nx 23.2.0-beta.0 → 23.2.0-beta.1

package/dist/src/generators/utils/nx-json.js

@@ -42,9 +42,19 @@ function updateNxJson(tree, nxJson) {
 }
 function readNxJsonExtends(tree, extendsPath) {
     try {
-        return (0, json_1.readJson)(tree, (0, path_1.relative)(tree.root, require.resolve(extendsPath, {
-            paths: [tree.root],
-        })));
+        let resolvedExtendsPath;
+        try {
+            resolvedExtendsPath = require.resolve(extendsPath, {
+                paths: [tree.root],
+            });
+        }
+        catch {
+            // Tree roots without a node_modules folder (e.g. the in-memory trees
+            // used in tests) can't anchor module resolution; fall back to
+            // resolving from the running nx package.
+            resolvedExtendsPath = require.resolve(extendsPath);
+        }
+        return (0, json_1.readJson)(tree, (0, path_1.relative)(tree.root, resolvedExtendsPath));
     }
     catch (e) {
         throw new Error(`Unable to resolve nx.json extends. Error: ${e.message}`);

package/dist/src/project-graph/file-utils.js

@@ -12,6 +12,7 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const fileutils_1 = require("../utils/fileutils");
+const git_revision_1 = require("../utils/git-revision");
 const ignore_1 = require("../utils/ignore");
 const json_diff_1 = require("../utils/json-diff");
 const workspace_root_1 = require("../utils/workspace-root");
@@ -116,11 +117,14 @@ function readLockFileAtRevision(file, lockFileName, revision, readFileAtRevision
 }
 exports.TEN_MEGABYTES = 1024 * 10000;
 function defaultReadFileAtRevision(file, revision) {
+    if (revision) {
+        (0, git_revision_1.assertValidGitRevision)(revision);
+    }
     try {
         const filePathInGitRepository = getFilePathInGitRepository(file);
         return !revision
             ? (0, fs_1.readFileSync)(file, 'utf-8')
-            : (0, child_process_1.execSync)(`git show ${revision}:${filePathInGitRepository}`, {
+            : (0, child_process_1.execFileSync)('git', ['show', `${revision}:${filePathInGitRepository}`], {
                 maxBuffer: exports.TEN_MEGABYTES,
                 stdio: ['pipe', 'pipe', 'ignore'],
                 windowsHide: true,
@@ -140,6 +144,7 @@ function defaultReadBunLockFileAtRevision(file, revision) {
             windowsHide: true,
         }).trim();
     }
+    (0, git_revision_1.assertValidGitRevision)(revision);
     const filePathInGitRepository = getFilePathInGitRepository(file);
     const tempDirectory = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'nx-bun-lock-'));
     const tempLockfilePath = (0, path_1.join)(tempDirectory, 'bun.lockb');

package/dist/src/tasks-runner/life-cycles/performance-analysis.d.ts

@@ -29,15 +29,20 @@ export interface Timespan {
     /** `parallelism: false` tasks running during the slice (each one holds every slot). */
     nonParallel: number;
 }
+/**
+ * A task and how long it ran (ms). The unit the report's task lists are built from —
+ * shared with the renderers so the producer and the formatters can't drift.
+ */
+export interface TaskDurationRow {
+    id: string;
+    duration: number;
+}
 export interface PerformanceSummary {
     runDuration: number;
     criticalPathDuration: number;
     criticalPathTaskCount: number;
     /** Longest critical-path tasks that ran (desc, capped at a few), cache hits excluded; empty when the path was fully cached. */
-    criticalPathTop: Array<{
-        id: string;
-        duration: number;
-    }>;
+    criticalPathTop: TaskDurationRow[];
     /** Ids of tasks that failed (slowest first), for the GitHub Actions summary's failed-tasks list. Continuous tasks and tasks without a complete window are excluded. */
     failedTasks: string[];
     /** runDuration − criticalPathDuration. */

package/dist/src/tasks-runner/life-cycles/performance-life-cycle.js

@@ -142,8 +142,9 @@ function flushPerformanceReport() {
         // restore_terminal cooks the terminal back post-TUI, so console.log's plain \n
         // renders fine; it also supplies the single trailing newline formatReport omits.
         console.log((0, performance_report_1.formatReport)(summary));
-        // In GitHub Actions, also append the report (plus a per-task table) to the job
-        // summary page. Independent of the console.log above so neither masks the other.
+        // In GitHub Actions, also append the report to the job summary page — the same stats
+        // as above, led by the run's outcome (a failed-tasks list, or a success line).
+        // Independent of the console.log above so neither masks the other.
         writePerformanceReportToGitHubActions(summary);
     }
     catch (e) {
@@ -157,8 +158,8 @@ function flushPerformanceReport() {
 /**
  * Append the performance report to the GitHub Actions job summary page when running in
  * Actions (`$GITHUB_STEP_SUMMARY` is set there and nowhere else). No-op otherwise. The
- * per-task table is computed lazily so non-CI runs don't pay for it. Best-effort: a
- * write failure must never affect the run.
+ * Markdown is rendered below the guard, so non-CI runs don't pay to format a report
+ * nothing reads. Best-effort: a write failure must never affect the run.
  *
  * Skipped for a nested run (one nx command invoked by another nx task's command), so only
  * the outermost run writes to the summary. Nx sets `NX_TASK_TARGET_PROJECT` on every task's

package/dist/src/tasks-runner/life-cycles/performance-report.d.ts

@@ -1,12 +1,16 @@
 import type { PerformanceSummaryPayload } from '../../native';
-import type { PerformanceSummary } from './performance-analysis';
+import type { PerformanceSummary, TaskDurationRow } from './performance-analysis';
 /**
- * A recommendation built from structured parts so the link text comes from the
- * link definition (not a substring scanned out of the assembled report). A part
- * is either literal text or a {@link RecLink}; the renderers below project the
- * same parts to the terminal string, the payload string, and the popup links.
+ * A recommendation built from structured parts so the link text comes from the link
+ * definition (not a substring scanned out of the assembled report). A part is literal
+ * text, a {@link RecLink}, or a {@link RecTaskRows}, projected to each output string by
+ * {@link renderRecommendation}.
+ *
+ * String parts must be single-line — multi-line content needs its own structured part (as
+ * {@link RecTaskRows} is). TS can't enforce this: `string` is already a handled member, so
+ * a multi-line one compiles and then breaks the Markdown nested list.
  */
-type RecPart = string | RecLink;
+type RecPart = string | RecLink | RecTaskRows;
 export type Recommendation = RecPart[];
 /**
  * A docs link inside a recommendation: a sentence is the visible text and the whole of
@@ -15,11 +19,15 @@ export type Recommendation = RecPart[];
  * re-links the phrase from {@link PerformanceSummaryPayload.links}.
  */
 interface RecLink {
-    /** Visible label: the sentence that links. */
     visible: string;
-    /** OSC 8 click target / appended URL: the utm-tagged URL. */
     href: string;
 }
+/**
+ * The critical path's longest tasks as data, so each renderer formats them natively:
+ * the terminal and payload as space-aligned columns, Markdown as a nested list
+ * (HTML collapses space runs, so aligned columns don't survive rendering there).
+ */
+type RecTaskRows = TaskDurationRow[];
 /**
  * The recommendation string the napi payload ships and the Rust popup matches against.
  * Links are URL-less (the popup re-links them from {@link PerformanceSummaryPayload.links}).

package/dist/src/tasks-runner/life-cycles/performance-report.js

@@ -25,15 +25,49 @@ const NX_DISTRIBUTE_CTA = 'Distribute across machines with Nx Agents';
 function phraseLink(phrase, taggedUrl) {
     return { visible: phrase, href: taggedUrl };
 }
+// Discriminate positively — test for what each part *is*. A `!isRecTaskRows` catch-all
+// would misclassify a future `RecPart` member as a link; TS can't catch that (it never
+// checks a predicate body), so `recommendationLinks`' `.filter(isRecLink)` would ship
+// `{text: undefined, href: undefined}` to the popup.
 function isRecLink(part) {
-    return typeof part !== 'string';
+    return typeof part !== 'string' && 'href' in part;
+}
+function isRecTaskRows(part) {
+    return Array.isArray(part);
+}
+/**
+ * Project a recommendation to a string, formatting each non-text part with the caller's
+ * renderers. The three output targets (payload, terminal, Markdown) share this one dispatch.
+ * After the string and task-rows branches a part is a {@link RecLink}, so `render.link`
+ * takes it directly — and a new {@link RecPart} member that is neither would fail to satisfy
+ * that `RecLink` parameter, turning "forgot to handle it" into a compile error right here.
+ */
+function renderRecommendation(rec, render) {
+    return rec
+        .map((part) => {
+        if (typeof part === 'string') {
+            return part;
+        }
+        if (isRecTaskRows(part)) {
+            return render.taskRows(part);
+        }
+        return render.link(part);
+    })
+        .join('');
 }
 /**
  * The recommendation string the napi payload ships and the Rust popup matches against.
  * Links are URL-less (the popup re-links them from {@link PerformanceSummaryPayload.links}).
  */
 function recommendationToPayloadString(rec) {
-    return rec.map((part) => (!isRecLink(part) ? part : part.visible)).join('');
+    return renderRecommendation(rec, {
+        link: (link) => link.visible,
+        taskRows: taskRowsToText,
+    });
+}
+/** Task rows as the text block the terminal and payload embed: newline-led, space-aligned columns. */
+function taskRowsToText(tasks) {
+    return ['', ...formatTopTaskRows(tasks)].join('\n');
 }
 /**
  * The recommendation as a terminal string. With OSC 8 the phrase becomes a hyperlink
@@ -42,16 +76,12 @@ function recommendationToPayloadString(rec) {
  * are off.
  */
 function recommendationToTerminalString(rec, hyperlinks) {
-    return rec
-        .map((part) => {
-        if (!isRecLink(part)) {
-            return part;
-        }
-        return hyperlinks
-            ? (0, terminal_link_1.terminalLink)(part.visible, part.href)
-            : `${part.visible} → ${part.href}`;
-    })
-        .join('');
+    return renderRecommendation(rec, {
+        link: (link) => hyperlinks
+            ? (0, terminal_link_1.terminalLink)(link.visible, link.href)
+            : `${link.visible} → ${link.href}`,
+        taskRows: taskRowsToText,
+    });
 }
 /** The popup links (phrase + href) for every link in a recommendation list, for OSC 8 re-linking. */
 function recommendationLinks(recommendations) {
@@ -77,7 +107,8 @@ function recoverableTime(s) {
 }
 /** Render the longest critical-path tasks as aligned columns: task (left), duration (right). */
 function formatTopTaskRows(tasks) {
-    // The only caller returns early when empty, so `tasks` is non-empty here.
+    // Non-empty by construction: the only recommendation carrying task rows requires
+    // `criticalPathTop.length > 0` to apply, so no empty array reaches the widths below.
     const idWidth = Math.max(...tasks.map((t) => t.id.length));
     const durations = tasks.map((t) => (0, native_1.formatDuration)(t.duration));
     const durWidth = Math.max(...durations.map((d) => d.length));
@@ -172,10 +203,8 @@ const RECOMMENDATIONS = [
         // only multi-line rec). Nothing ran (fully cached) → it doesn't apply.
         isApplicable: (c) => criticalPathBound(c) && c.criticalPathTop.length > 0,
         build: (c) => [
-            [
-                `Speed up or split the longest tasks on the critical path:`,
-                ...formatTopTaskRows(c.criticalPathTop),
-            ].join('\n'),
+            `Speed up or split the longest tasks on the critical path:`,
+            c.criticalPathTop,
         ],
     },
 ];
@@ -261,18 +290,17 @@ function formatReport(s) {
 }
 /**
  * A recommendation as Markdown: every link becomes `[phrase](href)` (no OSC 8, unlike the
- * terminal renderer) — the whole sentence reads as prose and is the link text. The
- * critical-path rec embeds newline-separated, space-aligned task rows; collapse them to
- * `<br>`-joined lines so they render inside the list item.
+ * terminal renderer) — the whole sentence reads as prose and is the link text. Task rows
+ * become a nested list under the recommendation's bullet (space-aligned columns don't
+ * survive HTML's whitespace collapsing).
  */
 function recommendationToMarkdownString(rec) {
-    return rec
-        .map((part) => !isRecLink(part) ? part : `[${part.visible}](${part.href})`)
-        .join('')
-        .split('\n')
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .join('<br>');
+    return renderRecommendation(rec, {
+        link: (link) => `[${link.visible}](${link.href})`,
+        taskRows: (rows) => rows
+            .map((t) => `\n  - \`${t.id}\` — ${(0, native_1.formatDuration)(t.duration)}`)
+            .join(''),
+    });
 }
 /**
  * The performance report as GitHub-flavored Markdown for the Actions job summary

package/dist/src/utils/command-line-utils.js

@@ -11,6 +11,7 @@ const yargs_parser_1 = tslib_1.__importDefault(require("yargs-parser"));
 const file_utils_1 = require("../project-graph/file-utils");
 const output_1 = require("./output");
 const child_process_1 = require("child_process");
+const git_revision_1 = require("./git-revision");
 const workspace_root_1 = require("./workspace-root");
 const shared_options_1 = require("../command-line/yargs-utils/shared-options");
 function createOverrides(__overrides_unparsed__ = []) {
@@ -192,30 +193,27 @@ function parseFiles(options) {
     }
 }
 function getUncommittedFiles() {
-    return parseGitOutput(`git diff --name-only --no-renames --relative HEAD .`);
+    return parseGitOutput([
+        'diff',
+        '--name-only',
+        '--no-renames',
+        '--relative',
+        'HEAD',
+        '.',
+    ]);
 }
 function getUntrackedFiles() {
-    return parseGitOutput(`git ls-files --others --exclude-standard`);
+    return parseGitOutput(['ls-files', '--others', '--exclude-standard']);
 }
 function getMergeBase(base, head = 'HEAD') {
+    (0, git_revision_1.assertValidGitRevision)(base);
+    (0, git_revision_1.assertValidGitRevision)(head);
     try {
-        return (0, child_process_1.execSync)(`git merge-base "${base}" "${head}"`, {
-            maxBuffer: file_utils_1.TEN_MEGABYTES,
-            cwd: workspace_root_1.workspaceRoot,
-            stdio: 'pipe',
-            windowsHide: true,
-        })
-            .toString()
-            .trim();
+        return runGit(['merge-base', base, head]).toString().trim();
     }
     catch {
         try {
-            return (0, child_process_1.execSync)(`git merge-base --fork-point "${base}" "${head}"`, {
-                maxBuffer: file_utils_1.TEN_MEGABYTES,
-                cwd: workspace_root_1.workspaceRoot,
-                stdio: 'pipe',
-                windowsHide: true,
-            })
+            return runGit(['merge-base', '--fork-point', base, head])
                 .toString()
                 .trim();
         }
@@ -225,15 +223,27 @@ function getMergeBase(base, head = 'HEAD') {
     }
 }
 function getFilesUsingBaseAndHead(base, head) {
-    return parseGitOutput(`git diff --name-only --no-renames --relative "${base}" "${head}"`);
+    (0, git_revision_1.assertValidGitRevision)(base);
+    (0, git_revision_1.assertValidGitRevision)(head);
+    return parseGitOutput([
+        'diff',
+        '--name-only',
+        '--no-renames',
+        '--relative',
+        base,
+        head,
+    ]);
 }
-function parseGitOutput(command) {
-    return (0, child_process_1.execSync)(command, {
+function runGit(args) {
+    return (0, child_process_1.execFileSync)('git', args, {
         maxBuffer: file_utils_1.TEN_MEGABYTES,
         cwd: workspace_root_1.workspaceRoot,
         stdio: 'pipe',
         windowsHide: true,
-    })
+    });
+}
+function parseGitOutput(args) {
+    return runGit(args)
         .toString('utf-8')
         .split('\n')
         .map((a) => a.trim())

package/dist/src/utils/git-revision.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+export declare function assertValidGitRevision(revision: string): void;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+export declare function assertValidGitSha(sha: string): void;

package/dist/src/utils/git-revision.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertValidGitRevision = assertValidGitRevision;
+exports.assertValidGitSha = assertValidGitSha;
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+function assertValidGitRevision(revision) {
+    if (revision.startsWith('-')) {
+        throw new Error(`Invalid git revision: "${revision}". Git revisions cannot start with "-".`);
+    }
+}
+const COMMIT_SHA = /^[0-9a-f]{7,40}$/i;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+function assertValidGitSha(sha) {
+    if (!COMMIT_SHA.test(sha)) {
+        throw new Error(`Invalid git commit sha: "${sha}". Expected a hexadecimal commit sha.`);
+    }
+}

package/dist/src/utils/package-manager.js

@@ -165,8 +165,12 @@ function getPackageManagerCommand(packageManager = detectPackageManager(), root
                 install: 'pnpm install --no-frozen-lockfile', // explicitly disable in case of CI
                 ciInstall: 'pnpm install --frozen-lockfile',
                 updateLockFile: 'pnpm install --lockfile-only',
-                add: isPnpmWorkspace ? 'pnpm add -w' : 'pnpm add',
-                addDev: isPnpmWorkspace ? 'pnpm add -Dw' : 'pnpm add -D',
+                add: isPnpmWorkspace
+                    ? 'pnpm add -w --config.frozen-lockfile=false'
+                    : 'pnpm add --config.frozen-lockfile=false',
+                addDev: isPnpmWorkspace
+                    ? 'pnpm add -Dw --config.frozen-lockfile=false'
+                    : 'pnpm add -D --config.frozen-lockfile=false',
                 rm: 'pnpm rm',
                 exec: modernPnpm ? 'pnpm exec' : 'pnpx',
                 dlx: modernPnpm ? 'pnpm dlx' : 'pnpx',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "23.2.0-beta.0",
+  "version": "23.2.0-beta.1",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -176,16 +176,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "23.2.0-beta.0",
-    "@nx/nx-darwin-x64": "23.2.0-beta.0",
-    "@nx/nx-freebsd-x64": "23.2.0-beta.0",
-    "@nx/nx-linux-arm-gnueabihf": "23.2.0-beta.0",
-    "@nx/nx-linux-arm64-gnu": "23.2.0-beta.0",
-    "@nx/nx-linux-arm64-musl": "23.2.0-beta.0",
-    "@nx/nx-linux-x64-gnu": "23.2.0-beta.0",
-    "@nx/nx-linux-x64-musl": "23.2.0-beta.0",
-    "@nx/nx-win32-arm64-msvc": "23.2.0-beta.0",
-    "@nx/nx-win32-x64-msvc": "23.2.0-beta.0"
+    "@nx/nx-darwin-arm64": "23.2.0-beta.1",
+    "@nx/nx-darwin-x64": "23.2.0-beta.1",
+    "@nx/nx-freebsd-x64": "23.2.0-beta.1",
+    "@nx/nx-linux-arm-gnueabihf": "23.2.0-beta.1",
+    "@nx/nx-linux-arm64-gnu": "23.2.0-beta.1",
+    "@nx/nx-linux-arm64-musl": "23.2.0-beta.1",
+    "@nx/nx-linux-x64-gnu": "23.2.0-beta.1",
+    "@nx/nx-linux-x64-musl": "23.2.0-beta.1",
+    "@nx/nx-win32-arm64-msvc": "23.2.0-beta.1",
+    "@nx/nx-win32-x64-msvc": "23.2.0-beta.1"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",