nx 23.1.0 → 23.1.2

package/dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults.md

@@ -0,0 +1,50 @@
+#### Set cache on executor-based target defaults
+
+Maintains compatibility with how cacheability was resolved before Nx 23.
+
+Target defaults resolve to a single key rather than merging them. When a target matches both a target name key and an executor key, the executor key is the one that applies, and the target name key is not read at all. Earlier versions of Nx also derived cacheability from target names, so `"cache": true` on the target name key still took effect even when an executor key applied. Nx 23 reads cacheability from the resolved target only.
+
+This migration copies `cache` onto each executor key that applies to a target whose target name key enables it, so those targets remain cacheable.
+
+An executor key applies to every target that resolves through it, so the migration updates a key only when it can establish that caching is right for all of them. It leaves the key unchanged when the key already declares `cache`, when it declares `continuous: true`, when every entry on the key is filtered so none of them always applies, when a target through it is continuous or is a long-running target such as `serve`, `dev`, or `start`, when the executor's own schema marks its targets continuous, or when a target through it has no target name key enabling `cache`. It never updates the `nx:run-commands` or `nx:run-script` keys, because targets written with `command` and targets derived from `package.json` scripts resolve through those keys without naming them.
+
+Where the migration makes no change, Nx still decides at run time, per target rather than per key: a target whose target name key enables `cache`, and whose resolved configuration still leaves `cache` undefined, gets it back and is reported as a deprecated fallback. Because that test is applied to the resolved target rather than to the key, it also covers the cases where a key looks decided but is not for this project — an executor key whose entries are all filtered, or whose only `cache` declaration is filtered out here. It equally covers the targets left behind because a sibling target through the same key does not opt in, and the targets reaching the `nx:run-commands` and `nx:run-script` keys. Three cases get no fallback and no warning. A continuous or long-running target, because caching it is invalid. A target whose resolved configuration already sets `cache`. And a target whose target name key was discarded as incompatible, because its entry named an executor the target does not use — before Nx 23 that target was cacheable, since cacheability was matched on target name alone and the entry's `executor` was never read. Restoring it here would mean setting `cache` with no executor key to point the user at and no migration able to retire the behavior, so it is deliberately left alone. Set `cache` on those targets directly.
+
+Targets are read from each project's `project.json` and from the `nx.targets` block of its `package.json`. Targets inferred by a plugin, and targets derived from `package.json` scripts, are not visible to the migration — the latter is why the `nx:run-script` key is never updated. A key that looks safe here may still serve an inferred target. Set `cache` on the executor key by hand only after checking that no target reaching it is continuous; Nx rejects a target that is both cacheable and continuous. Nx names both keys in a run-time warning. That warning is emitted during project graph construction, so while the daemon is running it goes to `.nx/workspace-data/d/daemon.log` rather than the terminal; CI runs, where the daemon is disabled, print it normally.
+
+#### Sample code changes
+
+Given a project with a `build` target that uses the `@nx/angular:webpack-browser` executor:
+
+##### Before
+
+```json title="nx.json"
+{
+  "targetDefaults": {
+    "build": {
+      "cache": true,
+      "dependsOn": ["^build"]
+    },
+    "@nx/angular:webpack-browser": {
+      "inputs": ["production", "^production"]
+    }
+  }
+}
+```
+
+##### After
+
+```json title="nx.json"
+{
+  "targetDefaults": {
+    "build": {
+      "cache": true,
+      "dependsOn": ["^build"]
+    },
+    "@nx/angular:webpack-browser": {
+      "inputs": ["production", "^production"],
+      "cache": true
+    }
+  }
+}
+```

package/dist/src/native/index.d.ts

@@ -326,6 +326,7 @@ export interface EventDimensions {
   packageName: string
   packageVersion: string
   duration: string
+  sampleRate: string
   taskCount: string
   projectCount: string
   cachedTaskCount: string
@@ -411,6 +412,16 @@ export declare function getEventDimensions(): EventDimensions
  */
 export declare function getFilesForOutputsBatch(directory: string, entriesBatch: Array<Array<string>>): Array<Array<string>>
 
+/**
+ * The same list, for JavaScript callers that walk a tree rather than the
+ * filesystem - `visitNotIgnoredFiles` - so both sides apply one baseline
+ * instead of maintaining a second copy that drifts.
+ *
+ * The patterns are gitignore-shaped, so they read the same to the `ignore`
+ * crate here and the `ignore` npm package there.
+ */
+export declare function getHardcodedIgnorePatterns(): Array<string>
+
 /**
  * If `workspace_root` is inside a git worktree, returns the main repo root.
  * Returns `None` when already in the main repo (or not in a git repo at all).
@@ -487,14 +498,14 @@ export interface HashInputs {
  * so the caller can set it as an env var for child processes.
  * Used by CLI and daemon.
  */
-export declare function initializeTelemetry(connection: ExternalObject<NxDbConnection>, workspaceId: string, userId: string, nxVersion: string, packageManagerName: string, packageManagerVersion: string | undefined | null, nodeVersion: string, osArch: string, osPlatform: string, osRelease: string, isCi: boolean, isNxCloud: boolean): string
+export declare function initializeTelemetry(connection: ExternalObject<NxDbConnection>, workspaceId: string, userId: string | undefined | null, nxVersion: string, packageManagerName: string, packageManagerVersion: string | undefined | null, nodeVersion: string, osArch: string, osPlatform: string, osRelease: string, isCi: boolean, isNxCloud: boolean): string
 
 /**
  * Initialize telemetry with a pre-fetched session ID.
  * No DB connection — used by plugin workers that inherit the
  * session ID from their parent process via env var.
  */
-export declare function initializeTelemetryWithSessionId(sessionId: string, workspaceId: string, userId: string, nxVersion: string, packageManagerName: string, packageManagerVersion: string | undefined | null, nodeVersion: string, osArch: string, osPlatform: string, osRelease: string, isCi: boolean, isNxCloud: boolean): void
+export declare function initializeTelemetryWithSessionId(sessionId: string, workspaceId: string, userId: string | undefined | null, nxVersion: string, packageManagerName: string, packageManagerVersion: string | undefined | null, nodeVersion: string, osArch: string, osPlatform: string, osRelease: string, isCi: boolean, isNxCloud: boolean): void
 
 export interface InputsInput {
   input: string
@@ -557,6 +568,24 @@ export interface Link {
 
 export declare function logDebug(message: string): void
 
+/**
+ * Checks which `paths` match the given `globs`, using the same glob engine
+ * as the task hasher (`build_glob_set`). Used to statically match
+ * `dependentTasksOutputFiles` globs against candidate paths.
+ */
+export declare function matchGlobPaths(globs: Array<string>, paths: Array<string>): Array<boolean>
+
+/**
+ * Statically checks which `paths` would be captured by the given output
+ * `entries`, without touching the file system. Mirrors `expand_outputs`
+ * semantics: entries match themselves and anything nested under them (so a
+ * directory entry captures its contents), negated (`!`-prefixed) entries
+ * exclude matches from the whole entry set, and a non-empty list with only
+ * negated entries matches everything not excluded. An empty list matches
+ * nothing.
+ */
+export declare function matchOutputPaths(entries: Array<string>, paths: Array<string>): Array<boolean>
+
 /** Combined metadata for groups and processes */
 export interface Metadata {
   /** Group-level metadata */

package/dist/src/native/index.js

@@ -1,15 +1,11 @@
 const { join, basename } = require('path');
-const {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-} = require('fs');
+const { copyFileSync, renameSync, statSync, unlinkSync } = require('fs');
+const { createHash } = require('crypto');
 const Module = require('module');
 const { nxVersion } = require('../utils/versions');
-const { getNativeFileCacheLocation } = require('./native-file-cache-location');
+const {
+  ensureSecureNativeFileCacheLocation,
+} = require('./native-file-cache-location');
 
 const MAX_COPY_RETRIES = 3;
 
@@ -73,6 +69,14 @@ function statsOrNull(path) {
   }
 }
 
+function removeIfPresent(path) {
+  try {
+    unlinkSync(path);
+  } catch {
+    // Ignore cleanup errors
+  }
+}
+
 function isNoExecError(e) {
   return e.code === 'EACCES' || e.code === 'EPERM';
 }
@@ -95,20 +99,44 @@ Module._load = function (request, parent, isMain) {
     const nativeLocation = require.resolve(modulePath);
     const fileName = basename(nativeLocation);
 
-    // we copy the file to a workspace-scoped tmp directory and prefix with nxVersion to avoid stale files being loaded
-    const nativeFileCacheLocation = getNativeFileCacheLocation();
+    // null when the cache dir cannot be created *and trusted*; loading in place
+    // from node_modules is safer than loading out of a directory we don't own.
+    const nativeFileCacheLocation = ensureSecureNativeFileCacheLocation();
+    if (!nativeFileCacheLocation) {
+      return originalLoad.apply(this, [nativeLocation, parent, isMain]);
+    }
+
+    // nxVersion alone is not enough: in a source checkout it is the placeholder
+    // 0.0.1 for every worktree, so hashing the resolved binding path keeps each
+    // checkout in its own entry.
+    const cacheKey =
+      nxVersion +
+      '-' +
+      createHash('sha256')
+        .update(nativeLocation)
+        .digest('hex')
+        .substring(0, 12);
+
     // This is a path to copy to, not the one that gets loaded
     const tmpTmpFile = join(
       nativeFileCacheLocation,
-      nxVersion + '-' + Math.random() + fileName
+      cacheKey + '-' + Math.random() + fileName
     );
     // This is the path that will get loaded
-    const tmpFile = join(nativeFileCacheLocation, nxVersion + '-' + fileName);
-    const expectedFileSize = statSync(nativeLocation).size;
+    const tmpFile = join(nativeFileCacheLocation, cacheKey + '-' + fileName);
+    const sourceStats = statSync(nativeLocation);
+    const expectedFileSize = sourceStats.size;
     const existingFileStats = statsOrNull(tmpFile);
 
-    // If the file to be loaded already exists, just load it
-    if (existingFileStats?.size === expectedFileSize) {
+    // Size alone does not detect a rebuilt binding: a small Rust edit routinely
+    // produces a byte-identical size. The copy is taken after the build, so a
+    // cache entry older than the source means the source was rebuilt since.
+    const isFresh =
+      existingFileStats?.size === expectedFileSize &&
+      existingFileStats.mtimeMs >= sourceStats.mtimeMs;
+
+    // If the file to be loaded already exists and is current, just load it
+    if (isFresh) {
       try {
         return originalLoad.apply(this, [tmpFile, parent, isMain]);
       } catch (e) {
@@ -119,20 +147,36 @@ Module._load = function (request, parent, isMain) {
         throw e;
       }
     }
-    if (!existsSync(nativeFileCacheLocation)) {
-      mkdirSync(nativeFileCacheLocation, { recursive: true });
-    }
 
     // Retry copying up to 3 times, validating after each copy
+    let attemptsMade = 0;
+    let cacheError = null;
     for (let attempt = 1; attempt <= MAX_COPY_RETRIES; attempt++) {
+      attemptsMade = attempt;
       // First copy to a unique location for each process
-      copyFileSync(nativeLocation, tmpTmpFile);
+      try {
+        copyFileSync(nativeLocation, tmpTmpFile);
+      } catch (e) {
+        // Permission errors won't heal on retry, and a throwing copy can still
+        // have left a partial file behind.
+        cacheError = e;
+        removeIfPresent(tmpTmpFile);
+        break;
+      }
 
       // Validate the copy - check file size matches expected
       const copiedFileStats = statsOrNull(tmpTmpFile);
       if (copiedFileStats?.size === expectedFileSize) {
         // Copy succeeded, rename to final location and load
-        renameSync(tmpTmpFile, tmpFile);
+        try {
+          renameSync(tmpTmpFile, tmpFile);
+        } catch (e) {
+          // Unguarded, this throws out of `require` and native-bindings.js
+          // reports it as a missing optional dependency, which it is not.
+          cacheError = e;
+          removeIfPresent(tmpTmpFile);
+          break;
+        }
         try {
           return originalLoad.apply(this, [tmpFile, parent, isMain]);
         } catch (e) {
@@ -145,16 +189,15 @@ Module._load = function (request, parent, isMain) {
       }
 
       // Copy failed validation, clean up the malformed file
-      try {
-        unlinkSync(tmpTmpFile);
-      } catch {
-        // Ignore cleanup errors
-      }
+      removeIfPresent(tmpTmpFile);
     }
 
-    // All retries failed - warn and load from original location
+    // Name the errno: ENOSPC, EROFS, EACCES and EDQUOT are all actionable and
+    // otherwise indistinguishable.
     console.warn(
-      `Warning: Failed to copy native module to cache after ${MAX_COPY_RETRIES} attempts. ` +
+      `Warning: Failed to copy native module to cache after ${attemptsMade} attempt${
+        attemptsMade === 1 ? '' : 's'
+      }${cacheError ? ` (${cacheError.code ?? cacheError.message})` : ''}. ` +
         `Loading from original location instead. ` +
         `This may cause file locking issues on Windows.`
     );

package/dist/src/native/native-bindings.js

@@ -610,6 +610,7 @@ module.exports.getBinaryTarget = nativeBinding.getBinaryTarget
 module.exports.getDefaultMaxCacheSize = nativeBinding.getDefaultMaxCacheSize
 module.exports.getEventDimensions = nativeBinding.getEventDimensions
 module.exports.getFilesForOutputsBatch = nativeBinding.getFilesForOutputsBatch
+module.exports.getHardcodedIgnorePatterns = nativeBinding.getHardcodedIgnorePatterns
 module.exports.getMainWorktreeRoot = nativeBinding.getMainWorktreeRoot
 module.exports.getTransformableOutputs = nativeBinding.getTransformableOutputs
 module.exports.GroupType = nativeBinding.GroupType
@@ -625,6 +626,8 @@ module.exports.isEditorInstalled = nativeBinding.isEditorInstalled
 module.exports.killProcessTree = nativeBinding.killProcessTree
 module.exports.killProcessTreeGraceful = nativeBinding.killProcessTreeGraceful
 module.exports.logDebug = nativeBinding.logDebug
+module.exports.matchGlobPaths = nativeBinding.matchGlobPaths
+module.exports.matchOutputPaths = nativeBinding.matchOutputPaths
 module.exports.parseTaskStatus = nativeBinding.parseTaskStatus
 module.exports.remove = nativeBinding.remove
 module.exports.restoreTerminal = nativeBinding.restoreTerminal

package/dist/src/native/native-file-cache-location.d.ts

@@ -1 +1,17 @@
-export declare function getNativeFileCacheLocation(): string;
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+export declare const NATIVE_CACHE_ROOT: string;
+export declare function getNativeFileCacheLocationToDelete(): string | null;
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+export declare function ensureSecureNativeFileCacheLocation(cacheRoot?: string): string | null;

package/dist/src/native/native-file-cache-location.js

@@ -1,23 +1,97 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNativeFileCacheLocation = getNativeFileCacheLocation;
-const os_1 = require("os");
+exports.NATIVE_CACHE_ROOT = void 0;
+exports.getNativeFileCacheLocationToDelete = getNativeFileCacheLocationToDelete;
+exports.ensureSecureNativeFileCacheLocation = ensureSecureNativeFileCacheLocation;
 const path_1 = require("path");
-const crypto_1 = require("crypto");
-const workspace_root_1 = require("../utils/workspace-root");
+const fs_1 = require("fs");
+const nx_tmp_dir_1 = require("../utils/nx-tmp-dir");
 const versions_1 = require("../utils/versions");
-function getNativeFileCacheLocation() {
-    if (process.env.NX_NATIVE_FILE_CACHE_DIRECTORY) {
-        return process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+const owned_private_dir_1 = require("../utils/owned-private-dir");
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+exports.NATIVE_CACHE_ROOT = (0, path_1.join)(nx_tmp_dir_1.NX_USER_TMP_DIR, 'native-cache');
+/**
+ * The configured cache dir, normalized. `resolve` strips a trailing slash, which
+ * would otherwise defeat the guards downstream: `lstat` on a path ending in `/`
+ * resolves a symlink rather than reporting it, and `O_NOFOLLOW` then opens the
+ * target. `NX_SOCKET_DIR` is normalized for the same reason.
+ */
+function configuredCacheDir() {
+    const dir = process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+    return dir ? (0, path_1.resolve)(dir) : undefined;
+}
+function getNativeFileCacheLocationToDelete() {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        // Checked for ownership before it is handed to a recursive delete: being
+        // configured does not make it ours. Weaker than the load path below, which
+        // also enforces mode and validates the version directory.
+        return (0, owned_private_dir_1.isOwnedRealDirectory)(configured) ? configured : null;
     }
-    else {
-        const hash = (0, crypto_1.createHash)('sha256').update(workspace_root_1.workspaceRoot).update(versions_1.nxVersion);
+    return (0, owned_private_dir_1.isSafeSharedRoot)(nx_tmp_dir_1.NX_TMP_DIR).status === 'ok' &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(nx_tmp_dir_1.NX_USER_TMP_DIR) &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(exports.NATIVE_CACHE_ROOT)
+        ? (0, path_1.join)(exports.NATIVE_CACHE_ROOT, versions_1.nxVersion)
+        : null;
+}
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+function ensureSecureNativeFileCacheLocation(
+// Test seam: lets a spec plant a hostile directory under a root it controls.
+cacheRoot = exports.NATIVE_CACHE_ROOT) {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        const dir = configured;
         try {
-            hash.update((0, os_1.userInfo)().username);
+            // Held to the same 0700 bar as the default location: a `.node` is loaded
+            // out of here. Unlike NX_SOCKET_DIR it is not additionally refused for
+            // naming one of Nx's own roots, which is the only case that throws.
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(dir), { recursive: true });
+            const established = (0, owned_private_dir_1.ensureOwnedPrivateDir)(dir);
+            if (established.status !== 'ok') {
+                // The guard's own reason rather than a fixed sentence: `not-created
+                // (EACCES)` and `foreign-owner` are exactly what the catch below
+                // promises to tell apart, and one string for all of them cannot.
+                throw new owned_private_dir_1.DirectoryRefusedError(established.refusal);
+            }
+            return dir;
         }
         catch (e) {
-            // if there's no user, we only use the workspace root for the hash and move on
+            // Never discard a configured directory silently — the socket directory
+            // follows the same rule. A typo, EACCES or EROFS is otherwise
+            // indistinguishable from a working cache.
+            console.warn(`Nx could not use the configured native file cache directory ${dir} (${e?.code ?? e?.message ?? e}). Loading the native binding in place instead.`);
+            return null;
+        }
+    }
+    const userRoot = (0, path_1.dirname)(cacheRoot);
+    const sharedRoot = (0, path_1.dirname)(userRoot);
+    // Outermost first: the stable shared container must either belong to root or
+    // to us, and must be sticky if peers can write there. The uid directory then
+    // becomes the owner-only boundary for sockets and native-cache alike.
+    if ((0, owned_private_dir_1.ensureSafeSharedRoot)(sharedRoot).status !== 'ok') {
+        return null;
+    }
+    for (const root of [userRoot, cacheRoot]) {
+        if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(root).status !== 'ok') {
+            return null;
         }
-        return (0, path_1.join)((0, os_1.tmpdir)(), `nx-native-file-cache-${hash.digest('hex').substring(0, 7)}`);
     }
+    // Verified, not assumed: this is the directory we load a `.node` out of.
+    const versionDir = (0, path_1.join)(cacheRoot, versions_1.nxVersion);
+    if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(versionDir).status !== 'ok') {
+        return null;
+    }
+    return versionDir;
 }

package/dist/src/nx-cloud/utilities/get-cloud-options.js

@@ -5,12 +5,15 @@ exports.getCloudUrl = getCloudUrl;
 exports.removeTrailingSlash = removeTrailingSlash;
 exports.isNxCloudId = isNxCloudId;
 const nx_json_1 = require("../../config/nx-json");
-const run_command_1 = require("../../tasks-runner/run-command");
 const workspace_root_1 = require("../../utils/workspace-root");
 function getCloudOptions(directory = workspace_root_1.workspaceRoot) {
+    // Required lazily: this module is reachable from the @nx/devkit/internal
+    // barrel that plugin workers load, and run-command eagerly pulls in the whole
+    // task-execution subsystem.
+    const { getRunnerOptions, } = require('../../tasks-runner/run-command');
     const nxJson = (0, nx_json_1.readNxJson)(directory);
     // TODO: The default is not always cloud? But it's not handled at the moment
-    return (0, run_command_1.getRunnerOptions)('default', nxJson, {}, true);
+    return getRunnerOptions('default', nxJson, {}, true);
 }
 function getCloudUrl() {
     return removeTrailingSlash(process.env.NX_CLOUD_API || process.env.NRWL_API || `https://cloud.nx.app`);

package/dist/src/nx-cloud/utilities/onboarding.js

@@ -5,7 +5,6 @@ exports.getNxCloudAppOnBoardingUrl = getNxCloudAppOnBoardingUrl;
 exports.readNxCloudToken = readNxCloudToken;
 const is_workspace_claimed_1 = require("./is-workspace-claimed");
 const url_shorten_1 = require("./url-shorten");
-const run_command_1 = require("../../tasks-runner/run-command");
 const nx_json_1 = require("../../generators/utils/nx-json");
 async function createNxCloudOnboardingURLForWelcomeApp(tree, token) {
     token = token || readNxCloudToken(tree);
@@ -22,7 +21,11 @@ async function getNxCloudAppOnBoardingUrl(token) {
     return onboardingUrl;
 }
 function readNxCloudToken(tree) {
+    // Required lazily: this module is re-exported from the @nx/devkit/internal
+    // barrel that plugin workers load, and run-command eagerly pulls in the whole
+    // task-execution subsystem.
+    const { getRunnerOptions, } = require('../../tasks-runner/run-command');
     const nxJson = (0, nx_json_1.readNxJson)(tree);
-    const { accessToken, nxCloudId } = (0, run_command_1.getRunnerOptions)('default', nxJson, {}, true);
+    const { accessToken, nxCloudId } = getRunnerOptions('default', nxJson, {}, true);
     return accessToken || nxCloudId;
 }

package/dist/src/plugins/js/lock-file/bun-parser.js

@@ -12,6 +12,16 @@ const project_graph_1 = require("../../../config/project-graph");
 const file_hasher_1 = require("../../../hasher/file-hasher");
 const project_graph_builder_1 = require("../../../project-graph/project-graph-builder");
 const json_1 = require("../../../utils/json");
+// Highest bun.lock version this parser has been verified against:
+// - 1: workspace packages are no longer listed with their dependencies
+// - 2: identical content, stricter validation in Bun's own reader
+// - 3: values in "overrides" may be objects holding rules scoped to a parent
+//      package (`"parent": { "child": "1.0.0" }`) and keys may carry a version
+//      selector (`"parent@1"`, `"child@<2"`). This parser never reads
+//      "overrides"; the resolved packages are listed in "packages" as before.
+// Newer versions are parsed on a best-effort basis instead of being rejected
+// outright.
+const MAX_KNOWN_LOCKFILE_VERSION = 3;
 const DEPENDENCY_TYPES = [
     'dependencies',
     'devDependencies',
@@ -356,9 +366,12 @@ function parseLockFile(lockFileContent, lockFileHash) {
             if (typeof result.lockfileVersion !== 'number') {
                 throw new Error(`Lockfile version must be a number, got ${typeof result.lockfileVersion}`);
             }
-            const supportedVersions = [0, 1];
-            if (!supportedVersions.includes(result.lockfileVersion)) {
-                throw new Error(`Unsupported lockfile version ${result.lockfileVersion}. Supported versions: ${supportedVersions.join(', ')}`);
+            if (!Number.isInteger(result.lockfileVersion) ||
+                result.lockfileVersion < 0) {
+                throw new Error(`Unsupported lockfile version ${result.lockfileVersion}. Lockfile version must be a non-negative integer`);
+            }
+            if (result.lockfileVersion > MAX_KNOWN_LOCKFILE_VERSION) {
+                console.warn(`bun.lock has lockfileVersion ${result.lockfileVersion}, which is newer than the version ${MAX_KNOWN_LOCKFILE_VERSION} this version of Nx was tested with. Attempting to parse it anyway.`);
             }
         }
         if (!result.packages || typeof result.packages !== 'object') {
@@ -616,7 +629,7 @@ function processPackageForDependencies(packageKey, packageData, lockFile, index,
         const deps = packageDependencies[depType];
         if (!deps || typeof deps !== 'object')
             continue;
-        const depDependencies = processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePackages, lockFile.manifests);
+        const depDependencies = processDependencyEntries(deps, packageKey, sourceNodeName, lockFile, index, ctx, workspacePackages);
         dependencies.push(...depDependencies);
     }
     return dependencies;
@@ -634,12 +647,12 @@ function extractPackageDependencies(packageData) {
     }
     return undefined;
 }
-function processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePackages, manifests) {
+function processDependencyEntries(deps, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages) {
     const dependencies = [];
     const depsEntries = Object.entries(deps);
     for (const [packageName, versionSpec] of depsEntries) {
         try {
-            const dependency = processSingleDependency(packageName, versionSpec, sourceNodeName, index, ctx, workspacePackages, manifests);
+            const dependency = processSingleDependency(packageName, versionSpec, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages);
             if (dependency) {
                 dependencies.push(dependency);
             }
@@ -650,7 +663,7 @@ function processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePac
     }
     return dependencies;
 }
-function processSingleDependency(packageName, versionSpec, sourceNodeName, index, ctx, workspacePackages, manifests) {
+function processSingleDependency(packageName, versionSpec, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages) {
     if (typeof packageName !== 'string' || typeof versionSpec !== 'string') {
         return null;
     }
@@ -663,14 +676,22 @@ function processSingleDependency(packageName, versionSpec, sourceNodeName, index
     }
     let targetPackageName = packageName;
     let targetVersion = versionSpec;
-    const aliasTarget = resolveAliasTarget(versionSpec);
-    if (aliasTarget) {
+    // A "<parent>/<name>" entry records what this parent actually resolved the
+    // dependency to. Overrides scoped to a parent (bun.lock v3) can pick a
+    // version outside the declared range, so it takes precedence over matching
+    // the range against the versions in the lockfile.
+    const nestedVersion = resolveNestedVersion(sourcePackageKey, packageName, lockFile);
+    const aliasTarget = nestedVersion ? null : resolveAliasTarget(versionSpec);
+    if (nestedVersion) {
+        targetVersion = nestedVersion;
+    }
+    else if (aliasTarget) {
         targetPackageName = aliasTarget.packageName;
         targetVersion = aliasTarget.version;
     }
     else {
         // O(1) lookup using index instead of O(n) scan
-        const resolvedVersion = findResolvedVersion(packageName, versionSpec, index, manifests);
+        const resolvedVersion = findResolvedVersion(packageName, versionSpec, index, lockFile.manifests);
         if (!resolvedVersion) {
             return null;
         }
@@ -693,6 +714,18 @@ function processSingleDependency(packageName, versionSpec, sourceNodeName, index
         return null;
     }
 }
+function resolveNestedVersion(sourcePackageKey, packageName, lockFile) {
+    const nestedEntry = lockFile.packages[`${sourcePackageKey}/${packageName}`];
+    if (!Array.isArray(nestedEntry) || typeof nestedEntry[0] !== 'string') {
+        return null;
+    }
+    const { name, version } = getCachedSpecInfo(nestedEntry[0]);
+    // aliases ("alias@npm:real@1.0.0") are resolved to the real package by the caller
+    if (name !== packageName || !version || version.startsWith('npm:')) {
+        return null;
+    }
+    return version;
+}
 function resolveTargetNodeName(targetPackageName, targetVersion, ctx) {
     const hoistedNodeName = `npm:${targetPackageName}`;
     const versionedNodeName = `npm:${targetPackageName}@${targetVersion}`;