nx 23.2.0-beta.0 → 23.2.0-beta.2

package/dist/src/project-graph/build-project-graph.js

@@ -7,6 +7,7 @@ exports.applyProjectMetadata = applyProjectMetadata;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const perf_hooks_1 = require("perf_hooks");
+const analytics_1 = require("../analytics");
 const configuration_1 = require("../config/configuration");
 const file_hasher_1 = require("../hasher/file-hasher");
 const typescript_1 = require("../plugins/js/utils/typescript");
@@ -222,7 +223,12 @@ async function updateProjectGraphWithPlugins(context, initProjectGraph, plugins,
         perf_hooks_1.performance.measure(`${plugin.name}:createDependencies`, {
             start: `${plugin.name}:createDependencies - start`,
             end: `${plugin.name}:createDependencies - end`,
-            detail: { track: true },
+            detail: {
+                track: true,
+                ...(analytics_1.customDimensions && {
+                    [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
+                }),
+            },
         });
     }));
     perf_hooks_1.performance.mark('createDependencies:end');

package/dist/src/project-graph/file-utils.js

@@ -12,6 +12,7 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const fileutils_1 = require("../utils/fileutils");
+const git_revision_1 = require("../utils/git-revision");
 const ignore_1 = require("../utils/ignore");
 const json_diff_1 = require("../utils/json-diff");
 const workspace_root_1 = require("../utils/workspace-root");
@@ -116,11 +117,14 @@ function readLockFileAtRevision(file, lockFileName, revision, readFileAtRevision
 }
 exports.TEN_MEGABYTES = 1024 * 10000;
 function defaultReadFileAtRevision(file, revision) {
+    if (revision) {
+        (0, git_revision_1.assertValidGitRevision)(revision);
+    }
     try {
         const filePathInGitRepository = getFilePathInGitRepository(file);
         return !revision
             ? (0, fs_1.readFileSync)(file, 'utf-8')
-            : (0, child_process_1.execSync)(`git show ${revision}:${filePathInGitRepository}`, {
+            : (0, child_process_1.execFileSync)('git', ['show', `${revision}:${filePathInGitRepository}`], {
                 maxBuffer: exports.TEN_MEGABYTES,
                 stdio: ['pipe', 'pipe', 'ignore'],
                 windowsHide: true,
@@ -140,6 +144,7 @@ function defaultReadBunLockFileAtRevision(file, revision) {
             windowsHide: true,
         }).trim();
     }
+    (0, git_revision_1.assertValidGitRevision)(revision);
     const filePathInGitRepository = getFilePathInGitRepository(file);
     const tempDirectory = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'nx-bun-lock-'));
     const tempLockfilePath = (0, path_1.join)(tempDirectory, 'bun.lockb');

package/dist/src/project-graph/plugins/loaded-nx-plugin.js

@@ -63,6 +63,7 @@ class LoadedNxPlugin {
                             track: true,
                             ...(analytics_1.customDimensions && {
                                 [analytics_1.customDimensions.projectCount]: projectCount,
+                                [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
                             }),
                         },
                     });

package/dist/src/project-graph/project-graph.js

@@ -244,6 +244,7 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                     track: true,
                     ...(analytics_1.customDimensions && {
                         [analytics_1.customDimensions.projectCount]: Object.keys(currentProjectGraph.nodes).length,
+                        [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
                     }),
                 },
             });
@@ -310,6 +311,7 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                     ...(analytics_1.customDimensions && {
                         [analytics_1.customDimensions.projectCount]: Object.keys(res.projectGraph.nodes)
                             .length,
+                        [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
                     }),
                 },
             });
@@ -333,6 +335,7 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                     track: true,
                     ...(analytics_1.customDimensions && {
                         [analytics_1.customDimensions.projectCount]: Object.keys(projectGraphAndSourceMaps.projectGraph.nodes).length,
+                        [analytics_1.customDimensions.sampleRate]: analytics_1.PERF_SPAN_SAMPLE_RATE,
                     }),
                 },
             });

package/dist/src/tasks-runner/life-cycle.d.ts

@@ -44,7 +44,7 @@ export interface LifeCycle {
     startTasks?(task: Task[], metadata: TaskMetadata): void | Promise<void>;
     endTasks?(taskResults: TaskResult[], metadata: TaskMetadata): void | Promise<void>;
     printTaskTerminalOutput?(task: Task, status: TaskStatus, output: string): void;
-    registerRunningTask?(taskId: string, parserAndWriter: ExternalObject<[any, any]>): void;
+    registerRunningTask?(taskId: string, ptyHandles: ExternalObject<[any, any, any]>): void;
     registerRunningTaskWithEmptyParser?(taskId: string): void;
     appendTaskOutput?(taskId: string, output: string, isPtyTask: boolean): void;
     setTaskStatus?(taskId: string, status: NativeTaskStatus): void;
@@ -72,7 +72,7 @@ export declare class CompositeLifeCycle implements LifeCycle {
     startTasks(tasks: Task[], metadata: TaskMetadata): Promise<void>;
     endTasks(taskResults: TaskResult[], metadata: TaskMetadata): Promise<void>;
     printTaskTerminalOutput(task: Task, status: TaskStatus, output: string): void;
-    registerRunningTask(taskId: string, parserAndWriter: ExternalObject<[any, any]>): void;
+    registerRunningTask(taskId: string, ptyHandles: ExternalObject<[any, any, any]>): void;
     registerRunningTaskWithEmptyParser(taskId: string): void;
     appendTaskOutput(taskId: string, output: string, isPtyTask: boolean): void;
     setTaskStatus(taskId: string, status: NativeTaskStatus): void;

package/dist/src/tasks-runner/life-cycle.js

@@ -67,10 +67,10 @@ class CompositeLifeCycle {
             }
         }
     }
-    registerRunningTask(taskId, parserAndWriter) {
+    registerRunningTask(taskId, ptyHandles) {
         for (let l of this.lifeCycles) {
             if (l.registerRunningTask) {
-                l.registerRunningTask(taskId, parserAndWriter);
+                l.registerRunningTask(taskId, ptyHandles);
             }
         }
     }

package/dist/src/tasks-runner/life-cycles/performance-analysis.d.ts

@@ -29,15 +29,20 @@ export interface Timespan {
     /** `parallelism: false` tasks running during the slice (each one holds every slot). */
     nonParallel: number;
 }
+/**
+ * A task and how long it ran (ms). The unit the report's task lists are built from —
+ * shared with the renderers so the producer and the formatters can't drift.
+ */
+export interface TaskDurationRow {
+    id: string;
+    duration: number;
+}
 export interface PerformanceSummary {
     runDuration: number;
     criticalPathDuration: number;
     criticalPathTaskCount: number;
     /** Longest critical-path tasks that ran (desc, capped at a few), cache hits excluded; empty when the path was fully cached. */
-    criticalPathTop: Array<{
-        id: string;
-        duration: number;
-    }>;
+    criticalPathTop: TaskDurationRow[];
     /** Ids of tasks that failed (slowest first), for the GitHub Actions summary's failed-tasks list. Continuous tasks and tasks without a complete window are excluded. */
     failedTasks: string[];
     /** runDuration − criticalPathDuration. */

package/dist/src/tasks-runner/life-cycles/performance-life-cycle.js

@@ -142,8 +142,9 @@ function flushPerformanceReport() {
         // restore_terminal cooks the terminal back post-TUI, so console.log's plain \n
         // renders fine; it also supplies the single trailing newline formatReport omits.
         console.log((0, performance_report_1.formatReport)(summary));
-        // In GitHub Actions, also append the report (plus a per-task table) to the job
-        // summary page. Independent of the console.log above so neither masks the other.
+        // In GitHub Actions, also append the report to the job summary page — the same stats
+        // as above, led by the run's outcome (a failed-tasks list, or a success line).
+        // Independent of the console.log above so neither masks the other.
         writePerformanceReportToGitHubActions(summary);
     }
     catch (e) {
@@ -157,8 +158,8 @@ function flushPerformanceReport() {
 /**
  * Append the performance report to the GitHub Actions job summary page when running in
  * Actions (`$GITHUB_STEP_SUMMARY` is set there and nowhere else). No-op otherwise. The
- * per-task table is computed lazily so non-CI runs don't pay for it. Best-effort: a
- * write failure must never affect the run.
+ * Markdown is rendered below the guard, so non-CI runs don't pay to format a report
+ * nothing reads. Best-effort: a write failure must never affect the run.
  *
  * Skipped for a nested run (one nx command invoked by another nx task's command), so only
  * the outermost run writes to the summary. Nx sets `NX_TASK_TARGET_PROJECT` on every task's

package/dist/src/tasks-runner/life-cycles/performance-report.d.ts

@@ -1,12 +1,16 @@
 import type { PerformanceSummaryPayload } from '../../native';
-import type { PerformanceSummary } from './performance-analysis';
+import type { PerformanceSummary, TaskDurationRow } from './performance-analysis';
 /**
- * A recommendation built from structured parts so the link text comes from the
- * link definition (not a substring scanned out of the assembled report). A part
- * is either literal text or a {@link RecLink}; the renderers below project the
- * same parts to the terminal string, the payload string, and the popup links.
+ * A recommendation built from structured parts so the link text comes from the link
+ * definition (not a substring scanned out of the assembled report). A part is literal
+ * text, a {@link RecLink}, or a {@link RecTaskRows}, projected to each output string by
+ * {@link renderRecommendation}.
+ *
+ * String parts must be single-line — multi-line content needs its own structured part (as
+ * {@link RecTaskRows} is). TS can't enforce this: `string` is already a handled member, so
+ * a multi-line one compiles and then breaks the Markdown nested list.
  */
-type RecPart = string | RecLink;
+type RecPart = string | RecLink | RecTaskRows;
 export type Recommendation = RecPart[];
 /**
  * A docs link inside a recommendation: a sentence is the visible text and the whole of
@@ -15,11 +19,15 @@ export type Recommendation = RecPart[];
  * re-links the phrase from {@link PerformanceSummaryPayload.links}.
  */
 interface RecLink {
-    /** Visible label: the sentence that links. */
     visible: string;
-    /** OSC 8 click target / appended URL: the utm-tagged URL. */
     href: string;
 }
+/**
+ * The critical path's longest tasks as data, so each renderer formats them natively:
+ * the terminal and payload as space-aligned columns, Markdown as a nested list
+ * (HTML collapses space runs, so aligned columns don't survive rendering there).
+ */
+type RecTaskRows = TaskDurationRow[];
 /**
  * The recommendation string the napi payload ships and the Rust popup matches against.
  * Links are URL-less (the popup re-links them from {@link PerformanceSummaryPayload.links}).

package/dist/src/tasks-runner/life-cycles/performance-report.js

@@ -25,15 +25,49 @@ const NX_DISTRIBUTE_CTA = 'Distribute across machines with Nx Agents';
 function phraseLink(phrase, taggedUrl) {
     return { visible: phrase, href: taggedUrl };
 }
+// Discriminate positively — test for what each part *is*. A `!isRecTaskRows` catch-all
+// would misclassify a future `RecPart` member as a link; TS can't catch that (it never
+// checks a predicate body), so `recommendationLinks`' `.filter(isRecLink)` would ship
+// `{text: undefined, href: undefined}` to the popup.
 function isRecLink(part) {
-    return typeof part !== 'string';
+    return typeof part !== 'string' && 'href' in part;
+}
+function isRecTaskRows(part) {
+    return Array.isArray(part);
+}
+/**
+ * Project a recommendation to a string, formatting each non-text part with the caller's
+ * renderers. The three output targets (payload, terminal, Markdown) share this one dispatch.
+ * After the string and task-rows branches a part is a {@link RecLink}, so `render.link`
+ * takes it directly — and a new {@link RecPart} member that is neither would fail to satisfy
+ * that `RecLink` parameter, turning "forgot to handle it" into a compile error right here.
+ */
+function renderRecommendation(rec, render) {
+    return rec
+        .map((part) => {
+        if (typeof part === 'string') {
+            return part;
+        }
+        if (isRecTaskRows(part)) {
+            return render.taskRows(part);
+        }
+        return render.link(part);
+    })
+        .join('');
 }
 /**
  * The recommendation string the napi payload ships and the Rust popup matches against.
  * Links are URL-less (the popup re-links them from {@link PerformanceSummaryPayload.links}).
  */
 function recommendationToPayloadString(rec) {
-    return rec.map((part) => (!isRecLink(part) ? part : part.visible)).join('');
+    return renderRecommendation(rec, {
+        link: (link) => link.visible,
+        taskRows: taskRowsToText,
+    });
+}
+/** Task rows as the text block the terminal and payload embed: newline-led, space-aligned columns. */
+function taskRowsToText(tasks) {
+    return ['', ...formatTopTaskRows(tasks)].join('\n');
 }
 /**
  * The recommendation as a terminal string. With OSC 8 the phrase becomes a hyperlink
@@ -42,16 +76,12 @@ function recommendationToPayloadString(rec) {
  * are off.
  */
 function recommendationToTerminalString(rec, hyperlinks) {
-    return rec
-        .map((part) => {
-        if (!isRecLink(part)) {
-            return part;
-        }
-        return hyperlinks
-            ? (0, terminal_link_1.terminalLink)(part.visible, part.href)
-            : `${part.visible} → ${part.href}`;
-    })
-        .join('');
+    return renderRecommendation(rec, {
+        link: (link) => hyperlinks
+            ? (0, terminal_link_1.terminalLink)(link.visible, link.href)
+            : `${link.visible} → ${link.href}`,
+        taskRows: taskRowsToText,
+    });
 }
 /** The popup links (phrase + href) for every link in a recommendation list, for OSC 8 re-linking. */
 function recommendationLinks(recommendations) {
@@ -77,7 +107,8 @@ function recoverableTime(s) {
 }
 /** Render the longest critical-path tasks as aligned columns: task (left), duration (right). */
 function formatTopTaskRows(tasks) {
-    // The only caller returns early when empty, so `tasks` is non-empty here.
+    // Non-empty by construction: the only recommendation carrying task rows requires
+    // `criticalPathTop.length > 0` to apply, so no empty array reaches the widths below.
     const idWidth = Math.max(...tasks.map((t) => t.id.length));
     const durations = tasks.map((t) => (0, native_1.formatDuration)(t.duration));
     const durWidth = Math.max(...durations.map((d) => d.length));
@@ -172,10 +203,8 @@ const RECOMMENDATIONS = [
         // only multi-line rec). Nothing ran (fully cached) → it doesn't apply.
         isApplicable: (c) => criticalPathBound(c) && c.criticalPathTop.length > 0,
         build: (c) => [
-            [
-                `Speed up or split the longest tasks on the critical path:`,
-                ...formatTopTaskRows(c.criticalPathTop),
-            ].join('\n'),
+            `Speed up or split the longest tasks on the critical path:`,
+            c.criticalPathTop,
         ],
     },
 ];
@@ -261,18 +290,17 @@ function formatReport(s) {
 }
 /**
  * A recommendation as Markdown: every link becomes `[phrase](href)` (no OSC 8, unlike the
- * terminal renderer) — the whole sentence reads as prose and is the link text. The
- * critical-path rec embeds newline-separated, space-aligned task rows; collapse them to
- * `<br>`-joined lines so they render inside the list item.
+ * terminal renderer) — the whole sentence reads as prose and is the link text. Task rows
+ * become a nested list under the recommendation's bullet (space-aligned columns don't
+ * survive HTML's whitespace collapsing).
  */
 function recommendationToMarkdownString(rec) {
-    return rec
-        .map((part) => !isRecLink(part) ? part : `[${part.visible}](${part.href})`)
-        .join('')
-        .split('\n')
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .join('<br>');
+    return renderRecommendation(rec, {
+        link: (link) => `[${link.visible}](${link.href})`,
+        taskRows: (rows) => rows
+            .map((t) => `\n  - \`${t.id}\` — ${(0, native_1.formatDuration)(t.duration)}`)
+            .join(''),
+    });
 }
 /**
  * The performance report as GitHub-flavored Markdown for the Actions job summary

package/dist/src/tasks-runner/pseudo-terminal.d.ts

@@ -47,7 +47,7 @@ export declare class PseudoTtyProcess implements RunningTask {
     onOutput(callback: (message: string) => void): void;
     getPid(): number | undefined;
     kill(s?: NodeJS.Signals): Promise<void>;
-    getParserAndWriter(): import("../native").ExternalObject<[import("../native").ParserArc, import("../native").WriterArc]>;
+    getPtyHandles(): import("../native").ExternalObject<[import("../native").ParserArc, import("../native").WriterArc, import("../native").MasterArc]>;
 }
 export declare class PseudoTtyProcessWithSend extends PseudoTtyProcess {
     rustPseudoTerminal: RustPseudoTerminal;

package/dist/src/tasks-runner/pseudo-terminal.js

@@ -150,8 +150,8 @@ class PseudoTtyProcess {
             }
         }
     }
-    getParserAndWriter() {
-        return this.childProcess.getParserAndWriter();
+    getPtyHandles() {
+        return this.childProcess.getPtyHandles();
     }
 }
 exports.PseudoTtyProcess = PseudoTtyProcess;

package/dist/src/tasks-runner/task-orchestrator.d.ts

@@ -35,6 +35,7 @@ export declare class TaskOrchestrator {
     private reverseTaskDeps;
     private initializingTaskIds;
     private processedTasks;
+    private cacheMissedHashes;
     private completedTasks;
     private waitingForTasks;
     private pendingDiscreteWorkers;
@@ -100,7 +101,9 @@ export declare class TaskOrchestrator {
      * The coordinator relies on this running unconditionally (when cache
      * is enabled): tasks dispatched in step 5 via runTaskDirectly skip
      * their own cache lookup on the assumption that this has already
-     * confirmed them as misses. Don't add length-based bails.
+     * confirmed them as misses. Excluding cacheMissedHashes preserves that
+     * invariant — every dispatched hash was queried exactly once — but
+     * don't add other length-based bails.
      */
     private resolveCachedTasksBulk;
     /**

package/dist/src/tasks-runner/task-orchestrator.js

@@ -79,6 +79,12 @@ class TaskOrchestrator {
         // underlying real tasks become the anchors.
         this.initializingTaskIds = (0, utils_1.expandInitiatingTasksThroughNoop)(this.initiatingTasks, this.taskGraph, this.projectGraph);
         this.processedTasks = new Map();
+        // Hashes confirmed absent from the cache this run. A confirmed miss can
+        // only become a hit when the task itself runs — and then it leaves the
+        // schedule — so a missed hash never needs re-querying. Without this, a
+        // miss waiting for a worker slot is re-queried (including the remote
+        // retrieval) on every coordinator cycle.
+        this.cacheMissedHashes = new Set();
         this.completedTasks = new Map();
         this.waitingForTasks = [];
         this.pendingDiscreteWorkers = new Set();
@@ -324,9 +330,12 @@ class TaskOrchestrator {
      * inside DbCache.getBatch.
      */
     async fetchCacheHits(tasks) {
-        const batchResults = await this.cache.getBatch(tasks);
+        const tasksToQuery = tasks.filter((t) => t.hash && !this.cacheMissedHashes.has(t.hash));
+        if (tasksToQuery.length === 0)
+            return [];
+        const batchResults = await this.cache.getBatch(tasksToQuery);
         const cacheHits = [];
-        for (const task of tasks) {
+        for (const task of tasksToQuery) {
             const cachedResult = batchResults.get(task.hash);
             // Replay a cached result only under the same condition it was cached
             // under (shouldCacheTaskResult): successes always, failures only when
@@ -335,6 +344,9 @@ class TaskOrchestrator {
             if (cachedResult && this.shouldCacheTaskResult(task, cachedResult.code)) {
                 cacheHits.push({ task, cachedResult });
             }
+            else {
+                this.cacheMissedHashes.add(task.hash);
+            }
         }
         return cacheHits;
     }
@@ -396,14 +408,19 @@ class TaskOrchestrator {
      * The coordinator relies on this running unconditionally (when cache
      * is enabled): tasks dispatched in step 5 via runTaskDirectly skip
      * their own cache lookup on the assumption that this has already
-     * confirmed them as misses. Don't add length-based bails.
+     * confirmed them as misses. Excluding cacheMissedHashes preserves that
+     * invariant — every dispatched hash was queried exactly once — but
+     * don't add other length-based bails.
      */
     async resolveCachedTasksBulk() {
         const { scheduledTasks } = this.tasksSchedule.getAllScheduledTasks();
         const candidates = [];
         for (const id of scheduledTasks) {
             const task = this.taskGraph.tasks[id];
-            if (task.hash && !task.continuous && task.cache) {
+            if (task.hash &&
+                !this.cacheMissedHashes.has(task.hash) &&
+                !task.continuous &&
+                task.cache) {
                 candidates.push(task);
             }
         }
@@ -790,7 +807,7 @@ class TaskOrchestrator {
                 else if (this.tuiEnabled) {
                     if (runningTask instanceof pseudo_terminal_1.PseudoTtyProcess) {
                         // This is an external of a the pseudo terminal where a task is running and can be passed to the TUI
-                        this.options.lifeCycle.registerRunningTask(task.id, runningTask.getParserAndWriter());
+                        this.options.lifeCycle.registerRunningTask(task.id, runningTask.getPtyHandles());
                         runningTask.onOutput((output) => {
                             this.options.lifeCycle.appendTaskOutput(task.id, output, true);
                         });
@@ -839,7 +856,7 @@ class TaskOrchestrator {
             if (this.tuiEnabled) {
                 if (runningTask instanceof pseudo_terminal_1.PseudoTtyProcess) {
                     // This is an external of a the pseudo terminal where a task is running and can be passed to the TUI
-                    this.options.lifeCycle.registerRunningTask(task.id, runningTask.getParserAndWriter());
+                    this.options.lifeCycle.registerRunningTask(task.id, runningTask.getPtyHandles());
                     runningTask.onOutput((output) => {
                         this.options.lifeCycle.appendTaskOutput(task.id, output, true);
                     });

package/dist/src/utils/acknowledge-build-scripts.js

@@ -7,6 +7,7 @@ const yaml_1 = require("yaml");
 const semver_1 = require("semver");
 const package_manager_1 = require("./package-manager");
 const fileutils_1 = require("./fileutils");
+const json_1 = require("./json");
 const PNPM_WORKSPACE_FILE = 'pnpm-workspace.yaml';
 /**
  * Records build-script decisions for dependencies that are about to be
@@ -42,23 +43,24 @@ function acknowledgePnpmBuildScripts(treeOrRoot, entries) {
     // A file that doesn't parse cleanly or whose root isn't a mapping is
     // malformed for pnpm; leave it alone rather than crashing or replacing the
     // user's content. pnpm's own error on the file is the actionable signal.
+    // Empty and comment-only files have no contents at all; setIn creates the
+    // mapping for them while keeping whatever comments they carry.
     if (parsed.errors.length > 0 ||
         (parsed.contents != null && !(parsed.contents instanceof yaml_1.YAMLMap))) {
         return;
     }
-    const doc = parsed.contents instanceof yaml_1.YAMLMap ? parsed : new yaml_1.Document({});
     let changed = false;
     for (const [pkg, allowed] of Object.entries(entries)) {
         // Only a real boolean is a user decision. pnpm's non-strict installs stub
         // undecided packages with a placeholder string ("set this to true or
         // false"), which would fail the next strict install if left in place.
-        if (typeof doc.getIn(['allowBuilds', pkg]) !== 'boolean') {
-            doc.setIn(['allowBuilds', pkg], allowed);
+        if (typeof parsed.getIn(['allowBuilds', pkg]) !== 'boolean') {
+            parsed.setIn(['allowBuilds', pkg], allowed);
             changed = true;
         }
     }
     if (changed) {
-        host.write(PNPM_WORKSPACE_FILE, doc.toString());
+        host.write(PNPM_WORKSPACE_FILE, parsed.toString());
     }
 }
 function createHost(treeOrRoot) {
@@ -76,7 +78,7 @@ function createHost(treeOrRoot) {
         exists: (p) => treeOrRoot.exists(p),
         read: (p) => treeOrRoot.read(p, 'utf-8'),
         write: (p, c) => treeOrRoot.write(p, c),
-        readJson: (p) => JSON.parse(treeOrRoot.read(p, 'utf-8')),
+        readJson: (p) => (0, json_1.parseJson)(treeOrRoot.read(p, 'utf-8')),
     };
 }
 function getPnpmVersion(host) {

package/dist/src/utils/command-line-utils.js

@@ -11,6 +11,7 @@ const yargs_parser_1 = tslib_1.__importDefault(require("yargs-parser"));
 const file_utils_1 = require("../project-graph/file-utils");
 const output_1 = require("./output");
 const child_process_1 = require("child_process");
+const git_revision_1 = require("./git-revision");
 const workspace_root_1 = require("./workspace-root");
 const shared_options_1 = require("../command-line/yargs-utils/shared-options");
 function createOverrides(__overrides_unparsed__ = []) {
@@ -192,30 +193,27 @@ function parseFiles(options) {
     }
 }
 function getUncommittedFiles() {
-    return parseGitOutput(`git diff --name-only --no-renames --relative HEAD .`);
+    return parseGitOutput([
+        'diff',
+        '--name-only',
+        '--no-renames',
+        '--relative',
+        'HEAD',
+        '.',
+    ]);
 }
 function getUntrackedFiles() {
-    return parseGitOutput(`git ls-files --others --exclude-standard`);
+    return parseGitOutput(['ls-files', '--others', '--exclude-standard']);
 }
 function getMergeBase(base, head = 'HEAD') {
+    (0, git_revision_1.assertValidGitRevision)(base);
+    (0, git_revision_1.assertValidGitRevision)(head);
     try {
-        return (0, child_process_1.execSync)(`git merge-base "${base}" "${head}"`, {
-            maxBuffer: file_utils_1.TEN_MEGABYTES,
-            cwd: workspace_root_1.workspaceRoot,
-            stdio: 'pipe',
-            windowsHide: true,
-        })
-            .toString()
-            .trim();
+        return runGit(['merge-base', base, head]).toString().trim();
     }
     catch {
         try {
-            return (0, child_process_1.execSync)(`git merge-base --fork-point "${base}" "${head}"`, {
-                maxBuffer: file_utils_1.TEN_MEGABYTES,
-                cwd: workspace_root_1.workspaceRoot,
-                stdio: 'pipe',
-                windowsHide: true,
-            })
+            return runGit(['merge-base', '--fork-point', base, head])
                 .toString()
                 .trim();
         }
@@ -225,15 +223,27 @@ function getMergeBase(base, head = 'HEAD') {
     }
 }
 function getFilesUsingBaseAndHead(base, head) {
-    return parseGitOutput(`git diff --name-only --no-renames --relative "${base}" "${head}"`);
+    (0, git_revision_1.assertValidGitRevision)(base);
+    (0, git_revision_1.assertValidGitRevision)(head);
+    return parseGitOutput([
+        'diff',
+        '--name-only',
+        '--no-renames',
+        '--relative',
+        base,
+        head,
+    ]);
 }
-function parseGitOutput(command) {
-    return (0, child_process_1.execSync)(command, {
+function runGit(args) {
+    return (0, child_process_1.execFileSync)('git', args, {
         maxBuffer: file_utils_1.TEN_MEGABYTES,
         cwd: workspace_root_1.workspaceRoot,
         stdio: 'pipe',
         windowsHide: true,
-    })
+    });
+}
+function parseGitOutput(args) {
+    return runGit(args)
         .toString('utf-8')
         .split('\n')
         .map((a) => a.trim())

package/dist/src/utils/git-revision.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+export declare function assertValidGitRevision(revision: string): void;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+export declare function assertValidGitSha(sha: string): void;

package/dist/src/utils/git-revision.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertValidGitRevision = assertValidGitRevision;
+exports.assertValidGitSha = assertValidGitSha;
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+function assertValidGitRevision(revision) {
+    if (revision.startsWith('-')) {
+        throw new Error(`Invalid git revision: "${revision}". Git revisions cannot start with "-".`);
+    }
+}
+const COMMIT_SHA = /^[0-9a-f]{7,40}$/i;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+function assertValidGitSha(sha) {
+    if (!COMMIT_SHA.test(sha)) {
+        throw new Error(`Invalid git commit sha: "${sha}". Expected a hexadecimal commit sha.`);
+    }
+}

package/dist/src/utils/package-manager.js

@@ -165,8 +165,12 @@ function getPackageManagerCommand(packageManager = detectPackageManager(), root
                 install: 'pnpm install --no-frozen-lockfile', // explicitly disable in case of CI
                 ciInstall: 'pnpm install --frozen-lockfile',
                 updateLockFile: 'pnpm install --lockfile-only',
-                add: isPnpmWorkspace ? 'pnpm add -w' : 'pnpm add',
-                addDev: isPnpmWorkspace ? 'pnpm add -Dw' : 'pnpm add -D',
+                add: isPnpmWorkspace
+                    ? 'pnpm add -w --config.frozen-lockfile=false'
+                    : 'pnpm add --config.frozen-lockfile=false',
+                addDev: isPnpmWorkspace
+                    ? 'pnpm add -Dw --config.frozen-lockfile=false'
+                    : 'pnpm add -D --config.frozen-lockfile=false',
                 rm: 'pnpm rm',
                 exec: modernPnpm ? 'pnpm exec' : 'pnpx',
                 dlx: modernPnpm ? 'pnpm dlx' : 'pnpx',