@nx/js 23.2.0-beta.0 → 23.2.0-beta.10

package/dist/src/migrations/update-23-2-0/add-pnpm-prune-lockfile-cache-config.md

@@ -0,0 +1,59 @@
+#### Update the cache configuration of `@nx/js:prune-lockfile` targets for the pnpm install artifacts
+
+In a pnpm workspace, the `@nx/js:prune-lockfile` executor emits more than the pruned `package.json` and `pnpm-lock.yaml`: a settings-only `pnpm-workspace.yaml`, the `.patch` files of a `pnpm patch` workspace under `patches/`, and non-workspace local-path dependencies (`file:` tarballs and directories, `link:` targets) under `local_path_modules/`. On pnpm 11 and above that workspace file is where the build-script approvals and `supportedArchitectures` live; on pnpm 10 and below they go into the emitted `package.json` and the file ships carrying only an empty `packages` list.
+
+Targets generated before this change declare only the manifest and the lockfile in `outputs`, so a cache replay in a clean checkout restores just those two files. The missing `patches/` and `local_path_modules/` break the deploy install loudly. On pnpm 11 and above a missing `pnpm-workspace.yaml` is worse than loud: it silently drops the build-script approvals, and the deployed app's native dependencies never run their build scripts.
+
+Those artifacts are built from pnpm settings the workspace root declares. The build approvals and `supportedArchitectures` among them are recorded nowhere in the lockfile, so nothing else in the task hash moves when they change, and the same targets declare no `inputs` at all. Revoking a build approval would replay the previous run's artifact from cache and ship an output that still grants it.
+
+The three artifact paths are appended to whichever `outputs` array declares the `pnpm-lock.yaml` entry, reusing that entry's own path prefix. That covers a target's own `outputs` and the `targetDefaults` entries applying to prune-lockfile targets: entries keyed by the executor, declaring or filtering on it, and entries under a target-name or glob key that resolves to one of them. Configurations without `outputs`, configurations whose lockfile entry is not pnpm's, and paths already present are left untouched.
+
+The two root sources, plus a `runtime` input probing the pnpm major (which decides whether the settings land in the emitted `pnpm-workspace.yaml` or the emitted `package.json` when the root manifest has no `packageManager` field; it is added even when the field currently pins a pnpm version, because the migration runs once and the pin can be removed later), go somewhere else, because a target's own `inputs` array replaces the defaults' rather than merging with it. Each target is classified by its merged `outputs`, so inheriting or spreading the lockfile entry still counts, and the sources are added once: to the target's own `inputs` when it declares them, and otherwise to the `targetDefaults` entry supplying the array it inherits. A target inheriting nothing gets nx's own default spelled out first, so nothing that was hashed stops being hashed. A source the target already hashes is left alone. A workspace with no prune-lockfile target at all, configuring them purely through `targetDefaults`, has the sources added to every compatible entry under the key that declares its own `inputs` (each can be the array a future target inherits, and a sibling's array covers nothing); when no filter-less entry declares any, the spelled-out default is prepended as a new entry, under a name or glob key pinned to the executor so same-name targets of other executors do not inherit it. The fallback is only authored where it cannot change which key a target resolves: under the executor key when a compatible filter-less entry already exists, and under a name or glob key when a compatible filter-less entry already pins the executor. Any other key gets no fallback, whether its compatible entries are all filtered or its filter-less entries do not pin the executor, because a new entry would make that key win selection for targets that previously resolved their defaults elsewhere.
+
+The migration only ever appends to an array that already exists or writes that spelled-out default; it never authors a `"..."` of its own. Whether a spread finds anything to expand against depends on the identity resets in nx's own document-order merge, and one that finds nothing would leave the target hashing only the two root files.
+
+#### Sample code changes
+
+##### Before
+
+```json title="apps/app1/project.json"
+{
+  "targets": {
+    "prune-lockfile": {
+      "executor": "@nx/js:prune-lockfile",
+      "outputs": [
+        "{workspaceRoot}/dist/apps/app1/package.json",
+        "{workspaceRoot}/dist/apps/app1/pnpm-lock.yaml"
+      ]
+    }
+  }
+}
+```
+
+##### After
+
+```json title="apps/app1/project.json"
+{
+  "targets": {
+    "prune-lockfile": {
+      "executor": "@nx/js:prune-lockfile",
+      "inputs": [
+        "default",
+        "^default",
+        "{workspaceRoot}/pnpm-workspace.yaml",
+        "{workspaceRoot}/package.json",
+        {
+          "runtime": "node -e \"try{console.log('pnpm major '+require('child_process').execSync('pnpm --version',{stdio:['ignore','pipe','ignore']}).toString().trim().split('.')[0])}catch{console.log('pnpm major unavailable')}\""
+        }
+      ],
+      "outputs": [
+        "{workspaceRoot}/dist/apps/app1/package.json",
+        "{workspaceRoot}/dist/apps/app1/pnpm-lock.yaml",
+        "{workspaceRoot}/dist/apps/app1/pnpm-workspace.yaml",
+        "{workspaceRoot}/dist/apps/app1/patches",
+        "{workspaceRoot}/dist/apps/app1/local_path_modules"
+      ]
+    }
+  }
+}
+```

package/dist/src/plugins/typescript/plugin.js

@@ -5,12 +5,7 @@ const internal_1 = require("@nx/devkit/internal");
 const devkit_1 = require("@nx/devkit");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
-const file_hasher_1 = require("nx/src/hasher/file-hasher");
 const picomatch = require("picomatch");
-// eslint-disable-next-line @typescript-eslint/no-restricted-imports
-const lock_file_1 = require("nx/src/plugins/js/lock-file/lock-file");
-const cache_directory_1 = require("nx/src/utils/cache-directory");
-const installation_directory_1 = require("nx/src/utils/installation-directory");
 const util_1 = require("./util");
 let ts;
 const resolvedTypescriptPaths = {};
@@ -20,12 +15,12 @@ function resolveTypescriptPath(projectRoot, workspaceRoot) {
     // path is outside the workspace tree (e.g. pnpm's enableGlobalVirtualStore),
     // since typescript is not a declared dep.
     resolvedTypescriptPaths[projectRoot] ??= require.resolve('typescript', {
-        paths: [projectRoot, ...(0, installation_directory_1.getNxRequirePaths)(workspaceRoot), __dirname],
+        paths: [projectRoot, ...(0, internal_1.getNxRequirePaths)(workspaceRoot), __dirname],
     });
     return resolvedTypescriptPaths[projectRoot];
 }
 const TSCONFIG_CACHE_VERSION = 2;
-const TS_CONFIG_CACHE_PATH = (0, node_path_1.join)(cache_directory_1.workspaceDataDirectory, 'tsconfig-files.hash');
+const TS_CONFIG_CACHE_PATH = (0, node_path_1.join)(internal_1.workspaceDataDirectory, 'tsconfig-files.hash');
 // Module-level cache store — each invocation gets a unique Symbol key
 const cacheStore = new Map();
 // Shared tsconfig cache — initialized once per batch, persisted to disk
@@ -117,8 +112,8 @@ const tsConfigGlob = '**/tsconfig*.json';
 exports.createNodesV2 = [
     tsConfigGlob,
     async (configFilePaths, options, context) => {
-        const optionsHash = (0, file_hasher_1.hashObject)(options);
-        const targetsCachePath = (0, node_path_1.join)(cache_directory_1.workspaceDataDirectory, `tsc-${optionsHash}.hash`);
+        const optionsHash = (0, internal_1.hashObject)(options);
+        const targetsCachePath = (0, node_path_1.join)(internal_1.workspaceDataDirectory, `tsc-${optionsHash}.hash`);
         const targetsCache = readFromCache(targetsCachePath);
         // Each invocation gets a unique Symbol key — guaranteed no collisions
         const cacheKey = Symbol('tsc-invocation');
@@ -136,7 +131,7 @@ exports.createNodesV2 = [
         const normalizedOptions = normalizePluginOptions(options);
         const packageManager = (0, devkit_1.detectPackageManager)(context.workspaceRoot);
         const pmc = (0, devkit_1.getPackageManagerCommand)(packageManager);
-        const lockFileName = (0, lock_file_1.getLockFileName)(packageManager);
+        const lockFileName = (0, internal_1.getLockFileName)(packageManager);
         const { configFilePaths: validConfigFilePaths, hashes, projectRoots, } = await resolveValidConfigFilesAndHashes(configFilePaths, normalizedOptions, optionsHash, context, cache, lockFileName);
         try {
             return await (0, devkit_1.createNodesFromFiles)((configFilePath, options, context, idx) => {
@@ -171,7 +166,7 @@ exports.createNodesV2 = [
 ];
 exports.createNodes = exports.createNodesV2;
 async function resolveValidConfigFilesAndHashes(configFilePaths, options, optionsHash, context, cache, lockFileName) {
-    const lockFileHash = (0, file_hasher_1.hashFile)((0, node_path_1.join)(context.workspaceRoot, lockFileName)) ?? '';
+    const lockFileHash = (0, internal_1.hashFile)((0, node_path_1.join)(context.workspaceRoot, lockFileName)) ?? '';
     const validConfigFilePaths = [];
     const hashes = [];
     const projectRoots = [];
@@ -218,7 +213,7 @@ async function getConfigFileHash(configFilePath, workspaceRoot, project, options
         packageJson = (0, devkit_1.readJsonFile)((0, node_path_1.join)(workspaceRoot, project.root, 'package.json'));
     }
     catch { }
-    return (0, file_hasher_1.hashArray)([
+    return (0, devkit_1.hashArray)([
         ...[
             fullConfigPath,
             ...extendedConfigFiles.files.sort(),
@@ -228,7 +223,7 @@ async function getConfigFileHash(configFilePath, workspaceRoot, project, options
         ...extendedConfigFiles.packages.sort(),
         lockFileHash,
         optionsHash,
-        ...(packageJson ? [(0, file_hasher_1.hashObject)(packageJson)] : []),
+        ...(packageJson ? [(0, internal_1.hashObject)(packageJson)] : []),
     ]);
 }
 function checkIfConfigFileShouldBeProject(config, cache) {
@@ -956,7 +951,7 @@ function getFileHash(filePath, workspaceRoot, cache) {
     const relativePath = posixRelative(workspaceRoot, filePath);
     if (!cache.fileHashes[relativePath]) {
         const content = readFile(filePath, workspaceRoot, cache);
-        cache.fileHashes[relativePath] = (0, file_hasher_1.hashArray)([content]);
+        cache.fileHashes[relativePath] = (0, devkit_1.hashArray)([content]);
     }
     return cache.fileHashes[relativePath];
 }

package/dist/src/plugins/typescript/util.d.ts

@@ -1,6 +1,6 @@
 import { type TargetConfiguration } from '@nx/devkit';
-import { type PackageManagerCommands } from 'nx/src/utils/package-manager';
 import { type ParsedCommandLine } from 'typescript';
+import { type PackageManagerCommands } from '@nx/devkit/internal';
 export type ExtendedConfigFile = {
     filePath: string;
     externalPackage?: string;

package/dist/src/release/utils/update-lock-file.js

@@ -3,9 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.updateLockFile = updateLockFile;
 const devkit_1 = require("@nx/devkit");
 const child_process_1 = require("child_process");
-const client_1 = require("nx/src/daemon/client/client");
-// eslint-disable-next-line @typescript-eslint/no-restricted-imports
-const lock_file_1 = require("nx/src/plugins/js/lock-file/lock-file");
+const internal_1 = require("@nx/devkit/internal");
 const semver_1 = require("semver");
 async function updateLockFile(cwd, { dryRun, verbose, options, }) {
     if (options?.skipLockFileUpdate) {
@@ -30,10 +28,10 @@ async function updateLockFile(cwd, { dryRun, verbose, options, }) {
         }
         return [];
     }
-    const isDaemonEnabled = client_1.daemonClient.enabled();
+    const isDaemonEnabled = internal_1.daemonClient.enabled();
     if (!dryRun && isDaemonEnabled) {
         // if not in dry-run temporarily stop the daemon, as it will error if the lock file is updated
-        await client_1.daemonClient.stop();
+        await internal_1.daemonClient.stop();
     }
     const packageManagerCommands = (0, devkit_1.getPackageManagerCommand)(packageManager);
     let installArgs = options?.installArgs || '';
@@ -48,7 +46,7 @@ async function updateLockFile(cwd, { dryRun, verbose, options, }) {
             installArgs = `${installArgs} --ignore-scripts`.trim();
         }
     }
-    const lockFile = (0, lock_file_1.getLockFileName)(packageManager);
+    const lockFile = (0, internal_1.getLockFileName)(packageManager);
     const command = `${packageManagerCommands.updateLockFile} ${installArgs}`.trim();
     if (verbose) {
         if (dryRun) {
@@ -65,7 +63,7 @@ async function updateLockFile(cwd, { dryRun, verbose, options, }) {
     execLockFileUpdate(command, cwd, env);
     if (isDaemonEnabled) {
         try {
-            await client_1.daemonClient.startInBackground();
+            await internal_1.daemonClient.startInBackground();
         }
         catch (e) {
             // If the daemon fails to start, we don't want to prevent the user from continuing, so we just log the error and move on

package/dist/src/release/version-actions.d.ts

@@ -1,9 +1,11 @@
 import { ProjectGraph, Tree } from '@nx/devkit';
-import { AfterAllProjectsVersioned, VersionActions } from 'nx/release';
-import type { NxReleaseVersionConfiguration } from 'nx/src/config/nx-json';
+import { VersionActions } from 'nx/release';
+import type { ResolveVersionForDependency } from 'nx/release';
+import type { AfterAllProjectsVersioned, NxReleaseVersionConfiguration } from '@nx/devkit/internal';
 export declare const afterAllProjectsVersioned: AfterAllProjectsVersioned;
 export default class JsVersionActions extends VersionActions {
     validManifestFilenames: string[];
+    excludeManifestsFromFormatting: boolean;
     readCurrentVersionFromSourceManifest(tree: Tree): Promise<{
         currentVersion: string;
         manifestPath: string;
@@ -17,6 +19,13 @@ export default class JsVersionActions extends VersionActions {
         dependencyCollection: string | null;
     }>;
     updateProjectVersion(tree: Tree, newVersion: string): Promise<string[]>;
-    updateProjectDependencies(tree: Tree, projectGraph: ProjectGraph, dependenciesToUpdate: Record<string, string>): Promise<string[]>;
+    updateProjectDependencies(tree: Tree, projectGraph: ProjectGraph, dependenciesToUpdate: Record<string, string>, resolveVersionForDependency?: ResolveVersionForDependency): Promise<string[]>;
+    private getLocalDependencyProjectLookup;
+    private resolveLocalDependencySpecifier;
+    private applyVersionPrefix;
+    private updateManifestValues;
+    private readAndValidateManifest;
+    private validateManifestUpdates;
+    private detectFormattingOptions;
     private isLocalDependencyProtocol;
 }

package/dist/src/release/version-actions.js

@@ -5,11 +5,13 @@ const internal_1 = require("@nx/devkit/internal");
 const devkit_1 = require("@nx/devkit");
 const node_child_process_1 = require("node:child_process");
 const node_path_1 = require("node:path");
+const jsonc_parser_1 = require("jsonc-parser");
+const semver_1 = require("semver");
 const release_1 = require("nx/release");
 const npm_config_1 = require("../utils/npm-config");
 const update_lock_file_1 = require("./utils/update-lock-file");
 const chalk = require("chalk");
-const semver_1 = require("./utils/semver");
+const semver_2 = require("./utils/semver");
 const afterAllProjectsVersioned = async (cwd, { rootVersionActionsOptions, ...opts }) => {
     return {
         changedFiles: await (0, update_lock_file_1.updateLockFile)(cwd, {
@@ -22,10 +24,14 @@ const afterAllProjectsVersioned = async (cwd, { rootVersionActionsOptions, ...op
 exports.afterAllProjectsVersioned = afterAllProjectsVersioned;
 // Cache at the module level to avoid re-detecting the package manager for each instance
 let pm;
+// Every project in a release receives the same ProjectGraph. Building these
+// indexes once avoids turning dependency updates into quadratic graph scans.
+const localDependencyProjectsByGraph = new WeakMap();
 class JsVersionActions extends release_1.VersionActions {
     constructor() {
         super(...arguments);
         this.validManifestFilenames = ['package.json'];
+        this.excludeManifestsFromFormatting = true;
     }
     async readCurrentVersionFromSourceManifest(tree) {
         const sourcePackageJsonPath = (0, node_path_1.join)(this.projectGraphNode.data.root, 'package.json');
@@ -90,25 +96,26 @@ class JsVersionActions extends release_1.VersionActions {
     async readCurrentVersionOfDependency(tree, projectGraph, dependencyProjectName) {
         const sourcePackageJsonPath = (0, node_path_1.join)(this.projectGraphNode.data.root, 'package.json');
         const json = (0, devkit_1.readJson)(tree, sourcePackageJsonPath);
-        // Resolve the package name from the project graph metadata, as it may not match the project name
-        const dependencyPackageName = projectGraph.nodes[dependencyProjectName].data.metadata?.js?.packageName;
         const dependencyTypes = [
             'dependencies',
             'devDependencies',
             'peerDependencies',
             'optionalDependencies',
         ];
+        const dependencyPackageName = projectGraph.nodes[dependencyProjectName]?.data.metadata?.js?.packageName;
         let currentVersion = null;
         let dependencyCollection = null;
-        for (const depType of dependencyTypes) {
-            if (json[depType] && json[depType][dependencyPackageName]) {
-                currentVersion = json[depType][dependencyPackageName];
-                dependencyCollection = depType;
-                break;
+        if (dependencyPackageName) {
+            for (const depType of dependencyTypes) {
+                if (json[depType]?.[dependencyPackageName]) {
+                    currentVersion = json[depType][dependencyPackageName];
+                    dependencyCollection = depType;
+                    break;
+                }
             }
         }
         // Resolve catalog references if needed
-        if (currentVersion) {
+        if (currentVersion && dependencyPackageName) {
             const catalogManager = (0, internal_1.getCatalogManager)(tree.root);
             if (catalogManager?.isCatalogReference(currentVersion)) {
                 currentVersion = catalogManager.resolveCatalogReference(tree, dependencyPackageName, currentVersion);
@@ -122,100 +129,253 @@ class JsVersionActions extends release_1.VersionActions {
     async updateProjectVersion(tree, newVersion) {
         const logMessages = [];
         for (const manifestToUpdate of this.manifestsToUpdate) {
-            (0, devkit_1.updateJson)(tree, manifestToUpdate.manifestPath, (json) => {
-                json.version = newVersion;
-                return json;
-            });
+            this.updateManifestValues(tree, manifestToUpdate.manifestPath, [
+                { path: ['version'], value: newVersion },
+            ]);
             logMessages.push(`✍️  New version ${newVersion} written to manifest: ${manifestToUpdate.manifestPath}`);
         }
         return logMessages;
     }
-    async updateProjectDependencies(tree, projectGraph, dependenciesToUpdate) {
-        let numDependenciesToUpdate = Object.keys(dependenciesToUpdate).length;
-        if (numDependenciesToUpdate === 0) {
+    async updateProjectDependencies(tree, projectGraph, dependenciesToUpdate, resolveVersionForDependency) {
+        if (Object.keys(dependenciesToUpdate).length === 0 &&
+            !resolveVersionForDependency) {
             return [];
         }
-        const logMessages = [];
+        const dependencyTypes = [
+            'dependencies',
+            'devDependencies',
+            'peerDependencies',
+            'optionalDependencies',
+        ];
+        const localDependencyProjects = this.getLocalDependencyProjectLookup(projectGraph);
+        for (const projectName of Object.keys(dependenciesToUpdate)) {
+            if (!projectGraph.nodes[projectName]?.data.metadata?.js?.packageName) {
+                throw new Error(`Unable to determine the package name for project "${projectName}" from the project graph metadata, please ensure that the "@nx/js" plugin is installed and the project graph has been built. If the issue persists, please report this issue on https://github.com/nrwl/nx/issues`);
+            }
+        }
+        const resolvedVersions = new Map();
+        const resolveVersion = (projectName) => {
+            let resolution = resolvedVersions.get(projectName);
+            if (!resolution) {
+                if (!resolveVersionForDependency) {
+                    throw new Error(`No version resolver was provided for dependency project "${projectName}".`);
+                }
+                resolution = resolveVersionForDependency(projectName);
+                resolvedVersions.set(projectName, resolution);
+            }
+            return resolution;
+        };
+        const manifestUpdates = [];
         const catalogUpdates = [];
         const catalogManager = (0, internal_1.getCatalogManager)(tree.root);
         for (const manifestToUpdate of this.manifestsToUpdate) {
-            (0, devkit_1.updateJson)(tree, manifestToUpdate.manifestPath, (json) => {
-                const dependencyTypes = [
-                    'dependencies',
-                    'devDependencies',
-                    'peerDependencies',
-                    'optionalDependencies',
-                ];
-                const preserveMatchingDependencyRanges = this.finalConfigForProject.preserveMatchingDependencyRanges === true
-                    ? dependencyTypes
-                    : this.finalConfigForProject.preserveMatchingDependencyRanges ===
-                        false
-                        ? []
-                        : this.finalConfigForProject.preserveMatchingDependencyRanges ||
-                            dependencyTypes;
-                for (const depType of dependencyTypes) {
-                    if (json[depType]) {
-                        for (const [dep, version] of Object.entries(dependenciesToUpdate)) {
-                            // Resolve the package name from the project graph metadata, as it may not match the project name
-                            const packageName = projectGraph.nodes[dep].data.metadata?.js?.packageName;
-                            if (!packageName) {
-                                throw new Error(`Unable to determine the package name for project "${dep}" from the project graph metadata, please ensure that the "@nx/js" plugin is installed and the project graph has been built. If the issue persists, please report this issue on https://github.com/nrwl/nx/issues`);
+            const json = (0, devkit_1.readJson)(tree, manifestToUpdate.manifestPath);
+            const updates = [];
+            const preserveMatchingDependencyRanges = this.finalConfigForProject.preserveMatchingDependencyRanges === true
+                ? dependencyTypes
+                : this.finalConfigForProject.preserveMatchingDependencyRanges ===
+                    false
+                    ? []
+                    : this.finalConfigForProject.preserveMatchingDependencyRanges ||
+                        dependencyTypes;
+            for (const depType of dependencyTypes) {
+                if (json[depType]) {
+                    for (const [dependencyName, currentVersion] of Object.entries(json[depType])) {
+                        const targetProject = localDependencyProjects.get(dependencyName);
+                        if (!targetProject) {
+                            continue;
+                        }
+                        let version = dependenciesToUpdate[targetProject.projectName];
+                        if (version !== undefined) {
+                            if (catalogManager?.isCatalogReference(currentVersion)) {
+                                // collect the catalog updates so we can update the catalog definitions later
+                                const catalogRef = catalogManager.parseCatalogReference(currentVersion);
+                                catalogUpdates.push({
+                                    packageName: dependencyName,
+                                    version,
+                                    catalogName: catalogRef.catalogName,
+                                });
+                                continue;
                             }
-                            const currentVersion = json[depType][packageName];
-                            if (currentVersion) {
-                                if (catalogManager?.isCatalogReference(currentVersion)) {
-                                    // collect the catalog updates so we can update the catalog definitions later
-                                    const catalogRef = catalogManager.parseCatalogReference(currentVersion);
-                                    catalogUpdates.push({
-                                        packageName,
-                                        version,
-                                        catalogName: catalogRef.catalogName,
-                                    });
-                                    numDependenciesToUpdate--;
-                                    continue;
+                            if (manifestToUpdate.preserveLocalDependencyProtocols &&
+                                this.isLocalDependencyProtocol(currentVersion)) {
+                                continue;
+                            }
+                            if (this.isLocalDependencyProtocol(currentVersion)) {
+                                version = this.applyVersionPrefix(currentVersion, version);
+                            }
+                            if (preserveMatchingDependencyRanges.includes(depType) &&
+                                !this.isLocalDependencyProtocol(currentVersion)) {
+                                // If the dependency is specified using a range, do some additional processing to determine whether to update the version
+                                if ((0, semver_2.isValidRange)(currentVersion) &&
+                                    !(0, semver_2.isMatchingDependencyRange)(version, currentVersion)) {
+                                    throw new Error(`"preserveMatchingDependencyRanges" is enabled for "${depType}" and the new version "${version}" is outside the current range for "${dependencyName}" in manifest "${manifestToUpdate.manifestPath}". Please update the range before releasing.`);
                                 }
-                                // Check if other local dependency protocols should be preserved
-                                else if (manifestToUpdate.preserveLocalDependencyProtocols &&
-                                    this.isLocalDependencyProtocol(currentVersion)) {
-                                    // Reduce the count appropriately to avoid confusing user-facing logs
-                                    numDependenciesToUpdate--;
+                                else if ((0, semver_2.isValidRange)(currentVersion)) {
                                     continue;
                                 }
-                                else if (preserveMatchingDependencyRanges.includes(depType) &&
-                                    !this.isLocalDependencyProtocol(currentVersion)) {
-                                    // If the dependency is specified using a range, do some additional processing to determine whether to update the version
-                                    if ((0, semver_1.isValidRange)(currentVersion) &&
-                                        !(0, semver_1.isMatchingDependencyRange)(version, currentVersion)) {
-                                        throw new Error(`"preserveMatchingDependencyRanges" is enabled for "${depType}" and the new version "${version}" is outside the current range for "${packageName}" in manifest "${manifestToUpdate.manifestPath}". Please update the range before releasing.`);
-                                    }
-                                    else if ((0, semver_1.isValidRange)(currentVersion)) {
-                                        // it is a range, but it is valid
-                                        continue;
-                                    }
-                                }
-                                json[depType][packageName] = version;
                             }
                         }
+                        else if (resolveVersionForDependency &&
+                            !manifestToUpdate.preserveLocalDependencyProtocols &&
+                            this.isLocalDependencyProtocol(currentVersion)) {
+                            try {
+                                version = await this.resolveLocalDependencySpecifier(dependencyName, currentVersion, targetProject, resolveVersion);
+                            }
+                            catch (error) {
+                                const message = error instanceof Error ? error.message : String(error);
+                                throw new Error(`Unable to replace local dependency protocol "${currentVersion}" for "${dependencyName}" in manifest "${manifestToUpdate.manifestPath}". ${message}`);
+                            }
+                        }
+                        if (version !== undefined) {
+                            updates.push({
+                                path: [depType, dependencyName],
+                                value: version,
+                            });
+                        }
                     }
                 }
-                return json;
+            }
+            manifestUpdates.push({
+                manifestPath: manifestToUpdate.manifestPath,
+                updates,
             });
-            // If we ignored local dependecy protocols, then we could have dynamically ended up with zero here and we should not log anything related to dependencies
-            if (numDependenciesToUpdate === 0) {
-                return [];
+        }
+        // Resolve every requested version before writing any manifest so one
+        // failed resolver cannot leave a partially updated set of manifests.
+        const logMessages = [];
+        for (const manifestUpdate of manifestUpdates) {
+            this.updateManifestValues(tree, manifestUpdate.manifestPath, manifestUpdate.updates);
+            if (manifestUpdate.updates.length > 0) {
+                const depText = manifestUpdate.updates.length === 1 ? 'dependency' : 'dependencies';
+                logMessages.push(`✍️  Updated ${manifestUpdate.updates.length} ${depText} in manifest: ${manifestUpdate.manifestPath}`);
             }
-            const depText = numDependenciesToUpdate === 1 ? 'dependency' : 'dependencies';
-            logMessages.push(`✍️  Updated ${numDependenciesToUpdate} ${depText} in manifest: ${manifestToUpdate.manifestPath}`);
         }
-        // Update catalog definitions in pnpm-workspace.yaml
+        // Update catalog definitions in the package manager's catalog file
         if (catalogUpdates.length > 0) {
             // catalogManager is guaranteed to be defined when there are catalog updates
             catalogManager.updateCatalogVersions(tree, catalogUpdates);
             const catalogText = catalogUpdates.length === 1 ? 'entry' : 'entries';
-            logMessages.push(`✍️  Updated ${catalogUpdates.length} catalog ${catalogText} in pnpm-workspace.yaml`);
+            logMessages.push(`✍️  Updated ${catalogUpdates.length} catalog ${catalogText} in ${catalogManager
+                .getCatalogDefinitionFilePaths()
+                .join(', ')}`);
         }
         return logMessages;
     }
+    getLocalDependencyProjectLookup(projectGraph) {
+        let lookup = localDependencyProjectsByGraph.get(projectGraph);
+        if (lookup) {
+            return lookup;
+        }
+        // This lookup requires the dependency key to match the package name.
+        // Package aliases need relationship-specific manifest data that the
+        // project graph does not retain. Support is tracked in
+        // https://github.com/nrwl/nx/issues/36630.
+        lookup = new Map();
+        for (const [projectName, node] of Object.entries(projectGraph.nodes)) {
+            const packageName = node.data.metadata?.js?.packageName;
+            if (!packageName) {
+                continue;
+            }
+            lookup.set(packageName, { projectName });
+        }
+        localDependencyProjectsByGraph.set(projectGraph, lookup);
+        return lookup;
+    }
+    async resolveLocalDependencySpecifier(dependencyName, versionSpecifier, targetProject, resolveVersion) {
+        if (versionSpecifier.startsWith('file:')) {
+            const resolvedVersion = await resolveVersion(targetProject.projectName);
+            return this.applyVersionPrefix(versionSpecifier, resolvedVersion);
+        }
+        const range = versionSpecifier.slice('workspace:'.length);
+        if (range !== '' &&
+            range !== '*' &&
+            range !== '^' &&
+            range !== '~' &&
+            (0, semver_1.validRange)(range) !== null) {
+            return range;
+        }
+        const isRelativePath = range.startsWith('.');
+        if (!isRelativePath &&
+            range !== '' &&
+            range !== '*' &&
+            range !== '^' &&
+            range !== '~') {
+            throw new Error(`The workspace protocol used by "${dependencyName}" is not a supported range or relative workspace path.`);
+        }
+        const resolvedVersion = await resolveVersion(targetProject.projectName);
+        return this.applyVersionPrefix(isRelativePath ? 'workspace:*' : `workspace:${range}`, resolvedVersion);
+    }
+    applyVersionPrefix(versionSpecifier, resolvedVersion) {
+        const configuredPrefix = this.finalConfigForProject.versionPrefix;
+        let prefix = '';
+        if (configuredPrefix === '~' ||
+            configuredPrefix === '^' ||
+            configuredPrefix === '=') {
+            prefix = configuredPrefix;
+        }
+        else if (configuredPrefix === 'auto' &&
+            versionSpecifier.startsWith('workspace:')) {
+            const range = versionSpecifier.slice('workspace:'.length);
+            if (range.startsWith('^')) {
+                prefix = '^';
+            }
+            else if (range.startsWith('~')) {
+                prefix = '~';
+            }
+        }
+        return `${prefix}${resolvedVersion.replace(/^[~^=]/, '')}`;
+    }
+    updateManifestValues(tree, manifestPath, updates) {
+        if (updates.length === 0) {
+            return;
+        }
+        let content = this.readAndValidateManifest(tree, manifestPath);
+        const formattingOptions = this.detectFormattingOptions(content);
+        for (const update of updates) {
+            content = (0, jsonc_parser_1.applyEdits)(content, (0, jsonc_parser_1.modify)(content, update.path, update.value, { formattingOptions }));
+        }
+        this.validateManifestUpdates(content, manifestPath, updates);
+        tree.write(manifestPath, content);
+    }
+    readAndValidateManifest(tree, manifestPath) {
+        const content = tree.read(manifestPath, 'utf-8');
+        try {
+            // Match readJson's support for comments and trailing commas while
+            // retaining the original text for targeted edits.
+            (0, devkit_1.parseJson)(content);
+        }
+        catch (error) {
+            throw new Error(`Cannot parse ${manifestPath}: ${error.message}`);
+        }
+        return content;
+    }
+    validateManifestUpdates(content, manifestPath, updates) {
+        const manifest = (0, devkit_1.parseJson)(content);
+        for (const update of updates) {
+            let actualValue = manifest;
+            for (const pathSegment of update.path) {
+                if (actualValue === null ||
+                    typeof actualValue !== 'object' ||
+                    !(pathSegment in actualValue)) {
+                    actualValue = undefined;
+                    break;
+                }
+                actualValue = actualValue[pathSegment];
+            }
+            if (actualValue !== update.value) {
+                throw new Error(`Cannot update ${manifestPath}: "${update.path.join('.')}" resolves to ${JSON.stringify(actualValue)} instead of ${JSON.stringify(update.value)} after editing. The manifest may contain duplicate keys.`);
+            }
+        }
+    }
+    detectFormattingOptions(content) {
+        const indentation = content.match(/^[\t ]+(?=")/m)?.[0] ?? '  ';
+        const insertSpaces = !indentation.includes('\t');
+        return {
+            insertSpaces,
+            tabSize: insertSpaces ? indentation.length : 1,
+        };
+    }
     // NOTE: The TODOs were carried over from the original implementation, they are not yet implemented
     isLocalDependencyProtocol(versionSpecifier) {
         const localPackageProtocols = [