nx 23.1.1 → 23.1.2

package/dist/src/utils/safe-spawn.d.ts

@@ -0,0 +1,24 @@
+import { ChildProcess, ExecFileSyncOptions, SpawnOptions } from 'child_process';
+/**
+ * Spawn a binary that may be a Windows `.cmd`/`.bat` shim, without letting its
+ * arguments become shell syntax.
+ *
+ * Off Windows, and for a `.exe`, no shell is involved at all. Where one is —
+ * a shim or a bare name — the binary and every argument are quoted for cmd.exe.
+ *
+ * Not a complete guarantee: cmd.exe expands `%VAR%` in the binary or any
+ * argument whether or not it is quoted, so a caller with untrusted arguments
+ * inherits that gap (NXC-4798). See the note on `LINE_BREAK` above.
+ *
+ * @throws on Windows when the binary or an argument contains a line break, or a
+ * literal `"` (via `quoteShellArg`). Those are the only refusals — the `%`
+ * expansion above is not one of them.
+ */
+export declare function safeSpawn(binary: string, args: readonly string[], options?: Omit<SpawnOptions, 'shell'>): ChildProcess;
+/**
+ * Synchronous {@link safeSpawn}, returning the child's stdout.
+ *
+ * Carries the same Windows caveats: `%VAR%` is expanded quoted or not
+ * (NXC-4798), and a line break or literal `"` throws.
+ */
+export declare function safeExecFileSync(binary: string, args: readonly string[], options?: Omit<ExecFileSyncOptions, 'encoding' | 'shell'>): string;

package/dist/src/utils/safe-spawn.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeSpawn = safeSpawn;
+exports.safeExecFileSync = safeExecFileSync;
+const child_process_1 = require("child_process");
+const path_1 = require("path");
+const shell_quoting_1 = require("./shell-quoting");
+// Node refuses to launch a Windows `.cmd`/`.bat` shim without a shell
+// (CVE-2024-27980). A bare name takes the shell for the same reason, one step
+// removed: libuv walks PATH and PATHEXT itself, so no shell is needed to *find*
+// the binary — but the walk may land on a `.cmd`/`.bat`, and this cannot know
+// which in advance, so it is deliberately conservative. Everything else,
+// including a `.exe`, spawns directly, so the shell and the quoting below reach
+// only the invocations that cannot do without them.
+//
+// Deliberately a function: a module-level const is fixed at import time, which
+// would make the Windows branch untestable.
+function needsShell(binary) {
+    if (process.platform !== 'win32') {
+        return false;
+    }
+    // win32.extname, not the platform default: this branch only runs on Windows,
+    // where `path` is win32 anyway, and pinning it lets a test model the real
+    // parse rather than posix's (which reads `C:\ws\my.app\gradlew` as `.app\gradlew`).
+    const ext = path_1.win32.extname(binary).toLowerCase();
+    return ext === '' || ext === '.cmd' || ext === '.bat';
+}
+// A line break ends the command line whatever the quoting, so nothing can carry
+// one.
+//
+// `%` is deliberately NOT refused, and this is a known gap rather than a safe
+// case. cmd.exe expands `%VAR%` whether or not the value is quoted — see
+// `quoteShellArg`'s own docstring in ./shell-quoting, which says so and pins it
+// with a test — so quoting contains nothing here. It applies to the binary path
+// as much as to the arguments, and an expansion yielding a `"` defeats the
+// literal-quote refusal below, because that inspects the pre-expansion bytes.
+// `bin/nx.ts` loads the workspace's own `.env` before the graph is built, so a
+// repo can set the variable too.
+//
+// Refusing `%` is what an earlier revision did, and it made any workspace under
+// a `%` path — a legal Windows directory name — fail graph construction. The gap
+// is bounded by the argument that bounds this whole class: a repo that can reach
+// here already has `mvnw` / `pom.xml` executing on its behalf. Closing it
+// properly is tracked as NXC-4798.
+const LINE_BREAK = /[\r\n]/;
+/**
+ * Spawn a binary that may be a Windows `.cmd`/`.bat` shim, without letting its
+ * arguments become shell syntax.
+ *
+ * Off Windows, and for a `.exe`, no shell is involved at all. Where one is —
+ * a shim or a bare name — the binary and every argument are quoted for cmd.exe.
+ *
+ * Not a complete guarantee: cmd.exe expands `%VAR%` in the binary or any
+ * argument whether or not it is quoted, so a caller with untrusted arguments
+ * inherits that gap (NXC-4798). See the note on `LINE_BREAK` above.
+ *
+ * @throws on Windows when the binary or an argument contains a line break, or a
+ * literal `"` (via `quoteShellArg`). Those are the only refusals — the `%`
+ * expansion above is not one of them.
+ */
+function safeSpawn(binary, args, options = {}) {
+    const shell = needsShell(binary);
+    return (0, child_process_1.spawn)(quoteBinary(binary, shell), quoteArgs(args, shell), {
+        ...options,
+        windowsHide: true,
+        shell,
+    });
+}
+/**
+ * Synchronous {@link safeSpawn}, returning the child's stdout.
+ *
+ * Carries the same Windows caveats: `%VAR%` is expanded quoted or not
+ * (NXC-4798), and a line break or literal `"` throws.
+ */
+function safeExecFileSync(binary, args, options = {}) {
+    const shell = needsShell(binary);
+    return (0, child_process_1.execFileSync)(quoteBinary(binary, shell), quoteArgs(args, shell), {
+        stdio: 'pipe',
+        ...options,
+        windowsHide: true,
+        shell,
+        encoding: 'utf-8',
+    });
+}
+// The binary needs quoting too: Node joins it into the same command line, so a
+// path holding a space or an `&` would split there.
+function quoteBinary(binary, shell) {
+    if (!shell) {
+        return binary;
+    }
+    return quoteForCmd(binary, `the path ${JSON.stringify(binary)}`);
+}
+function quoteForCmd(value, described, remedy = '') {
+    if (LINE_BREAK.test(value)) {
+        throw new Error(`Cannot pass ${described} to cmd.exe: a line break inside it would end the command line before cmd.exe reached the rest of it.${remedy}`);
+    }
+    return (0, shell_quoting_1.quoteShellArg)(value);
+}
+function quoteArgs(args, shell) {
+    if (!shell) {
+        return [...args];
+    }
+    return args.map((arg) => quoteForCmd(arg, `the argument ${JSON.stringify(arg)}`, ' Remove it from your Nx configuration and try again.'));
+}

package/dist/src/utils/shell-quoting.d.ts

@@ -8,3 +8,18 @@ export declare function needsShellQuoting(str: string): boolean;
  * Check if a string is already wrapped in matching quotes (single or double).
  */
 export declare function isAlreadyQuoted(str: string): boolean;
+/**
+ * Quote a string so it survives being interpolated into a shell command line
+ * as a single argument.
+ *
+ * On Windows the safety boundary is one unbroken double-quoted run: it keeps
+ * `^`, `&`, `|`, `<` and `>` literal through cmd.exe's parse and a `.cmd`
+ * shim's re-parse of `%*`, but not `%`, which cmd.exe expands inside double
+ * quotes too.
+ *
+ * @throws on Windows when the argument contains a double quote, which ends that
+ * run, since cmd.exe recognizes no backslash escape. Carrying one means
+ * caret-escaping every metacharacter instead, doubled for a `.cmd` shim, which
+ * this path does not implement.
+ */
+export declare function quoteShellArg(arg: string): string;

package/dist/src/utils/shell-quoting.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.needsShellQuoting = needsShellQuoting;
 exports.isAlreadyQuoted = isAlreadyQuoted;
+exports.quoteShellArg = quoteShellArg;
 /**
  * Shell metacharacters that have special meaning and require quoting.
  *
@@ -39,3 +40,37 @@ function isAlreadyQuoted(str) {
         ((str[0] === "'" && str[str.length - 1] === "'") ||
             (str[0] === '"' && str[str.length - 1] === '"')));
 }
+/**
+ * Quote a string so it survives being interpolated into a shell command line
+ * as a single argument.
+ *
+ * On Windows the safety boundary is one unbroken double-quoted run: it keeps
+ * `^`, `&`, `|`, `<` and `>` literal through cmd.exe's parse and a `.cmd`
+ * shim's re-parse of `%*`, but not `%`, which cmd.exe expands inside double
+ * quotes too.
+ *
+ * @throws on Windows when the argument contains a double quote, which ends that
+ * run, since cmd.exe recognizes no backslash escape. Carrying one means
+ * caret-escaping every metacharacter instead, doubled for a `.cmd` shim, which
+ * this path does not implement.
+ */
+function quoteShellArg(arg) {
+    const isWindows = process.platform === 'win32';
+    if (isWindows && arg.includes('"')) {
+        throw new Error(`Cannot safely pass ${arg} to cmd.exe as a single argument: a double quote inside it would end the quoting and leave the rest of the argument to be read as commands. Remove the double quote and run the command again.`);
+    }
+    if (arg === '') {
+        // an unquoted empty string would vanish when joined into a command line
+        return isWindows ? '""' : "''";
+    }
+    // `^` is cmd.exe syntax rather than shell syntax, so it earns quoting only
+    // where cmd.exe parses the command line.
+    if (!needsShellQuoting(arg) && !(isWindows && arg.includes('^'))) {
+        return arg;
+    }
+    return isWindows
+        ? // MSVCRT reads the backslashes that precede the closing quote as escapes,
+            // so they have to be doubled to survive as themselves.
+            `"${arg.replace(/(\\+)$/, '$1$1')}"`
+        : `'${arg.replace(/'/g, `'\\''`)}'`;
+}

package/dist/src/utils/wait-for-socket-connection.d.ts

@@ -12,4 +12,15 @@ export declare function waitForSocketConnection(socketPath: string | (() => stri
     signal?: AbortSignal;
     maxAttempts?: number;
     delayMs?: number;
+    /**
+     * Called with the errno of each failed connect and the path it was made
+     * against. Return `true` to stop polling: a permission refusal does not
+     * heal by retrying, and without a way out the caller waits the full budget
+     * and then cannot say why.
+     *
+     * The path is passed rather than left to the caller to recompute — with a
+     * resolver it can differ per attempt, and the caller that reports the
+     * refusal may no longer be able to resolve one at all.
+     */
+    onConnectError?: (error: NodeJS.ErrnoException, socketPath: string) => boolean | void;
 }): Promise<Socket | null>;

package/dist/src/utils/wait-for-socket-connection.js

@@ -26,9 +26,15 @@ async function waitForSocketConnection(socketPath, options) {
             return null;
         const path = typeof socketPath === 'function' ? socketPath() : socketPath;
         if (path) {
-            const socket = await tryConnect(path);
-            if (socket) {
-                return socket;
+            const result = await tryConnect(path);
+            if (result.socket) {
+                return result.socket;
+            }
+            // The caller may need the errno this attempt produced — a refused
+            // connection is reported very differently from a socket that is not
+            // there yet, and polling past it only delays the same answer.
+            if (result.error && options?.onConnectError?.(result.error, path)) {
+                return null;
             }
         }
         attempts++;
@@ -39,15 +45,15 @@ function tryConnect(socketPath) {
     return new Promise((resolve) => {
         try {
             const socket = (0, net_1.connect)(socketPath, () => {
-                resolve(socket);
+                resolve({ socket });
             });
-            socket.once('error', () => {
+            socket.once('error', (error) => {
                 socket.destroy();
-                resolve(null);
+                resolve({ error });
             });
         }
-        catch {
-            resolve(null);
+        catch (error) {
+            resolve({ error: error });
         }
     });
 }

package/migrations.json

@@ -184,6 +184,12 @@
       "version": "23.0.0-beta.18",
       "description": "Adds .nx/migrate-runs to .gitignore",
       "implementation": "./dist/src/migrations/update-23-0-0/add-migrate-runs-to-git-ignore"
+    },
+    "23-2-0-set-cache-on-executor-target-defaults": {
+      "version": "23.2.0-beta.8",
+      "description": "Sets \"cache\" on some executor-based target defaults whose caching was previously enabled by a target name default, maintaining compatibility with how cacheability resolved before Nx 23. Keys the migration cannot decide are left alone and keep working through a deprecated runtime fallback.",
+      "implementation": "./dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults",
+      "documentation": "./dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults.md"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "23.1.1",
+  "version": "23.1.2",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -65,7 +65,7 @@
     "balanced-match": "4.0.3",
     "base64-js": "1.5.1",
     "bl": "4.1.0",
-    "brace-expansion": "5.0.8",
+    "brace-expansion": "5.0.9",
     "buffer": "5.7.1",
     "bundle-name": "4.1.0",
     "call-bind-apply-helpers": "1.0.2",
@@ -181,16 +181,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "23.1.1",
-    "@nx/nx-darwin-x64": "23.1.1",
-    "@nx/nx-freebsd-x64": "23.1.1",
-    "@nx/nx-linux-arm-gnueabihf": "23.1.1",
-    "@nx/nx-linux-arm64-gnu": "23.1.1",
-    "@nx/nx-linux-arm64-musl": "23.1.1",
-    "@nx/nx-linux-x64-gnu": "23.1.1",
-    "@nx/nx-linux-x64-musl": "23.1.1",
-    "@nx/nx-win32-arm64-msvc": "23.1.1",
-    "@nx/nx-win32-x64-msvc": "23.1.1"
+    "@nx/nx-darwin-arm64": "23.1.2",
+    "@nx/nx-darwin-x64": "23.1.2",
+    "@nx/nx-freebsd-x64": "23.1.2",
+    "@nx/nx-linux-arm-gnueabihf": "23.1.2",
+    "@nx/nx-linux-arm64-gnu": "23.1.2",
+    "@nx/nx-linux-arm64-musl": "23.1.2",
+    "@nx/nx-linux-x64-gnu": "23.1.2",
+    "@nx/nx-linux-x64-musl": "23.1.2",
+    "@nx/nx-win32-arm64-msvc": "23.1.2",
+    "@nx/nx-win32-x64-msvc": "23.1.2"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",

package/dist/src/utils/min-release-age/npmrc.d.ts

@@ -1,15 +0,0 @@
-export interface NpmrcEntry {
-    key: string;
-    value: string;
-}
-/**
- * Parses an .npmrc file into its `key = value` entries the way npm/npm-conf do:
- * skip blank lines and `#`/`;` comments, split on the first `=`, and trim both
- * sides. The value is returned raw (quote stripping is the caller's concern).
- * Returns null when the file is missing or unreadable so callers can distinguish
- * "no file" from "file with no relevant keys". Shared by the npm and pnpm
- * cooldown readers.
- */
-export declare function readNpmrcEntries(path: string): NpmrcEntry[] | null;
-/** The parsing half of {@link readNpmrcEntries}, usable without a filesystem. */
-export declare function parseNpmrcContent(raw: string): NpmrcEntry[];

package/dist/src/utils/min-release-age/npmrc.js

@@ -1,45 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readNpmrcEntries = readNpmrcEntries;
-exports.parseNpmrcContent = parseNpmrcContent;
-const fs_1 = require("fs");
-/**
- * Parses an .npmrc file into its `key = value` entries the way npm/npm-conf do:
- * skip blank lines and `#`/`;` comments, split on the first `=`, and trim both
- * sides. The value is returned raw (quote stripping is the caller's concern).
- * Returns null when the file is missing or unreadable so callers can distinguish
- * "no file" from "file with no relevant keys". Shared by the npm and pnpm
- * cooldown readers.
- */
-function readNpmrcEntries(path) {
-    if (!(0, fs_1.existsSync)(path)) {
-        return null;
-    }
-    let raw;
-    try {
-        raw = (0, fs_1.readFileSync)(path, 'utf-8');
-    }
-    catch {
-        return null;
-    }
-    return parseNpmrcContent(raw);
-}
-/** The parsing half of {@link readNpmrcEntries}, usable without a filesystem. */
-function parseNpmrcContent(raw) {
-    const entries = [];
-    for (const line of raw.split(/\r?\n/)) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';')) {
-            continue;
-        }
-        const eq = trimmed.indexOf('=');
-        if (eq === -1) {
-            continue;
-        }
-        entries.push({
-            key: trimmed.slice(0, eq).trim(),
-            value: trimmed.slice(eq + 1).trim(),
-        });
-    }
-    return entries;
-}