@nx/js 23.2.0-beta.1 → 23.2.0-beta.11

package/dist/src/migrations/update-23-2-0/add-pnpm-prune-lockfile-cache-config.md

@@ -0,0 +1,59 @@
+#### Update the cache configuration of `@nx/js:prune-lockfile` targets for the pnpm install artifacts
+
+In a pnpm workspace, the `@nx/js:prune-lockfile` executor emits more than the pruned `package.json` and `pnpm-lock.yaml`: a settings-only `pnpm-workspace.yaml`, the `.patch` files of a `pnpm patch` workspace under `patches/`, and non-workspace local-path dependencies (`file:` tarballs and directories, `link:` targets) under `local_path_modules/`. On pnpm 11 and above that workspace file is where the build-script approvals and `supportedArchitectures` live; on pnpm 10 and below they go into the emitted `package.json` and the file ships carrying only an empty `packages` list.
+
+Targets generated before this change declare only the manifest and the lockfile in `outputs`, so a cache replay in a clean checkout restores just those two files. The missing `patches/` and `local_path_modules/` break the deploy install loudly. On pnpm 11 and above a missing `pnpm-workspace.yaml` is worse than loud: it silently drops the build-script approvals, and the deployed app's native dependencies never run their build scripts.
+
+Those artifacts are built from pnpm settings the workspace root declares. The build approvals and `supportedArchitectures` among them are recorded nowhere in the lockfile, so nothing else in the task hash moves when they change, and the same targets declare no `inputs` at all. Revoking a build approval would replay the previous run's artifact from cache and ship an output that still grants it.
+
+The three artifact paths are appended to whichever `outputs` array declares the `pnpm-lock.yaml` entry, reusing that entry's own path prefix. That covers a target's own `outputs` and the `targetDefaults` entries applying to prune-lockfile targets: entries keyed by the executor, declaring or filtering on it, and entries under a target-name or glob key that resolves to one of them. Configurations without `outputs`, configurations whose lockfile entry is not pnpm's, and paths already present are left untouched.
+
+The two root sources, plus a `runtime` input probing the pnpm major (which decides whether the settings land in the emitted `pnpm-workspace.yaml` or the emitted `package.json` when the root manifest has no `packageManager` field; it is added even when the field currently pins a pnpm version, because the migration runs once and the pin can be removed later), go somewhere else, because a target's own `inputs` array replaces the defaults' rather than merging with it. Each target is classified by its merged `outputs`, so inheriting or spreading the lockfile entry still counts, and the sources are added once: to the target's own `inputs` when it declares them, and otherwise to the `targetDefaults` entry supplying the array it inherits. A target inheriting nothing gets nx's own default spelled out first, so nothing that was hashed stops being hashed. A source the target already hashes is left alone. A workspace with no prune-lockfile target at all, configuring them purely through `targetDefaults`, has the sources added to every compatible entry under the key that declares its own `inputs` (each can be the array a future target inherits, and a sibling's array covers nothing); when no filter-less entry declares any, the spelled-out default is prepended as a new entry, under a name or glob key pinned to the executor so same-name targets of other executors do not inherit it. The fallback is only authored where it cannot change which key a target resolves: under the executor key when a compatible filter-less entry already exists, and under a name or glob key when a compatible filter-less entry already pins the executor. Any other key gets no fallback, whether its compatible entries are all filtered or its filter-less entries do not pin the executor, because a new entry would make that key win selection for targets that previously resolved their defaults elsewhere.
+
+The migration only ever appends to an array that already exists or writes that spelled-out default; it never authors a `"..."` of its own. Whether a spread finds anything to expand against depends on the identity resets in nx's own document-order merge, and one that finds nothing would leave the target hashing only the two root files.
+
+#### Sample code changes
+
+##### Before
+
+```json title="apps/app1/project.json"
+{
+  "targets": {
+    "prune-lockfile": {
+      "executor": "@nx/js:prune-lockfile",
+      "outputs": [
+        "{workspaceRoot}/dist/apps/app1/package.json",
+        "{workspaceRoot}/dist/apps/app1/pnpm-lock.yaml"
+      ]
+    }
+  }
+}
+```
+
+##### After
+
+```json title="apps/app1/project.json"
+{
+  "targets": {
+    "prune-lockfile": {
+      "executor": "@nx/js:prune-lockfile",
+      "inputs": [
+        "default",
+        "^default",
+        "{workspaceRoot}/pnpm-workspace.yaml",
+        "{workspaceRoot}/package.json",
+        {
+          "runtime": "node -e \"try{console.log('pnpm major '+require('child_process').execSync('pnpm --version',{stdio:['ignore','pipe','ignore']}).toString().trim().split('.')[0])}catch{console.log('pnpm major unavailable')}\""
+        }
+      ],
+      "outputs": [
+        "{workspaceRoot}/dist/apps/app1/package.json",
+        "{workspaceRoot}/dist/apps/app1/pnpm-lock.yaml",
+        "{workspaceRoot}/dist/apps/app1/pnpm-workspace.yaml",
+        "{workspaceRoot}/dist/apps/app1/patches",
+        "{workspaceRoot}/dist/apps/app1/local_path_modules"
+      ]
+    }
+  }
+}
+```

package/dist/src/plugins/typescript/plugin.js

@@ -5,12 +5,7 @@ const internal_1 = require("@nx/devkit/internal");
 const devkit_1 = require("@nx/devkit");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
-const file_hasher_1 = require("nx/src/hasher/file-hasher");
 const picomatch = require("picomatch");
-// eslint-disable-next-line @typescript-eslint/no-restricted-imports
-const lock_file_1 = require("nx/src/plugins/js/lock-file/lock-file");
-const cache_directory_1 = require("nx/src/utils/cache-directory");
-const installation_directory_1 = require("nx/src/utils/installation-directory");
 const util_1 = require("./util");
 let ts;
 const resolvedTypescriptPaths = {};
@@ -20,12 +15,12 @@ function resolveTypescriptPath(projectRoot, workspaceRoot) {
     // path is outside the workspace tree (e.g. pnpm's enableGlobalVirtualStore),
     // since typescript is not a declared dep.
     resolvedTypescriptPaths[projectRoot] ??= require.resolve('typescript', {
-        paths: [projectRoot, ...(0, installation_directory_1.getNxRequirePaths)(workspaceRoot), __dirname],
+        paths: [projectRoot, ...(0, internal_1.getNxRequirePaths)(workspaceRoot), __dirname],
     });
     return resolvedTypescriptPaths[projectRoot];
 }
 const TSCONFIG_CACHE_VERSION = 2;
-const TS_CONFIG_CACHE_PATH = (0, node_path_1.join)(cache_directory_1.workspaceDataDirectory, 'tsconfig-files.hash');
+const TS_CONFIG_CACHE_PATH = (0, node_path_1.join)(internal_1.workspaceDataDirectory, 'tsconfig-files.hash');
 // Module-level cache store — each invocation gets a unique Symbol key
 const cacheStore = new Map();
 // Shared tsconfig cache — initialized once per batch, persisted to disk
@@ -117,8 +112,8 @@ const tsConfigGlob = '**/tsconfig*.json';
 exports.createNodesV2 = [
     tsConfigGlob,
     async (configFilePaths, options, context) => {
-        const optionsHash = (0, file_hasher_1.hashObject)(options);
-        const targetsCachePath = (0, node_path_1.join)(cache_directory_1.workspaceDataDirectory, `tsc-${optionsHash}.hash`);
+        const optionsHash = (0, internal_1.hashObject)(options);
+        const targetsCachePath = (0, node_path_1.join)(internal_1.workspaceDataDirectory, `tsc-${optionsHash}.hash`);
         const targetsCache = readFromCache(targetsCachePath);
         // Each invocation gets a unique Symbol key — guaranteed no collisions
         const cacheKey = Symbol('tsc-invocation');
@@ -136,7 +131,7 @@ exports.createNodesV2 = [
         const normalizedOptions = normalizePluginOptions(options);
         const packageManager = (0, devkit_1.detectPackageManager)(context.workspaceRoot);
         const pmc = (0, devkit_1.getPackageManagerCommand)(packageManager);
-        const lockFileName = (0, lock_file_1.getLockFileName)(packageManager);
+        const lockFileName = (0, internal_1.getLockFileName)(packageManager);
         const { configFilePaths: validConfigFilePaths, hashes, projectRoots, } = await resolveValidConfigFilesAndHashes(configFilePaths, normalizedOptions, optionsHash, context, cache, lockFileName);
         try {
             return await (0, devkit_1.createNodesFromFiles)((configFilePath, options, context, idx) => {
@@ -171,7 +166,7 @@ exports.createNodesV2 = [
 ];
 exports.createNodes = exports.createNodesV2;
 async function resolveValidConfigFilesAndHashes(configFilePaths, options, optionsHash, context, cache, lockFileName) {
-    const lockFileHash = (0, file_hasher_1.hashFile)((0, node_path_1.join)(context.workspaceRoot, lockFileName)) ?? '';
+    const lockFileHash = (0, internal_1.hashFile)((0, node_path_1.join)(context.workspaceRoot, lockFileName)) ?? '';
     const validConfigFilePaths = [];
     const hashes = [];
     const projectRoots = [];
@@ -218,7 +213,7 @@ async function getConfigFileHash(configFilePath, workspaceRoot, project, options
         packageJson = (0, devkit_1.readJsonFile)((0, node_path_1.join)(workspaceRoot, project.root, 'package.json'));
     }
     catch { }
-    return (0, file_hasher_1.hashArray)([
+    return (0, devkit_1.hashArray)([
         ...[
             fullConfigPath,
             ...extendedConfigFiles.files.sort(),
@@ -228,7 +223,7 @@ async function getConfigFileHash(configFilePath, workspaceRoot, project, options
         ...extendedConfigFiles.packages.sort(),
         lockFileHash,
         optionsHash,
-        ...(packageJson ? [(0, file_hasher_1.hashObject)(packageJson)] : []),
+        ...(packageJson ? [(0, internal_1.hashObject)(packageJson)] : []),
     ]);
 }
 function checkIfConfigFileShouldBeProject(config, cache) {
@@ -956,7 +951,7 @@ function getFileHash(filePath, workspaceRoot, cache) {
     const relativePath = posixRelative(workspaceRoot, filePath);
     if (!cache.fileHashes[relativePath]) {
         const content = readFile(filePath, workspaceRoot, cache);
-        cache.fileHashes[relativePath] = (0, file_hasher_1.hashArray)([content]);
+        cache.fileHashes[relativePath] = (0, devkit_1.hashArray)([content]);
     }
     return cache.fileHashes[relativePath];
 }

package/dist/src/plugins/typescript/util.d.ts

@@ -1,6 +1,6 @@
 import { type TargetConfiguration } from '@nx/devkit';
-import { type PackageManagerCommands } from 'nx/src/utils/package-manager';
 import { type ParsedCommandLine } from 'typescript';
+import { type PackageManagerCommands } from '@nx/devkit/internal';
 export type ExtendedConfigFile = {
     filePath: string;
     externalPackage?: string;

package/dist/src/release/utils/update-lock-file.js

@@ -3,9 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.updateLockFile = updateLockFile;
 const devkit_1 = require("@nx/devkit");
 const child_process_1 = require("child_process");
-const client_1 = require("nx/src/daemon/client/client");
-// eslint-disable-next-line @typescript-eslint/no-restricted-imports
-const lock_file_1 = require("nx/src/plugins/js/lock-file/lock-file");
+const internal_1 = require("@nx/devkit/internal");
 const semver_1 = require("semver");
 async function updateLockFile(cwd, { dryRun, verbose, options, }) {
     if (options?.skipLockFileUpdate) {
@@ -30,10 +28,10 @@ async function updateLockFile(cwd, { dryRun, verbose, options, }) {
         }
         return [];
     }
-    const isDaemonEnabled = client_1.daemonClient.enabled();
+    const isDaemonEnabled = internal_1.daemonClient.enabled();
     if (!dryRun && isDaemonEnabled) {
         // if not in dry-run temporarily stop the daemon, as it will error if the lock file is updated
-        await client_1.daemonClient.stop();
+        await internal_1.daemonClient.stop();
     }
     const packageManagerCommands = (0, devkit_1.getPackageManagerCommand)(packageManager);
     let installArgs = options?.installArgs || '';
@@ -48,7 +46,7 @@ async function updateLockFile(cwd, { dryRun, verbose, options, }) {
             installArgs = `${installArgs} --ignore-scripts`.trim();
         }
     }
-    const lockFile = (0, lock_file_1.getLockFileName)(packageManager);
+    const lockFile = (0, internal_1.getLockFileName)(packageManager);
     const command = `${packageManagerCommands.updateLockFile} ${installArgs}`.trim();
     if (verbose) {
         if (dryRun) {
@@ -62,10 +60,27 @@ async function updateLockFile(cwd, { dryRun, verbose, options, }) {
     if (dryRun) {
         return [];
     }
+    // Capture modified/untracked files before the lock file update so we can
+    // detect everything the package-manager command touches on disk.
+    const modifiedBefore = getGitModifiedFiles(cwd);
     execLockFileUpdate(command, cwd, env);
+    // Capture again after the command to compute the delta.
+    const modifiedAfter = getGitModifiedFiles(cwd);
+    const newlyChanged = [...modifiedAfter].filter((f) => !modifiedBefore.has(f));
+    // Always include the lock file itself even if git didn't pick it up
+    // (e.g. it could be .gitignored in unusual setups).
+    if (!newlyChanged.includes(lockFile)) {
+        newlyChanged.push(lockFile);
+    }
+    if (verbose && newlyChanged.length > 1) {
+        console.log(`\nDetected additional files changed during lock file update:`);
+        newlyChanged
+            .filter((f) => f !== lockFile)
+            .forEach((f) => console.log(`  ${f}`));
+    }
     if (isDaemonEnabled) {
         try {
-            await client_1.daemonClient.startInBackground();
+            await internal_1.daemonClient.startInBackground();
         }
         catch (e) {
             // If the daemon fails to start, we don't want to prevent the user from continuing, so we just log the error and move on
@@ -77,7 +92,31 @@ async function updateLockFile(cwd, { dryRun, verbose, options, }) {
             }
         }
     }
-    return [lockFile];
+    return newlyChanged;
+}
+/**
+ * Returns the set of modified, added, and untracked file paths reported by git.
+ * Used to detect all filesystem side-effects of the lock file update command.
+ */
+function getGitModifiedFiles(cwd) {
+    try {
+        // Do not trim the result: porcelain lines for working-tree-only changes
+        // start with a leading space (e.g. " M path"), and stripping it would
+        // make substring(3) drop the first character of the path on the first line.
+        const result = (0, child_process_1.execSync)('git status --porcelain', {
+            cwd,
+            encoding: 'utf-8',
+            windowsHide: true,
+        });
+        return new Set(result
+            .split('\n')
+            .filter((l) => l.length >= 4)
+            .map((l) => l.substring(3)));
+    }
+    catch {
+        // git may not be available or this may not be a git repo
+        return new Set();
+    }
 }
 function execLockFileUpdate(command, cwd, env) {
     try {

package/dist/src/release/version-actions.d.ts

@@ -1,9 +1,11 @@
 import { ProjectGraph, Tree } from '@nx/devkit';
-import { AfterAllProjectsVersioned, VersionActions } from 'nx/release';
-import type { NxReleaseVersionConfiguration } from 'nx/src/config/nx-json';
+import { VersionActions } from 'nx/release';
+import type { ResolveVersionForDependency } from 'nx/release';
+import type { AfterAllProjectsVersioned, NxReleaseVersionConfiguration } from '@nx/devkit/internal';
 export declare const afterAllProjectsVersioned: AfterAllProjectsVersioned;
 export default class JsVersionActions extends VersionActions {
     validManifestFilenames: string[];
+    excludeManifestsFromFormatting: boolean;
     readCurrentVersionFromSourceManifest(tree: Tree): Promise<{
         currentVersion: string;
         manifestPath: string;
@@ -17,6 +19,13 @@ export default class JsVersionActions extends VersionActions {
         dependencyCollection: string | null;
     }>;
     updateProjectVersion(tree: Tree, newVersion: string): Promise<string[]>;
-    updateProjectDependencies(tree: Tree, projectGraph: ProjectGraph, dependenciesToUpdate: Record<string, string>): Promise<string[]>;
+    updateProjectDependencies(tree: Tree, projectGraph: ProjectGraph, dependenciesToUpdate: Record<string, string>, resolveVersionForDependency?: ResolveVersionForDependency): Promise<string[]>;
+    private getLocalDependencyProjectLookup;
+    private resolveLocalDependencySpecifier;
+    private applyVersionPrefix;
+    private updateManifestValues;
+    private readAndValidateManifest;
+    private validateManifestUpdates;
+    private detectFormattingOptions;
     private isLocalDependencyProtocol;
 }