nx 23.1.1 → 23.1.3

package/dist/src/native/index.d.ts

@@ -412,6 +412,16 @@ export declare function getEventDimensions(): EventDimensions
  */
 export declare function getFilesForOutputsBatch(directory: string, entriesBatch: Array<Array<string>>): Array<Array<string>>
 
+/**
+ * The same list, for JavaScript callers that walk a tree rather than the
+ * filesystem - `visitNotIgnoredFiles` - so both sides apply one baseline
+ * instead of maintaining a second copy that drifts.
+ *
+ * The patterns are gitignore-shaped, so they read the same to the `ignore`
+ * crate here and the `ignore` npm package there.
+ */
+export declare function getHardcodedIgnorePatterns(): Array<string>
+
 /**
  * If `workspace_root` is inside a git worktree, returns the main repo root.
  * Returns `None` when already in the main repo (or not in a git repo at all).

package/dist/src/native/index.js

@@ -1,15 +1,11 @@
 const { join, basename } = require('path');
-const {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-} = require('fs');
+const { copyFileSync, renameSync, statSync, unlinkSync } = require('fs');
+const { createHash } = require('crypto');
 const Module = require('module');
 const { nxVersion } = require('../utils/versions');
-const { getNativeFileCacheLocation } = require('./native-file-cache-location');
+const {
+  ensureSecureNativeFileCacheLocation,
+} = require('./native-file-cache-location');
 
 const MAX_COPY_RETRIES = 3;
 
@@ -73,6 +69,14 @@ function statsOrNull(path) {
   }
 }
 
+function removeIfPresent(path) {
+  try {
+    unlinkSync(path);
+  } catch {
+    // Ignore cleanup errors
+  }
+}
+
 function isNoExecError(e) {
   return e.code === 'EACCES' || e.code === 'EPERM';
 }
@@ -95,20 +99,44 @@ Module._load = function (request, parent, isMain) {
     const nativeLocation = require.resolve(modulePath);
     const fileName = basename(nativeLocation);
 
-    // we copy the file to a workspace-scoped tmp directory and prefix with nxVersion to avoid stale files being loaded
-    const nativeFileCacheLocation = getNativeFileCacheLocation();
+    // null when the cache dir cannot be created *and trusted*; loading in place
+    // from node_modules is safer than loading out of a directory we don't own.
+    const nativeFileCacheLocation = ensureSecureNativeFileCacheLocation();
+    if (!nativeFileCacheLocation) {
+      return originalLoad.apply(this, [nativeLocation, parent, isMain]);
+    }
+
+    // nxVersion alone is not enough: in a source checkout it is the placeholder
+    // 0.0.1 for every worktree, so hashing the resolved binding path keeps each
+    // checkout in its own entry.
+    const cacheKey =
+      nxVersion +
+      '-' +
+      createHash('sha256')
+        .update(nativeLocation)
+        .digest('hex')
+        .substring(0, 12);
+
     // This is a path to copy to, not the one that gets loaded
     const tmpTmpFile = join(
       nativeFileCacheLocation,
-      nxVersion + '-' + Math.random() + fileName
+      cacheKey + '-' + Math.random() + fileName
     );
     // This is the path that will get loaded
-    const tmpFile = join(nativeFileCacheLocation, nxVersion + '-' + fileName);
-    const expectedFileSize = statSync(nativeLocation).size;
+    const tmpFile = join(nativeFileCacheLocation, cacheKey + '-' + fileName);
+    const sourceStats = statSync(nativeLocation);
+    const expectedFileSize = sourceStats.size;
     const existingFileStats = statsOrNull(tmpFile);
 
-    // If the file to be loaded already exists, just load it
-    if (existingFileStats?.size === expectedFileSize) {
+    // Size alone does not detect a rebuilt binding: a small Rust edit routinely
+    // produces a byte-identical size. The copy is taken after the build, so a
+    // cache entry older than the source means the source was rebuilt since.
+    const isFresh =
+      existingFileStats?.size === expectedFileSize &&
+      existingFileStats.mtimeMs >= sourceStats.mtimeMs;
+
+    // If the file to be loaded already exists and is current, just load it
+    if (isFresh) {
       try {
         return originalLoad.apply(this, [tmpFile, parent, isMain]);
       } catch (e) {
@@ -119,20 +147,36 @@ Module._load = function (request, parent, isMain) {
         throw e;
       }
     }
-    if (!existsSync(nativeFileCacheLocation)) {
-      mkdirSync(nativeFileCacheLocation, { recursive: true });
-    }
 
     // Retry copying up to 3 times, validating after each copy
+    let attemptsMade = 0;
+    let cacheError = null;
     for (let attempt = 1; attempt <= MAX_COPY_RETRIES; attempt++) {
+      attemptsMade = attempt;
       // First copy to a unique location for each process
-      copyFileSync(nativeLocation, tmpTmpFile);
+      try {
+        copyFileSync(nativeLocation, tmpTmpFile);
+      } catch (e) {
+        // Permission errors won't heal on retry, and a throwing copy can still
+        // have left a partial file behind.
+        cacheError = e;
+        removeIfPresent(tmpTmpFile);
+        break;
+      }
 
       // Validate the copy - check file size matches expected
       const copiedFileStats = statsOrNull(tmpTmpFile);
       if (copiedFileStats?.size === expectedFileSize) {
         // Copy succeeded, rename to final location and load
-        renameSync(tmpTmpFile, tmpFile);
+        try {
+          renameSync(tmpTmpFile, tmpFile);
+        } catch (e) {
+          // Unguarded, this throws out of `require` and native-bindings.js
+          // reports it as a missing optional dependency, which it is not.
+          cacheError = e;
+          removeIfPresent(tmpTmpFile);
+          break;
+        }
         try {
           return originalLoad.apply(this, [tmpFile, parent, isMain]);
         } catch (e) {
@@ -145,16 +189,15 @@ Module._load = function (request, parent, isMain) {
       }
 
       // Copy failed validation, clean up the malformed file
-      try {
-        unlinkSync(tmpTmpFile);
-      } catch {
-        // Ignore cleanup errors
-      }
+      removeIfPresent(tmpTmpFile);
     }
 
-    // All retries failed - warn and load from original location
+    // Name the errno: ENOSPC, EROFS, EACCES and EDQUOT are all actionable and
+    // otherwise indistinguishable.
     console.warn(
-      `Warning: Failed to copy native module to cache after ${MAX_COPY_RETRIES} attempts. ` +
+      `Warning: Failed to copy native module to cache after ${attemptsMade} attempt${
+        attemptsMade === 1 ? '' : 's'
+      }${cacheError ? ` (${cacheError.code ?? cacheError.message})` : ''}. ` +
         `Loading from original location instead. ` +
         `This may cause file locking issues on Windows.`
     );

package/dist/src/native/native-bindings.js

@@ -610,6 +610,7 @@ module.exports.getBinaryTarget = nativeBinding.getBinaryTarget
 module.exports.getDefaultMaxCacheSize = nativeBinding.getDefaultMaxCacheSize
 module.exports.getEventDimensions = nativeBinding.getEventDimensions
 module.exports.getFilesForOutputsBatch = nativeBinding.getFilesForOutputsBatch
+module.exports.getHardcodedIgnorePatterns = nativeBinding.getHardcodedIgnorePatterns
 module.exports.getMainWorktreeRoot = nativeBinding.getMainWorktreeRoot
 module.exports.getTransformableOutputs = nativeBinding.getTransformableOutputs
 module.exports.GroupType = nativeBinding.GroupType

package/dist/src/native/native-file-cache-location.d.ts

@@ -1 +1,17 @@
-export declare function getNativeFileCacheLocation(): string;
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+export declare const NATIVE_CACHE_ROOT: string;
+export declare function getNativeFileCacheLocationToDelete(): string | null;
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+export declare function ensureSecureNativeFileCacheLocation(cacheRoot?: string): string | null;

package/dist/src/native/native-file-cache-location.js

@@ -1,23 +1,97 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNativeFileCacheLocation = getNativeFileCacheLocation;
-const os_1 = require("os");
+exports.NATIVE_CACHE_ROOT = void 0;
+exports.getNativeFileCacheLocationToDelete = getNativeFileCacheLocationToDelete;
+exports.ensureSecureNativeFileCacheLocation = ensureSecureNativeFileCacheLocation;
 const path_1 = require("path");
-const crypto_1 = require("crypto");
-const workspace_root_1 = require("../utils/workspace-root");
+const fs_1 = require("fs");
+const nx_tmp_dir_1 = require("../utils/nx-tmp-dir");
 const versions_1 = require("../utils/versions");
-function getNativeFileCacheLocation() {
-    if (process.env.NX_NATIVE_FILE_CACHE_DIRECTORY) {
-        return process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+const owned_private_dir_1 = require("../utils/owned-private-dir");
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+exports.NATIVE_CACHE_ROOT = (0, path_1.join)(nx_tmp_dir_1.NX_USER_TMP_DIR, 'native-cache');
+/**
+ * The configured cache dir, normalized. `resolve` strips a trailing slash, which
+ * would otherwise defeat the guards downstream: `lstat` on a path ending in `/`
+ * resolves a symlink rather than reporting it, and `O_NOFOLLOW` then opens the
+ * target. `NX_SOCKET_DIR` is normalized for the same reason.
+ */
+function configuredCacheDir() {
+    const dir = process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+    return dir ? (0, path_1.resolve)(dir) : undefined;
+}
+function getNativeFileCacheLocationToDelete() {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        // Checked for ownership before it is handed to a recursive delete: being
+        // configured does not make it ours. Weaker than the load path below, which
+        // also enforces mode and validates the version directory.
+        return (0, owned_private_dir_1.isOwnedRealDirectory)(configured) ? configured : null;
     }
-    else {
-        const hash = (0, crypto_1.createHash)('sha256').update(workspace_root_1.workspaceRoot).update(versions_1.nxVersion);
+    return (0, owned_private_dir_1.isSafeSharedRoot)(nx_tmp_dir_1.NX_TMP_DIR).status === 'ok' &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(nx_tmp_dir_1.NX_USER_TMP_DIR) &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(exports.NATIVE_CACHE_ROOT)
+        ? (0, path_1.join)(exports.NATIVE_CACHE_ROOT, versions_1.nxVersion)
+        : null;
+}
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+function ensureSecureNativeFileCacheLocation(
+// Test seam: lets a spec plant a hostile directory under a root it controls.
+cacheRoot = exports.NATIVE_CACHE_ROOT) {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        const dir = configured;
         try {
-            hash.update((0, os_1.userInfo)().username);
+            // Held to the same 0700 bar as the default location: a `.node` is loaded
+            // out of here. Unlike NX_SOCKET_DIR it is not additionally refused for
+            // naming one of Nx's own roots, which is the only case that throws.
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(dir), { recursive: true });
+            const established = (0, owned_private_dir_1.ensureOwnedPrivateDir)(dir);
+            if (established.status !== 'ok') {
+                // The guard's own reason rather than a fixed sentence: `not-created
+                // (EACCES)` and `foreign-owner` are exactly what the catch below
+                // promises to tell apart, and one string for all of them cannot.
+                throw new owned_private_dir_1.DirectoryRefusedError(established.refusal);
+            }
+            return dir;
         }
         catch (e) {
-            // if there's no user, we only use the workspace root for the hash and move on
+            // Never discard a configured directory silently — the socket directory
+            // follows the same rule. A typo, EACCES or EROFS is otherwise
+            // indistinguishable from a working cache.
+            console.warn(`Nx could not use the configured native file cache directory ${dir} (${e?.code ?? e?.message ?? e}). Loading the native binding in place instead.`);
+            return null;
+        }
+    }
+    const userRoot = (0, path_1.dirname)(cacheRoot);
+    const sharedRoot = (0, path_1.dirname)(userRoot);
+    // Outermost first: the stable shared container must either belong to root or
+    // to us, and must be sticky if peers can write there. The uid directory then
+    // becomes the owner-only boundary for sockets and native-cache alike.
+    if ((0, owned_private_dir_1.ensureSafeSharedRoot)(sharedRoot).status !== 'ok') {
+        return null;
+    }
+    for (const root of [userRoot, cacheRoot]) {
+        if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(root).status !== 'ok') {
+            return null;
         }
-        return (0, path_1.join)((0, os_1.tmpdir)(), `nx-native-file-cache-${hash.digest('hex').substring(0, 7)}`);
     }
+    // Verified, not assumed: this is the directory we load a `.node` out of.
+    const versionDir = (0, path_1.join)(cacheRoot, versions_1.nxVersion);
+    if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(versionDir).status !== 'ok') {
+        return null;
+    }
+    return versionDir;
 }

package/dist/src/nx-cloud/utilities/get-cloud-options.js

@@ -5,12 +5,15 @@ exports.getCloudUrl = getCloudUrl;
 exports.removeTrailingSlash = removeTrailingSlash;
 exports.isNxCloudId = isNxCloudId;
 const nx_json_1 = require("../../config/nx-json");
-const run_command_1 = require("../../tasks-runner/run-command");
 const workspace_root_1 = require("../../utils/workspace-root");
 function getCloudOptions(directory = workspace_root_1.workspaceRoot) {
+    // Required lazily: this module is reachable from the @nx/devkit/internal
+    // barrel that plugin workers load, and run-command eagerly pulls in the whole
+    // task-execution subsystem.
+    const { getRunnerOptions, } = require('../../tasks-runner/run-command');
     const nxJson = (0, nx_json_1.readNxJson)(directory);
     // TODO: The default is not always cloud? But it's not handled at the moment
-    return (0, run_command_1.getRunnerOptions)('default', nxJson, {}, true);
+    return getRunnerOptions('default', nxJson, {}, true);
 }
 function getCloudUrl() {
     return removeTrailingSlash(process.env.NX_CLOUD_API || process.env.NRWL_API || `https://cloud.nx.app`);

package/dist/src/nx-cloud/utilities/onboarding.js

@@ -5,7 +5,6 @@ exports.getNxCloudAppOnBoardingUrl = getNxCloudAppOnBoardingUrl;
 exports.readNxCloudToken = readNxCloudToken;
 const is_workspace_claimed_1 = require("./is-workspace-claimed");
 const url_shorten_1 = require("./url-shorten");
-const run_command_1 = require("../../tasks-runner/run-command");
 const nx_json_1 = require("../../generators/utils/nx-json");
 async function createNxCloudOnboardingURLForWelcomeApp(tree, token) {
     token = token || readNxCloudToken(tree);
@@ -22,7 +21,11 @@ async function getNxCloudAppOnBoardingUrl(token) {
     return onboardingUrl;
 }
 function readNxCloudToken(tree) {
+    // Required lazily: this module is re-exported from the @nx/devkit/internal
+    // barrel that plugin workers load, and run-command eagerly pulls in the whole
+    // task-execution subsystem.
+    const { getRunnerOptions, } = require('../../tasks-runner/run-command');
     const nxJson = (0, nx_json_1.readNxJson)(tree);
-    const { accessToken, nxCloudId } = (0, run_command_1.getRunnerOptions)('default', nxJson, {}, true);
+    const { accessToken, nxCloudId } = getRunnerOptions('default', nxJson, {}, true);
     return accessToken || nxCloudId;
 }

package/dist/src/plugins/js/lock-file/bun-parser.js

@@ -12,6 +12,16 @@ const project_graph_1 = require("../../../config/project-graph");
 const file_hasher_1 = require("../../../hasher/file-hasher");
 const project_graph_builder_1 = require("../../../project-graph/project-graph-builder");
 const json_1 = require("../../../utils/json");
+// Highest bun.lock version this parser has been verified against:
+// - 1: workspace packages are no longer listed with their dependencies
+// - 2: identical content, stricter validation in Bun's own reader
+// - 3: values in "overrides" may be objects holding rules scoped to a parent
+//      package (`"parent": { "child": "1.0.0" }`) and keys may carry a version
+//      selector (`"parent@1"`, `"child@<2"`). This parser never reads
+//      "overrides"; the resolved packages are listed in "packages" as before.
+// Newer versions are parsed on a best-effort basis instead of being rejected
+// outright.
+const MAX_KNOWN_LOCKFILE_VERSION = 3;
 const DEPENDENCY_TYPES = [
     'dependencies',
     'devDependencies',
@@ -356,9 +366,12 @@ function parseLockFile(lockFileContent, lockFileHash) {
             if (typeof result.lockfileVersion !== 'number') {
                 throw new Error(`Lockfile version must be a number, got ${typeof result.lockfileVersion}`);
             }
-            const supportedVersions = [0, 1];
-            if (!supportedVersions.includes(result.lockfileVersion)) {
-                throw new Error(`Unsupported lockfile version ${result.lockfileVersion}. Supported versions: ${supportedVersions.join(', ')}`);
+            if (!Number.isInteger(result.lockfileVersion) ||
+                result.lockfileVersion < 0) {
+                throw new Error(`Unsupported lockfile version ${result.lockfileVersion}. Lockfile version must be a non-negative integer`);
+            }
+            if (result.lockfileVersion > MAX_KNOWN_LOCKFILE_VERSION) {
+                console.warn(`bun.lock has lockfileVersion ${result.lockfileVersion}, which is newer than the version ${MAX_KNOWN_LOCKFILE_VERSION} this version of Nx was tested with. Attempting to parse it anyway.`);
             }
         }
         if (!result.packages || typeof result.packages !== 'object') {
@@ -616,7 +629,7 @@ function processPackageForDependencies(packageKey, packageData, lockFile, index,
         const deps = packageDependencies[depType];
         if (!deps || typeof deps !== 'object')
             continue;
-        const depDependencies = processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePackages, lockFile.manifests);
+        const depDependencies = processDependencyEntries(deps, packageKey, sourceNodeName, lockFile, index, ctx, workspacePackages);
         dependencies.push(...depDependencies);
     }
     return dependencies;
@@ -634,12 +647,12 @@ function extractPackageDependencies(packageData) {
     }
     return undefined;
 }
-function processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePackages, manifests) {
+function processDependencyEntries(deps, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages) {
     const dependencies = [];
     const depsEntries = Object.entries(deps);
     for (const [packageName, versionSpec] of depsEntries) {
         try {
-            const dependency = processSingleDependency(packageName, versionSpec, sourceNodeName, index, ctx, workspacePackages, manifests);
+            const dependency = processSingleDependency(packageName, versionSpec, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages);
             if (dependency) {
                 dependencies.push(dependency);
             }
@@ -650,7 +663,7 @@ function processDependencyEntries(deps, sourceNodeName, index, ctx, workspacePac
     }
     return dependencies;
 }
-function processSingleDependency(packageName, versionSpec, sourceNodeName, index, ctx, workspacePackages, manifests) {
+function processSingleDependency(packageName, versionSpec, sourcePackageKey, sourceNodeName, lockFile, index, ctx, workspacePackages) {
     if (typeof packageName !== 'string' || typeof versionSpec !== 'string') {
         return null;
     }
@@ -663,14 +676,22 @@ function processSingleDependency(packageName, versionSpec, sourceNodeName, index
     }
     let targetPackageName = packageName;
     let targetVersion = versionSpec;
-    const aliasTarget = resolveAliasTarget(versionSpec);
-    if (aliasTarget) {
+    // A "<parent>/<name>" entry records what this parent actually resolved the
+    // dependency to. Overrides scoped to a parent (bun.lock v3) can pick a
+    // version outside the declared range, so it takes precedence over matching
+    // the range against the versions in the lockfile.
+    const nestedVersion = resolveNestedVersion(sourcePackageKey, packageName, lockFile);
+    const aliasTarget = nestedVersion ? null : resolveAliasTarget(versionSpec);
+    if (nestedVersion) {
+        targetVersion = nestedVersion;
+    }
+    else if (aliasTarget) {
         targetPackageName = aliasTarget.packageName;
         targetVersion = aliasTarget.version;
     }
     else {
         // O(1) lookup using index instead of O(n) scan
-        const resolvedVersion = findResolvedVersion(packageName, versionSpec, index, manifests);
+        const resolvedVersion = findResolvedVersion(packageName, versionSpec, index, lockFile.manifests);
         if (!resolvedVersion) {
             return null;
         }
@@ -693,6 +714,18 @@ function processSingleDependency(packageName, versionSpec, sourceNodeName, index
         return null;
     }
 }
+function resolveNestedVersion(sourcePackageKey, packageName, lockFile) {
+    const nestedEntry = lockFile.packages[`${sourcePackageKey}/${packageName}`];
+    if (!Array.isArray(nestedEntry) || typeof nestedEntry[0] !== 'string') {
+        return null;
+    }
+    const { name, version } = getCachedSpecInfo(nestedEntry[0]);
+    // aliases ("alias@npm:real@1.0.0") are resolved to the real package by the caller
+    if (name !== packageName || !version || version.startsWith('npm:')) {
+        return null;
+    }
+    return version;
+}
 function resolveTargetNodeName(targetPackageName, targetVersion, ctx) {
     const hoistedNodeName = `npm:${targetPackageName}`;
     const versionedNodeName = `npm:${targetPackageName}@${targetVersion}`;

package/dist/src/plugins/js/lock-file/pnpm-parser.js

@@ -12,6 +12,7 @@ const file_hasher_1 = require("../../../hasher/file-hasher");
 const catalog_1 = require("../../../utils/catalog");
 const project_graph_pruning_1 = require("./project-graph-pruning");
 const path_1 = require("path");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const get_workspace_packages_from_graph_1 = require("../utils/get-workspace-packages-from-graph");
 const semver_1 = require("semver");
 const WORKSPACE_DEP_TYPES = [
@@ -133,6 +134,17 @@ function findPatchHash(patchEntriesByPackage, packageName, version) {
     const nameOnlyMatch = entries.find((entry) => entry.versionSpecifier === null);
     return nameOnlyMatch?.hash;
 }
+// Segment-aware: `..` and `../x` escape, a directory literally named `..cache`
+// does not. Absolute targets are resolved against the workspace root.
+function linkTargetEscapesWorkspace(importerPath, depVersion) {
+    const rawTarget = depVersion.slice('link:'.length);
+    if (path_1.posix.isAbsolute(rawTarget) || (0, path_1.isAbsolute)(rawTarget)) {
+        const rel = (0, path_1.relative)(workspace_root_1.workspaceRoot, rawTarget);
+        return rel === '..' || rel.startsWith(`..${path_1.sep}`) || (0, path_1.isAbsolute)(rel);
+    }
+    const combined = path_1.posix.normalize(path_1.posix.join(importerPath === '.' ? '' : importerPath, rawTarget));
+    return combined === '..' || combined.startsWith('../');
+}
 function getNodes(data, isV5) {
     cachedInvertedRecords.clear();
     const keyMap = new Map();
@@ -345,6 +357,54 @@ function getNodes(data, isV5) {
             results[node.name] = node;
         });
     }
+    // `link:` dependencies pointing outside the workspace never appear in the
+    // packages section, so nothing above minted a node for them — and a task
+    // input naming one via `externalDependencies` fails hashing with "could not
+    // be found". Mint a node under the bare `npm:<name>`, hashed on the link
+    // path: the hash changes only when the path does, not when the linked
+    // content does, which is how linked dependencies behave everywhere else in
+    // Nx. Links that resolve inside the workspace are workspace projects, not
+    // externals, and are skipped.
+    //
+    // One node per package name, chosen deterministically by visiting importers
+    // root-first, then lexicographically. An `externalDependencies` input names
+    // a package, not a link target, so it could not distinguish two linked
+    // targets anyway.
+    const importerPaths = Object.keys(data.importers ?? {}).sort((a, b) => a === '.' ? -1 : b === '.' ? 1 : a.localeCompare(b));
+    for (const importerPath of importerPaths) {
+        const importer = data.importers[importerPath];
+        for (const depType of [
+            'dependencies',
+            'devDependencies',
+            'optionalDependencies',
+        ]) {
+            const deps = importer[depType];
+            if (!deps) {
+                continue;
+            }
+            for (const [depName, depVersion] of Object.entries(deps)) {
+                if (typeof depVersion !== 'string' || !depVersion.startsWith('link:')) {
+                    continue;
+                }
+                if (!linkTargetEscapesWorkspace(importerPath, depVersion)) {
+                    continue; // inside the workspace -> a workspace project
+                }
+                const bareName = `npm:${depName}`;
+                if (results[bareName]) {
+                    continue; // a hoisted registry version or an earlier link wins
+                }
+                results[bareName] = {
+                    type: 'npm',
+                    name: bareName,
+                    data: {
+                        version: depVersion,
+                        packageName: depName,
+                        hash: (0, file_hasher_1.hashArray)([depName, depVersion]),
+                    },
+                };
+            }
+        }
+    }
     return { nodes: results, keyMap };
 }
 function getHoistedVersion(packageName, isV5, hoistedKeysByPackage) {

package/dist/src/plugins/js/lock-file/project-graph-pruning.js

@@ -177,17 +177,23 @@ function switchNodeToHoisted(node, builder, invBuilder) {
     const sources = Object.keys(builder.graph.dependencies).filter((name) => builder.graph.dependencies[name].some((d) => d.target === previousName));
     builder.removeNode(node.name);
     invBuilder.removeNode(node.name);
-    // modify the node and re-add it
-    node.name = `npm:${node.data.packageName}`;
-    builder.addExternalNode(node);
-    invBuilder.addExternalNode(node);
+    // Re-add under the hoisted name as a new object. The node is shared by
+    // reference with the caller's graph, so renaming it in place would leave that
+    // graph with a node keyed `npm:<pkg>@<version>` but named `npm:<pkg>`, and
+    // every later prune of the same graph would fail to resolve the edge.
+    const hoistedNode = {
+        ...node,
+        name: `npm:${node.data.packageName}`,
+    };
+    builder.addExternalNode(hoistedNode);
+    invBuilder.addExternalNode(hoistedNode);
     targets.forEach((target) => {
-        builder.addStaticDependency(node.name, target);
-        invBuilder.addStaticDependency(target, node.name);
+        builder.addStaticDependency(hoistedNode.name, target);
+        invBuilder.addStaticDependency(target, hoistedNode.name);
     });
     sources.forEach((source) => {
-        builder.addStaticDependency(source, node.name);
-        invBuilder.addStaticDependency(node.name, source);
+        builder.addStaticDependency(source, hoistedNode.name);
+        invBuilder.addStaticDependency(hoistedNode.name, source);
     });
 }
 // BFS to find the shortest path to a dependency specified in package.json