | ^4.0.4 |
 | bl | 4.1.0 | ^7.0.12 |
+| brace-expansion | 5.0.9 | ^5.0.12 |
 | buffer | 5.7.1 | ^6.0.3 |
 | chalk | 4.1.2 | ^6.0.0 |
 | cli-cursor | 3.1.0 | ^5.0.0 |
@@ -53,7 +54,7 @@ npm install @depup/nx
 | dotenv | 16.4.7 | ^17.4.2 |
 | dotenv-expand | 12.0.3 | ^1000.0.0 |
 | ejs | 5.0.1 | ^6.0.1 |
-| emoji-regex | 8.0.0 | ^10.6.0 |
+| emoji-regex | 8.0.0 | ^11.0.0 |
 | es-object-atoms | 1.1.1 | ^1.1.2 |
 | escape-string-regexp | 1.0.5 | ^5.0.0 |
 | fast-wrap-ansi | 0.2.0 | ^0.2.2 |
@@ -61,7 +62,7 @@ npm install @depup/nx
 | flat | 5.0.2 | ^6.0.1 |
 | has-flag | 4.0.0 | ^5.0.1 |
 | https-proxy-agent | 5.0.1 | ^9.1.0 |
-| ignore | 7.0.5 | ^7.0.8 |
+| ignore | 7.0.5 | ^7.0.9 |
 | is-docker | 3.0.0 | ^4.0.0 |
 | is-fullwidth-code-point | 3.0.0 | ^5.1.0 |
 | is-interactive | 1.0.0 | ^2.0.0 |
@@ -76,7 +77,7 @@ npm install @depup/nx
 | minimatch | 10.2.5 | ^10.2.6 |
 | npm-run-path | 4.0.1 | ^6.0.0 |
 | onetime | 5.1.2 | ^8.0.0 |
-| open | 10.1.0 | ^11.0.2 |
+| open | 10.1.0 | ^11.0.4 |
 | ora | 5.4.1 | ^9.4.1 |
 | path-key | 3.1.1 | ^4.0.0 |
 | readable-stream | 3.6.2 | ^4.7.0 |
@@ -93,6 +94,7 @@ npm install @depup/nx
 | tar-stream | 2.2.0 | ^3.2.1 |
 | which | 3.0.1 | ^7.0.0 |
 | wrap-ansi | 7.0.0 | ^10.0.1 |
+| yaml | 2.9.0 | ^2.9.1 |
 | yargs | 17.7.2 | ^18.1.0 |
 | yargs-parser | 21.1.1 | ^22.0.0 |
 

package/changes.json

@@ -2,11 +2,11 @@
   "bumped": {
     "@clack/core": {
       "from": "1.4.3",
-      "to": "^1.5.0"
+      "to": "^1.5.1"
     },
     "@clack/prompts": {
       "from": "1.7.0",
-      "to": "^1.8.0"
+      "to": "^1.8.1"
     },
     "@emnapi/core": {
       "from": "1.4.5",
@@ -26,11 +26,11 @@
     },
     "@napi-rs/wasm-runtime": {
       "from": "0.2.4",
-      "to": "^1.2.3"
+      "to": "^1.2.4"
     },
     "@tybys/wasm-util": {
       "from": "0.9.0",
-      "to": "^0.10.3"
+      "to": "^0.10.4"
     },
     "@zkochan/js-yaml": {
       "from": "0.0.7",
@@ -50,7 +50,7 @@
     },
     "argparse": {
       "from": "2.0.1",
-      "to": "^3.0.1"
+      "to": "^3.0.2"
     },
     "asynckit": {
       "from": "0.4.0",
@@ -68,6 +68,10 @@
       "from": "4.1.0",
       "to": "^7.0.12"
     },
+    "brace-expansion": {
+      "from": "5.0.9",
+      "to": "^5.0.12"
+    },
     "buffer": {
       "from": "5.7.1",
       "to": "^6.0.3"
@@ -126,7 +130,7 @@
     },
     "emoji-regex": {
       "from": "8.0.0",
-      "to": "^10.6.0"
+      "to": "^11.0.0"
     },
     "es-object-atoms": {
       "from": "1.1.1",
@@ -158,7 +162,7 @@
     },
     "ignore": {
       "from": "7.0.5",
-      "to": "^7.0.8"
+      "to": "^7.0.9"
     },
     "is-docker": {
       "from": "3.0.0",
@@ -218,7 +222,7 @@
     },
     "open": {
       "from": "10.1.0",
-      "to": "^11.0.2"
+      "to": "^11.0.4"
     },
     "ora": {
       "from": "5.4.1",
@@ -284,6 +288,10 @@
       "from": "7.0.0",
       "to": "^10.0.1"
     },
+    "yaml": {
+      "from": "2.9.0",
+      "to": "^2.9.1"
+    },
     "yargs": {
       "from": "17.7.2",
       "to": "^18.1.0"
@@ -293,6 +301,6 @@
       "to": "^22.0.0"
     }
   },
-  "timestamp": "2026-09-08T00:33:29.143Z",
-  "totalUpdated": 73
+  "timestamp": "2026-09-16T00:31:36.139Z",
+  "totalUpdated": 75
 }

package/dist/release/changelog-renderer/index.d.ts

@@ -106,5 +106,9 @@ export default class DefaultChangelogRenderer {
     protected groupChangesByScope(changes: ChangelogChange[]): Record<string, ChangelogChange[]>;
     protected extractBreakingChangeExplanation(message: string): string | null;
     private isBreakingChangeBoundary;
+    protected isAiAgentAuthor(author: {
+        name: string;
+        email: string;
+    }): boolean;
     protected formatName(name?: string): string;
 }

package/dist/release/changelog-renderer/index.js

@@ -3,6 +3,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const semver_1 = require("semver");
 // Stripped from breaking change explanations (e.g. bot/session markers).
 const HtmlCommentRegex = /<!--[\s\S]*?-->/g;
+// Keyed on email: agent display names track model versions (e.g. "Claude Opus
+// 5 (1M context)"), and a human contributor can share a name with an agent.
+const AiAgentAuthorEmails = new Set([
+    'noreply@anthropic.com',
+    'claude@anthropic.com',
+    'amp@ampcode.com',
+    'cursoragent@cursor.com',
+    'openhands@all-hands.dev',
+    'opendevin@all-hands.dev',
+]);
+// The Copilot coding agent's trailer is not always [bot]-suffixed.
+const CopilotAuthorEmailRegex = /^(?:\d+\+)?copilot@users\.noreply\.github\.com$/;
 class DefaultChangelogRenderer {
     /**
      * A ChangelogRenderer class takes in the determined changes and other relevant metadata
@@ -212,7 +224,7 @@ class DefaultChangelogRenderer {
             }
             for (const author of change.authors) {
                 const name = this.formatName(author.name);
-                if (!name || name.includes('[bot]')) {
+                if (!name || name.includes('[bot]') || this.isAiAgentAuthor(author)) {
                     continue;
                 }
                 if (!_authors.has(name)) {
@@ -371,6 +383,10 @@ class DefaultChangelogRenderer {
             // Git metadata delimiter following the body
             trimmed === '"');
     }
+    isAiAgentAuthor(author) {
+        const email = (author.email || '').trim().toLowerCase();
+        return (AiAgentAuthorEmails.has(email) || CopilotAuthorEmailRegex.test(email));
+    }
     formatName(name = '') {
         return name
             .split(' ')

package/dist/src/command-line/migrate/prompt-files.js

@@ -44,15 +44,8 @@ async function resolvePromptFiles(packageName, packageVersion, migrations, migra
         ? resolvedPromptFiles
         : undefined;
 }
-function isPromptPathWithinMigrationsDir(migrationsDir, promptRelPath) {
-    const rel = (0, path_1.relative)(migrationsDir, (0, path_1.join)(migrationsDir, promptRelPath));
-    return !((0, path_1.isAbsolute)(promptRelPath) ||
-        rel === '..' ||
-        rel.startsWith(`..${path_1.sep}`) ||
-        rel.startsWith(`..${path_1.posix.sep}`));
-}
 function assertPromptPathWithinMigrationsDir(migrationsDir, promptRelPath, packageName, packageVersion) {
-    if (!isPromptPathWithinMigrationsDir(migrationsDir, promptRelPath)) {
+    if (!(0, path_2.isContainedRelativePath)(promptRelPath)) {
         throw new Error(`Invalid prompt path "${promptRelPath}" in package "${packageName}@${packageVersion}": prompt paths must be relative and resolve within the package's migrations directory.`);
     }
 }
@@ -77,7 +70,7 @@ exports.PromptResolutionError = PromptResolutionError;
  * directory and point at an existing file.
  */
 function resolvePrompt(promptPath, migrationsDir) {
-    if (!isPromptPathWithinMigrationsDir(migrationsDir, promptPath)) {
+    if (!(0, path_2.isContainedRelativePath)(promptPath)) {
         throw new PromptResolutionError(promptPath, migrationsDir);
     }
     const resolvedPath = (0, path_1.join)(migrationsDir, promptPath);

package/dist/src/command-line/release/changelog.js

@@ -380,7 +380,9 @@ function createAPI(overrideReleaseConfig, ignoreNxJsonConfig) {
                 }
                 else {
                     const groupCacheKey = `${releaseGroup.name}:fixed`;
-                    const fromSHA = await getCachedFromSHA(groupCacheKey, releaseGroup.releaseTag.pattern, {}, workspacePreid ?? projectsPreid?.[Object.keys(projectsPreid)[0]], releaseGroup.releaseTag.checkAllBranchesWhen, releaseGroup.releaseTag.requireSemver, releaseGroup.releaseTag.strictPreid);
+                    const fromSHA = await getCachedFromSHA(groupCacheKey, releaseGroup.releaseTag.pattern, {
+                        releaseGroupName: releaseGroup.name,
+                    }, workspacePreid ?? projectsPreid?.[Object.keys(projectsPreid)[0]], releaseGroup.releaseTag.checkAllBranchesWhen, releaseGroup.releaseTag.requireSemver, releaseGroup.releaseTag.strictPreid);
                     if (!fromSHA) {
                         throw new Error(`Unable to determine the previous git tag. If this is the first release of your release group, use the --first-release option or set the "release.changelog.automaticFromRef" config property in nx.json to generate a changelog from the first commit. Otherwise, be sure to configure the "release.releaseTag.pattern" property in nx.json to match the structure of your repository's git tags.`);
                     }

package/dist/src/command-line/report/report.d.ts

@@ -13,6 +13,7 @@ export declare const patternsWeIgnoreInCommunityReport: Array<string | RegExp>;
  *
  */
 export declare function reportHandler(): Promise<void>;
+export declare function cacheSectionLines(cache: NonNullable<ReportData['cache']>): string[];
 export interface ReportData {
     pm: PackageManager;
     pmVersion: string;
@@ -49,6 +50,7 @@ export interface ReportData {
     cache: {
         max: number;
         used: number;
+        location: string;
     } | null;
 }
 export declare function getReportData(): Promise<ReportData>;

package/dist/src/command-line/report/report.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.patternsWeIgnoreInCommunityReport = exports.packagesWeCareAbout = void 0;
 exports.reportHandler = reportHandler;
+exports.cacheSectionLines = cacheSectionLines;
 exports.getReportData = getReportData;
 exports.findMisalignedPackagesForPackage = findMisalignedPackagesForPackage;
 exports.findInstalledPowerpackPlugins = findInstalledPowerpackPlugins;
@@ -11,6 +12,8 @@ exports.findInstalledPackagesWeCareAbout = findInstalledPackagesWeCareAbout;
 const tslib_1 = require("tslib");
 const pc = tslib_1.__importStar(require("picocolors"));
 const output_1 = require("../../utils/output");
+const path_1 = require("path");
+const os_1 = require("os");
 const package_manager_1 = require("../../utils/package-manager");
 const fileutils_1 = require("../../utils/fileutils");
 const package_json_1 = require("../../utils/package-json");
@@ -25,6 +28,7 @@ const operators_1 = require("../../project-graph/operators");
 const versions_1 = require("../../utils/versions");
 const nx_key_1 = require("../../utils/nx-key");
 const cache_1 = require("../../tasks-runner/cache");
+const cache_directory_1 = require("../../utils/cache-directory");
 const client_1 = require("../../daemon/client/client");
 const nx_package_group_1 = require("../../utils/nx-package-group");
 const nxPackageJson = (0, fileutils_1.readJsonFile)(require.resolve('nx/package.json'));
@@ -140,7 +144,7 @@ async function reportHandler() {
     }
     if (cache) {
         bodyLines.push(LINE_SEPARATOR);
-        bodyLines.push(`Cache Usage: ${(0, cache_1.formatCacheSize)(cache.used)} / ${cache.max === 0 ? '∞' : (0, cache_1.formatCacheSize)(cache.max)}`);
+        bodyLines.push(...cacheSectionLines(cache));
     }
     if (outOfSyncPackageGroup) {
         bodyLines.push(LINE_SEPARATOR);
@@ -182,6 +186,28 @@ async function reportHandler() {
         bodyLines,
     });
 }
+/**
+ * The report is meant to be pasted into public issues, so the home directory
+ * is elided rather than printing the user's account name.
+ */
+function collapseHome(path) {
+    const home = (0, os_1.homedir)();
+    return path === home || path.startsWith(home + path_1.sep)
+        ? `~${path.slice(home.length)}`
+        : path;
+}
+function cacheSectionLines(cache) {
+    const unlimited = cache.max === 0;
+    const max = unlimited ? '∞' : (0, cache_1.formatCacheSize)(cache.max);
+    const share = unlimited
+        ? ''
+        : ` (${((cache.used / cache.max) * 100).toFixed(1)}%)`;
+    return [
+        'Cache',
+        `- Usage: ${(0, cache_1.formatCacheSize)(cache.used)} / ${max}${share}`,
+        `- Location: ${collapseHome(cache.location)}`,
+    ];
+}
 function findDependencyChain(graph, targetNode) {
     const reversedGraph = (0, operators_1.reverse)(graph);
     // BFS to find shortest path to root dependency
@@ -266,6 +292,7 @@ async function getReportData() {
         ? {
             max: (0, cache_1.resolveMaxCacheSize)(nxJson),
             used: new cache_1.DbCache({ nxCloudRemoteCache: null }).getUsedCacheSpace(),
+            location: cache_directory_1.cacheDir,
         }
         : null;
     return {

package/dist/src/command-line/reset/reset.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetHandler = resetHandler;
 const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
 const client_1 = require("../../daemon/client/client");
 const tmp_dir_1 = require("../../daemon/tmp-dir");
 const cache_directory_1 = require("../../utils/cache-directory");
@@ -125,8 +124,7 @@ async function resetCloudClient() {
 }
 function removeInstalledNxCloudClient() {
     return incrementalBackoff(INCREMENTAL_BACKOFF_FIRST_DELAY, INCREMENTAL_BACKOFF_MAX_DURATION, () => {
-        const cloudClientDir = (0, update_manager_1.getBundleInstallDefaultLocation)();
-        (0, node_fs_1.rmSync)((0, node_path_1.join)(cloudClientDir, 'cloud'), { recursive: true, force: true });
+        (0, node_fs_1.rmSync)((0, update_manager_1.getBundleInstallDefaultLocation)(), { recursive: true, force: true });
     });
 }
 function cleanupCacheEntries() {

package/dist/src/daemon/client/daemon-environment.d.ts

@@ -62,3 +62,13 @@ export declare function getAppliedDaemonClientEnv(): {
  * previous client is stale all the same.
  */
 export declare function applyDaemonEnvFromClient(newEnv: NodeJS.ProcessEnv): string[];
+/**
+ * Yarn Berry creates a fresh BERRY_BIN_FOLDER for every invocation and puts it
+ * first on PATH. The wrappers inside are runtime state the daemon and workers
+ * must receive, but the folder's random name is not project-graph identity:
+ * two invocations whose environments differ only by it would compute the same
+ * graph. Strips the folder from PATH and pins the var to a sentinel so such
+ * environments compare equal. Returns a copy; never mutates runtime env.
+ */
+export declare function normalizeDaemonEnvironmentForGraph(env: NodeJS.ProcessEnv, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+export declare function getChangedEnvKeys(before: NodeJS.ProcessEnv, after: NodeJS.ProcessEnv): string[];

package/dist/src/daemon/client/daemon-environment.js

@@ -6,6 +6,8 @@ exports.getDaemonClientEnvGeneration = getDaemonClientEnvGeneration;
 exports.getDaemonSpawnEnv = getDaemonSpawnEnv;
 exports.getAppliedDaemonClientEnv = getAppliedDaemonClientEnv;
 exports.applyDaemonEnvFromClient = applyDaemonEnvFromClient;
+exports.normalizeDaemonEnvironmentForGraph = normalizeDaemonEnvironmentForGraph;
+exports.getChangedEnvKeys = getChangedEnvKeys;
 const file_hasher_1 = require("../../hasher/file-hasher");
 const DAEMON_ENV_REQUIRED_SETTINGS = {
     NX_PROJECT_GLOB_CACHE: 'false',
@@ -376,3 +378,45 @@ function applyDaemonEnvFromClient(newEnv) {
     appliedClientEnv = { ...newEnv };
     return [...changedKeys];
 }
+const BERRY_BIN_FOLDER_GRAPH_IDENTITY = '<YARN_BERRY_BIN_FOLDER>';
+/**
+ * Yarn Berry creates a fresh BERRY_BIN_FOLDER for every invocation and puts it
+ * first on PATH. The wrappers inside are runtime state the daemon and workers
+ * must receive, but the folder's random name is not project-graph identity:
+ * two invocations whose environments differ only by it would compute the same
+ * graph. Strips the folder from PATH and pins the var to a sentinel so such
+ * environments compare equal. Returns a copy; never mutates runtime env.
+ */
+function normalizeDaemonEnvironmentForGraph(env, platform = process.platform) {
+    const normalized = { ...env };
+    const berryBinFolder = normalized.BERRY_BIN_FOLDER;
+    if (!berryBinFolder) {
+        return normalized;
+    }
+    const pathKey = Object.keys(normalized).find((key) => key.toUpperCase() === 'PATH');
+    if (pathKey && normalized[pathKey]) {
+        const pathDelimiter = platform === 'win32' ? ';' : ':';
+        const canonicalize = (value) => {
+            const withPlatformSeparators = platform === 'win32' ? value.replaceAll('/', '\\') : value;
+            return platform === 'win32'
+                ? withPlatformSeparators.toLowerCase()
+                : withPlatformSeparators;
+        };
+        const canonicalBerryBinFolder = canonicalize(berryBinFolder);
+        normalized[pathKey] = normalized[pathKey]
+            .split(pathDelimiter)
+            .filter((entry) => canonicalize(entry) !== canonicalBerryBinFolder)
+            .join(pathDelimiter);
+    }
+    normalized.BERRY_BIN_FOLDER = BERRY_BIN_FOLDER_GRAPH_IDENTITY;
+    return normalized;
+}
+function getChangedEnvKeys(before, after) {
+    const changedKeys = [];
+    for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+        if (before[key] !== after[key]) {
+            changedKeys.push(key);
+        }
+    }
+    return changedKeys;
+}

package/dist/src/daemon/server/handle-client-env.js

@@ -29,12 +29,30 @@ async function handleClientEnv(env) {
     while (inFlightApply) {
         await inFlightApply;
     }
+    const graphEnvBefore = (0, daemon_environment_1.normalizeDaemonEnvironmentForGraph)(process.env);
+    const previousClientEnv = (0, daemon_environment_1.getAppliedDaemonClientEnv)()?.env;
     const changedEnvKeys = (0, daemon_environment_1.applyDaemonEnvFromClient)(env);
     if (changedEnvKeys.length === 0) {
         return;
     }
-    logger_1.serverLogger.log(`Graph recompute necessary due to env variable refresh. Changed keys: ${changedEnvKeys.join(', ')}`);
-    const apply = applyEnvChange(env);
+    // Runtime changes always reach the workers, but only changes that survive
+    // graph normalization (e.g. Yarn Berry's per-invocation BERRY_BIN_FOLDER
+    // does not) invalidate the computed graph.
+    const graphChangedKeys = new Set([
+        ...(0, daemon_environment_1.getChangedEnvKeys)(graphEnvBefore, (0, daemon_environment_1.normalizeDaemonEnvironmentForGraph)(process.env)),
+        ...(previousClientEnv
+            ? (0, daemon_environment_1.getChangedEnvKeys)((0, daemon_environment_1.normalizeDaemonEnvironmentForGraph)(previousClientEnv), (0, daemon_environment_1.normalizeDaemonEnvironmentForGraph)(env))
+            : []),
+    ]);
+    if (graphChangedKeys.size > 0) {
+        logger_1.serverLogger.log(`Graph recompute necessary due to env variable refresh. Changed keys: ${[
+            ...graphChangedKeys,
+        ].join(', ')}`);
+    }
+    else {
+        logger_1.serverLogger.log(`Env variable refresh changed only runtime values (${changedEnvKeys.join(', ')}); graph identity is unchanged, keeping the cached graph.`);
+    }
+    const apply = applyEnvChange(env, graphChangedKeys.size > 0);
     inFlightApply = apply;
     try {
         await apply;
@@ -45,8 +63,11 @@ async function handleClientEnv(env) {
         }
     }
 }
-async function applyEnvChange(env) {
+async function applyEnvChange(env, invalidateGraph) {
     await forwardEnvToPluginWorkers(env);
+    if (!invalidateGraph) {
+        return;
+    }
     // Discarding the cached graph makes the next request recompute under the
     // new env, and chains any in-flight compute (started under the old env) to
     // that successor.

package/dist/src/nx-cloud/update-manager.js

@@ -12,6 +12,7 @@ const axios_1 = require("./utilities/axios");
 const debug_logger_1 = require("./debug-logger");
 const tar = tslib_1.__importStar(require("tar-stream"));
 const cache_directory_1 = require("../utils/cache-directory");
+const is_ci_1 = require("../utils/is-ci");
 const crypto_1 = require("crypto");
 const workspace_root_1 = require("../utils/workspace-root");
 class NxCloudEnterpriseOutdatedError extends Error {
@@ -106,9 +107,9 @@ function getBundleInstallDefaultLocation() {
     if ((0, fs_1.existsSync)(legacyPath)) {
         return legacyPath;
     }
-    else {
-        return (0, path_1.join)(cache_directory_1.cacheDir, 'cloud');
-    }
+    // The bundle `require`s a bare `nx`, so it must sit where that resolves: on CI
+    // the shared per-user root is outside the checkout (NXC-4944).
+    return (0, path_1.join)((0, is_ci_1.isCI)() ? (0, cache_directory_1.cacheDirectoryForWorkspace)(workspace_root_1.workspaceRoot) : cache_directory_1.cacheDir, 'cloud');
 }
 const runnerBundleInstallDirectory = getBundleInstallDefaultLocation();
 function getLatestInstalledRunnerBundle() {

package/dist/src/plugins/js/lock-file/pruned-output.d.ts

@@ -42,15 +42,16 @@ type PrunedPnpmConfig = {
  * file is inert, verified installable with identical module resolution on
  * pnpm 9, 10 and 11.
  *
- * pnpm 11+ reads build approvals (`allowBuilds`), `supportedArchitectures` and
- * `patchedDependencies` only from pnpm-workspace.yaml, so those are carried
- * from the workspace root; pass `prunedLockfileContent` to scope the approvals
- * to the packages the pruned lockfile keeps (an approval for an absent package
- * is inert either way, this only keeps the emitted file accurate). On
- * pnpm <=10, which reads them from the emitted package.json instead (see
- * `getPrunedPnpmPackageJsonBuildSettings`), or when the workspace declares
- * none, the file holds only `packages: []`. Resolution-time config stays out:
- * the pruned lockfile bakes it in (`stripPrunedLockfilePnpmConfig`).
+ * On pnpm 11+, this file carries declared `minimumReleaseAge`,
+ * `minimumReleaseAgeExclude`, `minimumReleaseAgeStrict`, build approvals,
+ * `supportedArchitectures`, and applicable `patchedDependencies` from the
+ * workspace root. Approvals and patches are scoped to the pruned lockfile.
+ *
+ * On pnpm <=10, only build approvals, `supportedArchitectures`, and
+ * `patchedDependencies` are emitted in `package.json`.
+ *
+ * Settings encoded in the pruned resolution, such as `overrides` and
+ * `packageExtensions`, are not copied (`stripPrunedLockfilePnpmConfig`).
  *
  * The major is the build machine's pnpm, which is all that is knowable at
  * build time: an output built on pnpm <=10 but deployed on pnpm 11+ will not

package/dist/src/plugins/js/lock-file/pruned-output.js

@@ -107,15 +107,16 @@ function dropInheritedPnpmPatchedDependencies(packageJson) {
  * file is inert, verified installable with identical module resolution on
  * pnpm 9, 10 and 11.
  *
- * pnpm 11+ reads build approvals (`allowBuilds`), `supportedArchitectures` and
- * `patchedDependencies` only from pnpm-workspace.yaml, so those are carried
- * from the workspace root; pass `prunedLockfileContent` to scope the approvals
- * to the packages the pruned lockfile keeps (an approval for an absent package
- * is inert either way, this only keeps the emitted file accurate). On
- * pnpm <=10, which reads them from the emitted package.json instead (see
- * `getPrunedPnpmPackageJsonBuildSettings`), or when the workspace declares
- * none, the file holds only `packages: []`. Resolution-time config stays out:
- * the pruned lockfile bakes it in (`stripPrunedLockfilePnpmConfig`).
+ * On pnpm 11+, this file carries declared `minimumReleaseAge`,
+ * `minimumReleaseAgeExclude`, `minimumReleaseAgeStrict`, build approvals,
+ * `supportedArchitectures`, and applicable `patchedDependencies` from the
+ * workspace root. Approvals and patches are scoped to the pruned lockfile.
+ *
+ * On pnpm <=10, only build approvals, `supportedArchitectures`, and
+ * `patchedDependencies` are emitted in `package.json`.
+ *
+ * Settings encoded in the pruned resolution, such as `overrides` and
+ * `packageExtensions`, are not copied (`stripPrunedLockfilePnpmConfig`).
  *
  * The major is the build machine's pnpm, which is all that is knowable at
  * build time: an output built on pnpm <=10 but deployed on pnpm 11+ will not
@@ -129,6 +130,29 @@ function getPrunedPnpmInstallSettingsYaml(workspaceRootPath = workspace_root_1.w
     // list is accepted by pnpm 9-11 without pulling any importer into the install.
     return dump({ packages: [], ...settings });
 }
+/**
+ * pnpm-workspace.yaml fields carried verbatim from the workspace root to the
+ * pruned output, with no interpretation beyond "declared or not" (unlike
+ * `allowBuilds`, filtered to the pruned lockfile, and `patchedDependencies`,
+ * resolved against it):
+ * - `supportedArchitectures`.
+ * - `minimumReleaseAge`/`minimumReleaseAgeExclude`: silently dropping these
+ *   falls back to pnpm's own default cutoff instead of the workspace's,
+ *   which can reject lockfile entries the workspace itself allows (or vice
+ *   versa).
+ * - `minimumReleaseAgeStrict`: starting with pnpm 11.0.0, a declared
+ *   `minimumReleaseAge` enables strict mode unless `minimumReleaseAgeStrict:
+ *   false` is also declared. Dropping an explicit `false` here would
+ *   silently re-enable strict mode in the pruned output and make its
+ *   install reject an immature exact dependency the source workspace
+ *   accepted.
+ */
+const STRAIGHT_COPY_WORKSPACE_SETTINGS = [
+    'supportedArchitectures',
+    'minimumReleaseAge',
+    'minimumReleaseAgeExclude',
+    'minimumReleaseAgeStrict',
+];
 /**
  * The settings `getPrunedPnpmInstallSettingsYaml` emits, before serialization,
  * so a caller can tell which of them the workspace actually declares. Null when
@@ -155,7 +179,7 @@ function getPrunedPnpmWorkspaceSettings(workspaceRootPath, prunedLockfileContent
     }
     catch {
         // Unreadable or malformed pnpm-workspace.yaml: skip rather than guess.
-        logger_1.logger.warn('Could not read the workspace root pnpm-workspace.yaml; the pruned output will not declare pnpm install settings (build-script approvals, supportedArchitectures, patchedDependencies).');
+        logger_1.logger.warn('Could not read the workspace root pnpm-workspace.yaml; the pruned output will not declare pnpm install settings (build-script approvals, supportedArchitectures, minimumReleaseAge, patchedDependencies).');
         return null;
     }
     const settings = {};
@@ -167,8 +191,8 @@ function getPrunedPnpmWorkspaceSettings(workspaceRootPath, prunedLockfileContent
             settings.allowBuilds = allowBuilds;
         }
     }
-    if (rootSettings.supportedArchitectures) {
-        settings.supportedArchitectures = rootSettings.supportedArchitectures;
+    for (const field of STRAIGHT_COPY_WORKSPACE_SETTINGS) {
+        assignDefined(settings, rootSettings, field);
     }
     const patchedDependencies = precomputed?.patchedDependencies ??
         (prunedLockfileContent
@@ -216,7 +240,7 @@ function getPnpmMajor(workspaceRootPath) {
 function getPnpmMajorOrWarn(workspaceRootPath) {
     const pnpmMajor = getPnpmMajor(workspaceRootPath);
     if (pnpmMajor === null) {
-        logger_1.logger.warn('Could not determine the pnpm version. The pruned output will not carry pnpm build-script approvals, supportedArchitectures, or patchedDependencies declarations; patch files still ship.');
+        logger_1.logger.warn('Could not determine the pnpm version. The pruned output will not carry pnpm build-script approvals, supportedArchitectures, minimumReleaseAge, or patchedDependencies declarations; patch files still ship.');
     }
     return pnpmMajor;
 }