nx 23.2.0-beta.6 → 23.2.0-beta.8

package/dist/src/utils/safe-spawn.d.ts

@@ -0,0 +1,24 @@
+import { ChildProcess, ExecFileSyncOptions, SpawnOptions } from 'child_process';
+/**
+ * Spawn a binary that may be a Windows `.cmd`/`.bat` shim, without letting its
+ * arguments become shell syntax.
+ *
+ * Off Windows, and for a `.exe`, no shell is involved at all. Where one is —
+ * a shim or a bare name — the binary and every argument are quoted for cmd.exe.
+ *
+ * Not a complete guarantee: cmd.exe expands `%VAR%` in the binary or any
+ * argument whether or not it is quoted, so a caller with untrusted arguments
+ * inherits that gap (NXC-4798). See the note on `LINE_BREAK` above.
+ *
+ * @throws on Windows when the binary or an argument contains a line break, or a
+ * literal `"` (via `quoteShellArg`). Those are the only refusals — the `%`
+ * expansion above is not one of them.
+ */
+export declare function safeSpawn(binary: string, args: readonly string[], options?: Omit<SpawnOptions, 'shell'>): ChildProcess;
+/**
+ * Synchronous {@link safeSpawn}, returning the child's stdout.
+ *
+ * Carries the same Windows caveats: `%VAR%` is expanded quoted or not
+ * (NXC-4798), and a line break or literal `"` throws.
+ */
+export declare function safeExecFileSync(binary: string, args: readonly string[], options?: Omit<ExecFileSyncOptions, 'encoding' | 'shell'>): string;

package/dist/src/utils/safe-spawn.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeSpawn = safeSpawn;
+exports.safeExecFileSync = safeExecFileSync;
+const child_process_1 = require("child_process");
+const path_1 = require("path");
+const shell_quoting_1 = require("./shell-quoting");
+// Node refuses to launch a Windows `.cmd`/`.bat` shim without a shell
+// (CVE-2024-27980). A bare name takes the shell for the same reason, one step
+// removed: libuv walks PATH and PATHEXT itself, so no shell is needed to *find*
+// the binary — but the walk may land on a `.cmd`/`.bat`, and this cannot know
+// which in advance, so it is deliberately conservative. Everything else,
+// including a `.exe`, spawns directly, so the shell and the quoting below reach
+// only the invocations that cannot do without them.
+//
+// Deliberately a function: a module-level const is fixed at import time, which
+// would make the Windows branch untestable.
+function needsShell(binary) {
+    if (process.platform !== 'win32') {
+        return false;
+    }
+    // win32.extname, not the platform default: this branch only runs on Windows,
+    // where `path` is win32 anyway, and pinning it lets a test model the real
+    // parse rather than posix's (which reads `C:\ws\my.app\gradlew` as `.app\gradlew`).
+    const ext = path_1.win32.extname(binary).toLowerCase();
+    return ext === '' || ext === '.cmd' || ext === '.bat';
+}
+// A line break ends the command line whatever the quoting, so nothing can carry
+// one.
+//
+// `%` is deliberately NOT refused, and this is a known gap rather than a safe
+// case. cmd.exe expands `%VAR%` whether or not the value is quoted — see
+// `quoteShellArg`'s own docstring in ./shell-quoting, which says so and pins it
+// with a test — so quoting contains nothing here. It applies to the binary path
+// as much as to the arguments, and an expansion yielding a `"` defeats the
+// literal-quote refusal below, because that inspects the pre-expansion bytes.
+// `bin/nx.ts` loads the workspace's own `.env` before the graph is built, so a
+// repo can set the variable too.
+//
+// Refusing `%` is what an earlier revision did, and it made any workspace under
+// a `%` path — a legal Windows directory name — fail graph construction. The gap
+// is bounded by the argument that bounds this whole class: a repo that can reach
+// here already has `mvnw` / `pom.xml` executing on its behalf. Closing it
+// properly is tracked as NXC-4798.
+const LINE_BREAK = /[\r\n]/;
+/**
+ * Spawn a binary that may be a Windows `.cmd`/`.bat` shim, without letting its
+ * arguments become shell syntax.
+ *
+ * Off Windows, and for a `.exe`, no shell is involved at all. Where one is —
+ * a shim or a bare name — the binary and every argument are quoted for cmd.exe.
+ *
+ * Not a complete guarantee: cmd.exe expands `%VAR%` in the binary or any
+ * argument whether or not it is quoted, so a caller with untrusted arguments
+ * inherits that gap (NXC-4798). See the note on `LINE_BREAK` above.
+ *
+ * @throws on Windows when the binary or an argument contains a line break, or a
+ * literal `"` (via `quoteShellArg`). Those are the only refusals — the `%`
+ * expansion above is not one of them.
+ */
+function safeSpawn(binary, args, options = {}) {
+    const shell = needsShell(binary);
+    return (0, child_process_1.spawn)(quoteBinary(binary, shell), quoteArgs(args, shell), {
+        ...options,
+        windowsHide: true,
+        shell,
+    });
+}
+/**
+ * Synchronous {@link safeSpawn}, returning the child's stdout.
+ *
+ * Carries the same Windows caveats: `%VAR%` is expanded quoted or not
+ * (NXC-4798), and a line break or literal `"` throws.
+ */
+function safeExecFileSync(binary, args, options = {}) {
+    const shell = needsShell(binary);
+    return (0, child_process_1.execFileSync)(quoteBinary(binary, shell), quoteArgs(args, shell), {
+        stdio: 'pipe',
+        ...options,
+        windowsHide: true,
+        shell,
+        encoding: 'utf-8',
+    });
+}
+// The binary needs quoting too: Node joins it into the same command line, so a
+// path holding a space or an `&` would split there.
+function quoteBinary(binary, shell) {
+    if (!shell) {
+        return binary;
+    }
+    return quoteForCmd(binary, `the path ${JSON.stringify(binary)}`);
+}
+function quoteForCmd(value, described, remedy = '') {
+    if (LINE_BREAK.test(value)) {
+        throw new Error(`Cannot pass ${described} to cmd.exe: a line break inside it would end the command line before cmd.exe reached the rest of it.${remedy}`);
+    }
+    return (0, shell_quoting_1.quoteShellArg)(value);
+}
+function quoteArgs(args, shell) {
+    if (!shell) {
+        return [...args];
+    }
+    return args.map((arg) => quoteForCmd(arg, `the argument ${JSON.stringify(arg)}`, ' Remove it from your Nx configuration and try again.'));
+}

package/migrations.json

@@ -184,6 +184,12 @@
       "version": "23.0.0-beta.18",
       "description": "Adds .nx/migrate-runs to .gitignore",
       "implementation": "./dist/src/migrations/update-23-0-0/add-migrate-runs-to-git-ignore"
+    },
+    "23-2-0-set-cache-on-executor-target-defaults": {
+      "version": "23.2.0-beta.8",
+      "description": "Sets \"cache\" on some executor-based target defaults whose caching was previously enabled by a target name default, maintaining compatibility with how cacheability resolved before Nx 23. Keys the migration cannot decide are left alone and keep working through a deprecated runtime fallback.",
+      "implementation": "./dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults",
+      "documentation": "./dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults.md"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "23.2.0-beta.6",
+  "version": "23.2.0-beta.8",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -47,6 +47,8 @@
   },
   "homepage": "https://nx.dev",
   "dependencies": {
+    "@clack/core": "1.4.3",
+    "@clack/prompts": "1.7.0",
     "@emnapi/core": "1.4.5",
     "@emnapi/runtime": "1.4.5",
     "@emnapi/wasi-threads": "1.0.4",
@@ -56,7 +58,6 @@
     "@yarnpkg/lockfile": "1.1.0",
     "@zkochan/js-yaml": "0.0.7",
     "agent-base": "6.0.2",
-    "ansi-colors": "4.1.3",
     "ansi-regex": "5.0.1",
     "ansi-styles": "4.3.0",
     "argparse": "2.0.1",
@@ -89,13 +90,15 @@
     "ejs": "5.0.1",
     "emoji-regex": "8.0.0",
     "end-of-stream": "1.4.5",
-    "enquirer": "2.3.6",
     "es-define-property": "1.0.1",
     "es-errors": "1.3.0",
     "es-object-atoms": "1.1.1",
     "es-set-tostringtag": "2.1.0",
     "escalade": "3.2.0",
     "escape-string-regexp": "1.0.5",
+    "fast-string-truncated-width": "3.0.3",
+    "fast-string-width": "3.0.2",
+    "fast-wrap-ansi": "0.2.0",
     "figures": "3.2.0",
     "flat": "5.0.2",
     "follow-redirects": "1.16.0",
@@ -148,6 +151,7 @@
     "safe-buffer": "5.2.1",
     "semver": "7.8.4",
     "signal-exit": "3.0.7",
+    "sisteransi": "1.0.5",
     "smol-toml": "1.6.1",
     "string-width": "4.2.3",
     "string_decoder": "1.3.0",
@@ -181,16 +185,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "23.2.0-beta.6",
-    "@nx/nx-darwin-x64": "23.2.0-beta.6",
-    "@nx/nx-freebsd-x64": "23.2.0-beta.6",
-    "@nx/nx-linux-arm-gnueabihf": "23.2.0-beta.6",
-    "@nx/nx-linux-arm64-gnu": "23.2.0-beta.6",
-    "@nx/nx-linux-arm64-musl": "23.2.0-beta.6",
-    "@nx/nx-linux-x64-gnu": "23.2.0-beta.6",
-    "@nx/nx-linux-x64-musl": "23.2.0-beta.6",
-    "@nx/nx-win32-arm64-msvc": "23.2.0-beta.6",
-    "@nx/nx-win32-x64-msvc": "23.2.0-beta.6"
+    "@nx/nx-darwin-arm64": "23.2.0-beta.8",
+    "@nx/nx-darwin-x64": "23.2.0-beta.8",
+    "@nx/nx-freebsd-x64": "23.2.0-beta.8",
+    "@nx/nx-linux-arm-gnueabihf": "23.2.0-beta.8",
+    "@nx/nx-linux-arm64-gnu": "23.2.0-beta.8",
+    "@nx/nx-linux-arm64-musl": "23.2.0-beta.8",
+    "@nx/nx-linux-x64-gnu": "23.2.0-beta.8",
+    "@nx/nx-linux-x64-musl": "23.2.0-beta.8",
+    "@nx/nx-win32-arm64-msvc": "23.2.0-beta.8",
+    "@nx/nx-win32-x64-msvc": "23.2.0-beta.8"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",
@@ -218,6 +222,7 @@
       "@nx/next",
       "@nx/node",
       "@nx/nuxt",
+      "@nx/oxlint",
       "@nx/playwright",
       "@nx/plugin",
       "@nx/react",

package/dist/src/utils/min-release-age/npmrc.d.ts

@@ -1,15 +0,0 @@
-export interface NpmrcEntry {
-    key: string;
-    value: string;
-}
-/**
- * Parses an .npmrc file into its `key = value` entries the way npm/npm-conf do:
- * skip blank lines and `#`/`;` comments, split on the first `=`, and trim both
- * sides. The value is returned raw (quote stripping is the caller's concern).
- * Returns null when the file is missing or unreadable so callers can distinguish
- * "no file" from "file with no relevant keys". Shared by the npm and pnpm
- * cooldown readers.
- */
-export declare function readNpmrcEntries(path: string): NpmrcEntry[] | null;
-/** The parsing half of {@link readNpmrcEntries}, usable without a filesystem. */
-export declare function parseNpmrcContent(raw: string): NpmrcEntry[];

package/dist/src/utils/min-release-age/npmrc.js

@@ -1,45 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readNpmrcEntries = readNpmrcEntries;
-exports.parseNpmrcContent = parseNpmrcContent;
-const fs_1 = require("fs");
-/**
- * Parses an .npmrc file into its `key = value` entries the way npm/npm-conf do:
- * skip blank lines and `#`/`;` comments, split on the first `=`, and trim both
- * sides. The value is returned raw (quote stripping is the caller's concern).
- * Returns null when the file is missing or unreadable so callers can distinguish
- * "no file" from "file with no relevant keys". Shared by the npm and pnpm
- * cooldown readers.
- */
-function readNpmrcEntries(path) {
-    if (!(0, fs_1.existsSync)(path)) {
-        return null;
-    }
-    let raw;
-    try {
-        raw = (0, fs_1.readFileSync)(path, 'utf-8');
-    }
-    catch {
-        return null;
-    }
-    return parseNpmrcContent(raw);
-}
-/** The parsing half of {@link readNpmrcEntries}, usable without a filesystem. */
-function parseNpmrcContent(raw) {
-    const entries = [];
-    for (const line of raw.split(/\r?\n/)) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';')) {
-            continue;
-        }
-        const eq = trimmed.indexOf('=');
-        if (eq === -1) {
-            continue;
-        }
-        entries.push({
-            key: trimmed.slice(0, eq).trim(),
-            value: trimmed.slice(eq + 1).trim(),
-        });
-    }
-    return entries;
-}