nx 23.2.0-beta.7 → 23.2.0-beta.9

package/dist/src/utils/safe-spawn.d.ts

@@ -0,0 +1,24 @@
+import { ChildProcess, ExecFileSyncOptions, SpawnOptions } from 'child_process';
+/**
+ * Spawn a binary that may be a Windows `.cmd`/`.bat` shim, without letting its
+ * arguments become shell syntax.
+ *
+ * Off Windows, and for a `.exe`, no shell is involved at all. Where one is —
+ * a shim or a bare name — the binary and every argument are quoted for cmd.exe.
+ *
+ * Not a complete guarantee: cmd.exe expands `%VAR%` in the binary or any
+ * argument whether or not it is quoted, so a caller with untrusted arguments
+ * inherits that gap (NXC-4798). See the note on `LINE_BREAK` above.
+ *
+ * @throws on Windows when the binary or an argument contains a line break, or a
+ * literal `"` (via `quoteShellArg`). Those are the only refusals — the `%`
+ * expansion above is not one of them.
+ */
+export declare function safeSpawn(binary: string, args: readonly string[], options?: Omit<SpawnOptions, 'shell'>): ChildProcess;
+/**
+ * Synchronous {@link safeSpawn}, returning the child's stdout.
+ *
+ * Carries the same Windows caveats: `%VAR%` is expanded quoted or not
+ * (NXC-4798), and a line break or literal `"` throws.
+ */
+export declare function safeExecFileSync(binary: string, args: readonly string[], options?: Omit<ExecFileSyncOptions, 'encoding' | 'shell'>): string;

package/dist/src/utils/safe-spawn.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeSpawn = safeSpawn;
+exports.safeExecFileSync = safeExecFileSync;
+const child_process_1 = require("child_process");
+const path_1 = require("path");
+const shell_quoting_1 = require("./shell-quoting");
+// Node refuses to launch a Windows `.cmd`/`.bat` shim without a shell
+// (CVE-2024-27980). A bare name takes the shell for the same reason, one step
+// removed: libuv walks PATH and PATHEXT itself, so no shell is needed to *find*
+// the binary — but the walk may land on a `.cmd`/`.bat`, and this cannot know
+// which in advance, so it is deliberately conservative. Everything else,
+// including a `.exe`, spawns directly, so the shell and the quoting below reach
+// only the invocations that cannot do without them.
+//
+// Deliberately a function: a module-level const is fixed at import time, which
+// would make the Windows branch untestable.
+function needsShell(binary) {
+    if (process.platform !== 'win32') {
+        return false;
+    }
+    // win32.extname, not the platform default: this branch only runs on Windows,
+    // where `path` is win32 anyway, and pinning it lets a test model the real
+    // parse rather than posix's (which reads `C:\ws\my.app\gradlew` as `.app\gradlew`).
+    const ext = path_1.win32.extname(binary).toLowerCase();
+    return ext === '' || ext === '.cmd' || ext === '.bat';
+}
+// A line break ends the command line whatever the quoting, so nothing can carry
+// one.
+//
+// `%` is deliberately NOT refused, and this is a known gap rather than a safe
+// case. cmd.exe expands `%VAR%` whether or not the value is quoted — see
+// `quoteShellArg`'s own docstring in ./shell-quoting, which says so and pins it
+// with a test — so quoting contains nothing here. It applies to the binary path
+// as much as to the arguments, and an expansion yielding a `"` defeats the
+// literal-quote refusal below, because that inspects the pre-expansion bytes.
+// `bin/nx.ts` loads the workspace's own `.env` before the graph is built, so a
+// repo can set the variable too.
+//
+// Refusing `%` is what an earlier revision did, and it made any workspace under
+// a `%` path — a legal Windows directory name — fail graph construction. The gap
+// is bounded by the argument that bounds this whole class: a repo that can reach
+// here already has `mvnw` / `pom.xml` executing on its behalf. Closing it
+// properly is tracked as NXC-4798.
+const LINE_BREAK = /[\r\n]/;
+/**
+ * Spawn a binary that may be a Windows `.cmd`/`.bat` shim, without letting its
+ * arguments become shell syntax.
+ *
+ * Off Windows, and for a `.exe`, no shell is involved at all. Where one is —
+ * a shim or a bare name — the binary and every argument are quoted for cmd.exe.
+ *
+ * Not a complete guarantee: cmd.exe expands `%VAR%` in the binary or any
+ * argument whether or not it is quoted, so a caller with untrusted arguments
+ * inherits that gap (NXC-4798). See the note on `LINE_BREAK` above.
+ *
+ * @throws on Windows when the binary or an argument contains a line break, or a
+ * literal `"` (via `quoteShellArg`). Those are the only refusals — the `%`
+ * expansion above is not one of them.
+ */
+function safeSpawn(binary, args, options = {}) {
+    const shell = needsShell(binary);
+    return (0, child_process_1.spawn)(quoteBinary(binary, shell), quoteArgs(args, shell), {
+        ...options,
+        windowsHide: true,
+        shell,
+    });
+}
+/**
+ * Synchronous {@link safeSpawn}, returning the child's stdout.
+ *
+ * Carries the same Windows caveats: `%VAR%` is expanded quoted or not
+ * (NXC-4798), and a line break or literal `"` throws.
+ */
+function safeExecFileSync(binary, args, options = {}) {
+    const shell = needsShell(binary);
+    return (0, child_process_1.execFileSync)(quoteBinary(binary, shell), quoteArgs(args, shell), {
+        stdio: 'pipe',
+        ...options,
+        windowsHide: true,
+        shell,
+        encoding: 'utf-8',
+    });
+}
+// The binary needs quoting too: Node joins it into the same command line, so a
+// path holding a space or an `&` would split there.
+function quoteBinary(binary, shell) {
+    if (!shell) {
+        return binary;
+    }
+    return quoteForCmd(binary, `the path ${JSON.stringify(binary)}`);
+}
+function quoteForCmd(value, described, remedy = '') {
+    if (LINE_BREAK.test(value)) {
+        throw new Error(`Cannot pass ${described} to cmd.exe: a line break inside it would end the command line before cmd.exe reached the rest of it.${remedy}`);
+    }
+    return (0, shell_quoting_1.quoteShellArg)(value);
+}
+function quoteArgs(args, shell) {
+    if (!shell) {
+        return [...args];
+    }
+    return args.map((arg) => quoteForCmd(arg, `the argument ${JSON.stringify(arg)}`, ' Remove it from your Nx configuration and try again.'));
+}

package/dist/src/utils/write-formatted-json-file.d.ts

@@ -1,6 +1,7 @@
 import { type JsonWriteOptions } from './fileutils';
 /**
- * Writes a JSON file, formatting with Prettier if available, otherwise
- * falling back to standard JSON serialization.
+ * Writes a JSON file, formatting it with whichever formatter the workspace is
+ * configured for, and falling back to standard JSON serialization when there
+ * is none or it cannot format the file.
  */
 export declare function writeFormattedJsonFile<T extends object = object>(filePath: string, content: T, options?: JsonWriteOptions): Promise<void>;

package/dist/src/utils/write-formatted-json-file.js

@@ -2,16 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.writeFormattedJsonFile = writeFormattedJsonFile;
 const node_fs_1 = require("node:fs");
-const format_changed_files_with_prettier_if_available_1 = require("../generators/internal-utils/format-changed-files-with-prettier-if-available");
+const format_changed_files_1 = require("../generators/internal-utils/format-changed-files");
 const json_1 = require("./json");
 const fileutils_1 = require("./fileutils");
 const workspace_root_1 = require("./workspace-root");
 /**
- * Writes a JSON file, formatting with Prettier if available, otherwise
- * falling back to standard JSON serialization.
+ * Writes a JSON file, formatting it with whichever formatter the workspace is
+ * configured for, and falling back to standard JSON serialization when there
+ * is none or it cannot format the file.
  */
 async function writeFormattedJsonFile(filePath, content, options) {
-    const formattedContent = await (0, format_changed_files_with_prettier_if_available_1.formatFilesWithPrettierIfAvailable)([{ path: filePath, content: (0, json_1.serializeJson)(content) }], workspace_root_1.workspaceRoot, { silent: true });
+    const formattedContent = await (0, format_changed_files_1.formatFileContents)([{ path: filePath, content: (0, json_1.serializeJson)(content) }], workspace_root_1.workspaceRoot, { silent: true });
     if (formattedContent.has(filePath)) {
         (0, node_fs_1.writeFileSync)(filePath, formattedContent.get(filePath), {
             encoding: 'utf-8',

package/migrations.json

@@ -184,6 +184,12 @@
       "version": "23.0.0-beta.18",
       "description": "Adds .nx/migrate-runs to .gitignore",
       "implementation": "./dist/src/migrations/update-23-0-0/add-migrate-runs-to-git-ignore"
+    },
+    "23-2-0-set-cache-on-executor-target-defaults": {
+      "version": "23.2.0-beta.8",
+      "description": "Sets \"cache\" on some executor-based target defaults whose caching was previously enabled by a target name default, maintaining compatibility with how cacheability resolved before Nx 23. Keys the migration cannot decide are left alone and keep working through a deprecated runtime fallback.",
+      "implementation": "./dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults",
+      "documentation": "./dist/src/migrations/update-23-2-0/set-cache-on-executor-target-defaults.md"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "23.2.0-beta.7",
+  "version": "23.2.0-beta.9",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -47,6 +47,8 @@
   },
   "homepage": "https://nx.dev",
   "dependencies": {
+    "@clack/core": "1.4.3",
+    "@clack/prompts": "1.7.0",
     "@emnapi/core": "1.4.5",
     "@emnapi/runtime": "1.4.5",
     "@emnapi/wasi-threads": "1.0.4",
@@ -56,7 +58,6 @@
     "@yarnpkg/lockfile": "1.1.0",
     "@zkochan/js-yaml": "0.0.7",
     "agent-base": "6.0.2",
-    "ansi-colors": "4.1.3",
     "ansi-regex": "5.0.1",
     "ansi-styles": "4.3.0",
     "argparse": "2.0.1",
@@ -89,13 +90,15 @@
     "ejs": "5.0.1",
     "emoji-regex": "8.0.0",
     "end-of-stream": "1.4.5",
-    "enquirer": "2.3.6",
     "es-define-property": "1.0.1",
     "es-errors": "1.3.0",
     "es-object-atoms": "1.1.1",
     "es-set-tostringtag": "2.1.0",
     "escalade": "3.2.0",
     "escape-string-regexp": "1.0.5",
+    "fast-string-truncated-width": "3.0.3",
+    "fast-string-width": "3.0.2",
+    "fast-wrap-ansi": "0.2.0",
     "figures": "3.2.0",
     "flat": "5.0.2",
     "follow-redirects": "1.16.0",
@@ -148,6 +151,7 @@
     "safe-buffer": "5.2.1",
     "semver": "7.8.4",
     "signal-exit": "3.0.7",
+    "sisteransi": "1.0.5",
     "smol-toml": "1.6.1",
     "string-width": "4.2.3",
     "string_decoder": "1.3.0",
@@ -181,16 +185,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "23.2.0-beta.7",
-    "@nx/nx-darwin-x64": "23.2.0-beta.7",
-    "@nx/nx-freebsd-x64": "23.2.0-beta.7",
-    "@nx/nx-linux-arm-gnueabihf": "23.2.0-beta.7",
-    "@nx/nx-linux-arm64-gnu": "23.2.0-beta.7",
-    "@nx/nx-linux-arm64-musl": "23.2.0-beta.7",
-    "@nx/nx-linux-x64-gnu": "23.2.0-beta.7",
-    "@nx/nx-linux-x64-musl": "23.2.0-beta.7",
-    "@nx/nx-win32-arm64-msvc": "23.2.0-beta.7",
-    "@nx/nx-win32-x64-msvc": "23.2.0-beta.7"
+    "@nx/nx-darwin-arm64": "23.2.0-beta.9",
+    "@nx/nx-darwin-x64": "23.2.0-beta.9",
+    "@nx/nx-freebsd-x64": "23.2.0-beta.9",
+    "@nx/nx-linux-arm-gnueabihf": "23.2.0-beta.9",
+    "@nx/nx-linux-arm64-gnu": "23.2.0-beta.9",
+    "@nx/nx-linux-arm64-musl": "23.2.0-beta.9",
+    "@nx/nx-linux-x64-gnu": "23.2.0-beta.9",
+    "@nx/nx-linux-x64-musl": "23.2.0-beta.9",
+    "@nx/nx-win32-arm64-msvc": "23.2.0-beta.9",
+    "@nx/nx-win32-x64-msvc": "23.2.0-beta.9"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",

package/dist/src/generators/internal-utils/format-changed-files-with-prettier-if-available.js

@@ -1,88 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.formatChangedFilesWithPrettierIfAvailable = formatChangedFilesWithPrettierIfAvailable;
-exports.formatFilesWithPrettierIfAvailable = formatFilesWithPrettierIfAvailable;
-const tslib_1 = require("tslib");
-const path = tslib_1.__importStar(require("path"));
-const is_using_prettier_1 = require("../../utils/is-using-prettier");
-const path_1 = require("../../utils/path");
-const installation_directory_1 = require("../../utils/installation-directory");
-/**
- * Formats all the created or updated files using Prettier
- * @param tree - the file system tree
- *
- * @remarks
- * Set the environment variable `NX_SKIP_FORMAT` to `true` to skip Prettier
- * formatting. This is useful for repositories that use alternative formatters
- * like Biome, dprint, or have custom formatting requirements.
- */
-async function formatChangedFilesWithPrettierIfAvailable(tree, options) {
-    if (process.env.NX_SKIP_FORMAT === 'true') {
-        return;
-    }
-    const excludedPaths = options?.excludePaths
-        ? new Set(Array.from(options.excludePaths, path_1.normalizePath))
-        : undefined;
-    const files = new Set(tree
-        .listChanges()
-        .filter((file) => file.type !== 'DELETE' &&
-        !excludedPaths?.has((0, path_1.normalizePath)(file.path))));
-    const results = await formatFilesWithPrettierIfAvailable(Array.from(files), tree.root, options);
-    for (const [path, content] of results) {
-        tree.write(path, content);
-    }
-}
-async function formatFilesWithPrettierIfAvailable(files, root, options) {
-    const results = new Map();
-    // Check here as well for direct callers of this function
-    if (process.env.NX_SKIP_FORMAT === 'true' || files.length === 0) {
-        return results;
-    }
-    let prettier;
-    try {
-        const prettierPath = require.resolve('prettier', {
-            paths: [...(0, installation_directory_1.getNxRequirePaths)(root), __dirname],
-        });
-        prettier = require(prettierPath);
-        /**
-         * Even after we discovered prettier in node_modules, we need to be sure that the user is intentionally using prettier
-         * before proceeding to format with it.
-         */
-        if (!(0, is_using_prettier_1.isUsingPrettier)(root)) {
-            return results;
-        }
-    }
-    catch { }
-    if (!prettier) {
-        return results;
-    }
-    await Promise.all(Array.from(files).map(async (file) => {
-        try {
-            const systemPath = path.join(root, file.path);
-            let options = {
-                filepath: systemPath,
-            };
-            const resolvedOptions = await prettier.resolveConfig(systemPath, {
-                editorconfig: true,
-            });
-            if (!resolvedOptions) {
-                return;
-            }
-            options = {
-                ...options,
-                ...resolvedOptions,
-            };
-            const support = await prettier.getFileInfo(systemPath, options);
-            if (support.ignored || !support.inferredParser) {
-                return;
-            }
-            results.set(file.path, await prettier.format(file.content.toString('utf-8'), options));
-        }
-        catch (e) {
-            if (!options?.silent) {
-                console.warn(`Could not format ${file.path}. Error: "${e.message}"`);
-            }
-        }
-    }));
-    return results;
-}

package/dist/src/utils/is-using-prettier.d.ts

@@ -1,3 +0,0 @@
-import type { Tree } from '../generators/tree';
-export declare function isUsingPrettier(root: string): boolean;
-export declare function isUsingPrettierInTree(tree: Tree): boolean;

package/dist/src/utils/is-using-prettier.js

@@ -1,62 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isUsingPrettier = isUsingPrettier;
-exports.isUsingPrettierInTree = isUsingPrettierInTree;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const json_1 = require("../generators/utils/json");
-const fileutils_1 = require("./fileutils");
-/**
- * Possible configuration files are taken from https://prettier.io/docs/configuration
- */
-const configFiles = [
-    '.prettierrc',
-    '.prettierrc.json',
-    '.prettierrc.yml',
-    '.prettierrc.yaml',
-    '.prettierrc.json5',
-    '.prettierrc.js',
-    'prettier.config.js',
-    '.prettierrc.ts',
-    'prettier.config.ts',
-    '.prettierrc.mjs',
-    'prettier.config.mjs',
-    '.prettierrc.mts',
-    'prettier.config.mts',
-    '.prettierrc.cjs',
-    'prettier.config.cjs',
-    '.prettierrc.cts',
-    'prettier.config.cts',
-    '.prettierrc.toml',
-];
-function isUsingPrettier(root) {
-    for (const file of configFiles) {
-        if ((0, node_fs_1.existsSync)(file)) {
-            return true;
-        }
-    }
-    // Even if no file is present, it is possible the user is configuring prettier via their package.json
-    const packageJsonPath = (0, node_path_1.join)(root, 'package.json');
-    if ((0, node_fs_1.existsSync)(packageJsonPath)) {
-        const packageJson = (0, fileutils_1.readJsonFile)(packageJsonPath);
-        if (packageJson.prettier) {
-            return true;
-        }
-    }
-    return false;
-}
-function isUsingPrettierInTree(tree) {
-    for (const file of configFiles) {
-        if (tree.exists(file)) {
-            return true;
-        }
-    }
-    // Even if no file is present, it is possible the user is configuring prettier via their package.json
-    if (tree.exists('package.json')) {
-        const packageJson = (0, json_1.readJson)(tree, 'package.json');
-        if (packageJson.prettier) {
-            return true;
-        }
-    }
-    return false;
-}

package/dist/src/utils/min-release-age/npmrc.d.ts

@@ -1,15 +0,0 @@
-export interface NpmrcEntry {
-    key: string;
-    value: string;
-}
-/**
- * Parses an .npmrc file into its `key = value` entries the way npm/npm-conf do:
- * skip blank lines and `#`/`;` comments, split on the first `=`, and trim both
- * sides. The value is returned raw (quote stripping is the caller's concern).
- * Returns null when the file is missing or unreadable so callers can distinguish
- * "no file" from "file with no relevant keys". Shared by the npm and pnpm
- * cooldown readers.
- */
-export declare function readNpmrcEntries(path: string): NpmrcEntry[] | null;
-/** The parsing half of {@link readNpmrcEntries}, usable without a filesystem. */
-export declare function parseNpmrcContent(raw: string): NpmrcEntry[];

package/dist/src/utils/min-release-age/npmrc.js

@@ -1,45 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readNpmrcEntries = readNpmrcEntries;
-exports.parseNpmrcContent = parseNpmrcContent;
-const fs_1 = require("fs");
-/**
- * Parses an .npmrc file into its `key = value` entries the way npm/npm-conf do:
- * skip blank lines and `#`/`;` comments, split on the first `=`, and trim both
- * sides. The value is returned raw (quote stripping is the caller's concern).
- * Returns null when the file is missing or unreadable so callers can distinguish
- * "no file" from "file with no relevant keys". Shared by the npm and pnpm
- * cooldown readers.
- */
-function readNpmrcEntries(path) {
-    if (!(0, fs_1.existsSync)(path)) {
-        return null;
-    }
-    let raw;
-    try {
-        raw = (0, fs_1.readFileSync)(path, 'utf-8');
-    }
-    catch {
-        return null;
-    }
-    return parseNpmrcContent(raw);
-}
-/** The parsing half of {@link readNpmrcEntries}, usable without a filesystem. */
-function parseNpmrcContent(raw) {
-    const entries = [];
-    for (const line of raw.split(/\r?\n/)) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';')) {
-            continue;
-        }
-        const eq = trimmed.indexOf('=');
-        if (eq === -1) {
-            continue;
-        }
-        entries.push({
-            key: trimmed.slice(0, eq).trim(),
-            value: trimmed.slice(eq + 1).trim(),
-        });
-    }
-    return entries;
-}