nx 23.2.0-rc.2 → 23.2.1

package/dist/src/tasks-runner/task-orchestrator.d.ts

@@ -56,6 +56,7 @@ export declare class TaskOrchestrator {
     private discreteTaskExitHandled;
     private continuousTaskExitHandled;
     private cleanupPromise;
+    private signalHandlers;
     constructor(hasher: TaskHasher, initiatingProject: string | undefined, initiatingTasks: Task[], projectGraph: ProjectGraph, taskGraph: TaskGraph, nxJson: NxJsonConfiguration, options: NxArgs & DefaultTasksRunnerOptions, bail: boolean, daemon: DaemonClient, outputStyle: string, fullTaskGraph?: TaskGraph);
     init(): Promise<void>;
     run(): Promise<{
@@ -251,6 +252,8 @@ export declare class TaskOrchestrator {
     private cleanup;
     private performCleanup;
     private setupSignalHandlers;
+    waitForContinuousTaskExit(taskId: string): Promise<void>;
+    dispose(): Promise<void>;
     private cleanUpUnneededContinuousTasks;
 }
 export declare function getThreadPoolSize(options: NxArgs & DefaultTasksRunnerOptions, taskGraph: TaskGraph): {

package/dist/src/tasks-runner/task-orchestrator.js

@@ -105,6 +105,7 @@ class TaskOrchestrator {
         this.discreteTaskExitHandled = new Map();
         this.continuousTaskExitHandled = new Map();
         this.cleanupPromise = null;
+        this.signalHandlers = [];
     }
     async init() {
         this.setupSignalHandlers();
@@ -159,6 +160,7 @@ class TaskOrchestrator {
             this.cache.removeOldCacheRecords();
         }
         await this.cleanup();
+        await this.dispose();
         // Public API (defaultTasksRunner) returns a plain object keyed by
         // task id. Internal state is a Map for faster lookup.
         return Object.fromEntries(this.completedTasks);
@@ -1474,9 +1476,35 @@ class TaskOrchestrator {
                 }
             });
         };
-        process.on('SIGINT', () => handleSignal('SIGINT'));
-        process.on('SIGTERM', () => handleSignal('SIGTERM'));
-        process.on('SIGHUP', () => handleSignal('SIGHUP'));
+        for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+            const handler = () => handleSignal(signal);
+            this.signalHandlers.push([signal, handler]);
+            process.on(signal, handler);
+        }
+    }
+    // Registered at child creation, so unlike subscribing to RunningTask.onExit
+    // after the fact it cannot miss an exit that already happened.
+    waitForContinuousTaskExit(taskId) {
+        return this.continuousTaskExitHandled.get(taskId) ?? Promise.resolve();
+    }
+    // Releases the process-level listeners registered by setupSignalHandlers.
+    // Each closes over `this`, so a long-lived caller (an Nx Cloud agent creates
+    // an orchestrator per invocation) leaks whole orchestrators until they run.
+    async dispose() {
+        // The forked runner's exit handler is the last-resort kill for child
+        // processes, and a batch child can outlive its results message. Reap
+        // children first so removing the handler cannot orphan a live one.
+        try {
+            await this.forkedProcessTaskRunner.cleanup();
+        }
+        catch (e) {
+            console.error('Failed to clean up child processes on dispose:', e);
+        }
+        for (const [signal, handler] of this.signalHandlers) {
+            process.off(signal, handler);
+        }
+        this.signalHandlers = [];
+        this.forkedProcessTaskRunner.removeProcessEventListeners();
     }
     cleanUpUnneededContinuousTasks() {
         const incompleteTasks = this.tasksSchedule.getIncompleteTasks();

package/dist/src/utils/min-release-age/behavior/pnpm.js

@@ -9,6 +9,14 @@ const errors_1 = require("../errors");
 const pick_1 = require("../pick");
 // Ordered newest-bound-first so the first matching row applies.
 const PNPM_BEHAVIOR_ROWS = [
+    {
+        minVersion: '12.0.0',
+        major: 12,
+        strictMode: 'default-loose',
+        strictAutoOnWhenExplicit: true,
+        excludeGrammar: 'v2-globs-unions',
+        writesExcludes: true,
+    },
     {
         minVersion: '11.1.3',
         major: 11,
@@ -134,7 +142,7 @@ function toBoolean(value) {
 async function readPnpmPolicy(root, pmVersion) {
     // A pnpm major newer than the table knows can behave differently; defer to a
     // real install rather than guessing.
-    if ((0, semver_1.gte)(pmVersion, '12.0.0')) {
+    if ((0, semver_1.gte)(pmVersion, '13.0.0')) {
         return {
             outcome: 'ambiguous',
             reason: `pnpm ${pmVersion} is newer than the known cooldown behavior table.`,
@@ -155,15 +163,15 @@ async function readPnpmPolicy(root, pmVersion) {
     }
     const { windowMinutes: explicitWindow, excludes, strictExplicit, ignoreMissingTimeExplicit, } = parseCooldownConfig(config);
     // An explicitly configured window (from whatever surface pnpm honors) wins;
-    // otherwise v11 falls back to its built-in 1440-minute (1 day) default, while
-    // v10 has no default (no cooldown).
+    // otherwise v11 and v12 fall back to the built-in 1440-minute (1 day) default,
+    // while v10 has no default (no cooldown).
     let windowMinutes;
     let windowExplicit;
     if (explicitWindow !== undefined) {
         windowMinutes = explicitWindow;
         windowExplicit = true;
     }
-    else if (row.major === 11) {
+    else if (row.major >= 11) {
         windowMinutes = 1440;
         windowExplicit = false;
     }
@@ -178,14 +186,14 @@ async function readPnpmPolicy(root, pmVersion) {
     const cutoffMs = Date.now() - windowMs;
     const sourceDescription = `pnpm minimumReleaseAge (${windowMinutes} min)`;
     const strict = resolveStrict(row, strictExplicit, windowExplicit);
-    // v10 always errors on missing time; v11 defaults to skip unless a surface
-    // explicitly disabled it.
-    const ignoreMissingTime = row.major === 11 ? (ignoreMissingTimeExplicit ?? true) : false;
+    // v10 always errors on missing time; v11 and above default to skip unless a
+    // surface explicitly disabled it.
+    const ignoreMissingTime = row.major >= 11 ? (ignoreMissingTimeExplicit ?? true) : false;
     const behavior = {
         packageManager: 'pnpm',
         strict,
-        // Loose fallback only exists on v11 when strict is off.
-        looseFallback: row.major === 11 && !strict,
+        // Loose fallback only exists from v11 onwards when strict is off.
+        looseFallback: row.major >= 11 && !strict,
         writesExcludes: row.writesExcludes,
         missingTimeMap: row.major === 10 ? 'error' : ignoreMissingTime ? 'skip' : 'error',
     };

package/dist/src/utils/package-json.js

@@ -23,6 +23,7 @@ const target_merging_1 = require("../project-graph/utils/project-configuration/t
 const catalog_1 = require("./catalog");
 const fileutils_1 = require("./fileutils");
 const has_nx_js_plugin_1 = require("./has-nx-js-plugin");
+const path_2 = require("./path");
 const installation_directory_1 = require("./installation-directory");
 const package_manager_1 = require("./package-manager");
 const workspace_root_1 = require("./workspace-root");
@@ -35,15 +36,25 @@ function normalizePackageGroup(packageGroup) {
         }));
 }
 function readNxMigrateConfig(json) {
+    // Registry fetching uses this value to build a temporary extraction path.
+    // Reject unsupported absolute paths and escaping parent traversal before extraction.
+    const assertContained = (migrations) => {
+        if (!(0, path_2.isContainedRelativePath)(migrations)) {
+            throw new Error(`Invalid migrations path "${migrations}" in package "${json.name ?? 'unknown'}@${json.version ?? 'unknown'}": migration paths must not be absolute or escape their base directory through parent traversal.`);
+        }
+        return migrations;
+    };
     const parseNxMigrationsConfig = (fromJson) => {
         if (!fromJson) {
             return {};
         }
         if (typeof fromJson === 'string') {
-            return { migrations: fromJson, packageGroup: [] };
+            return { migrations: assertContained(fromJson), packageGroup: [] };
         }
         return {
-            ...(fromJson.migrations ? { migrations: fromJson.migrations } : {}),
+            ...(fromJson.migrations
+                ? { migrations: assertContained(fromJson.migrations) }
+                : {}),
             ...(fromJson.packageGroup
                 ? { packageGroup: normalizePackageGroup(fromJson.packageGroup) }
                 : {}),

package/dist/src/utils/params.js

@@ -443,7 +443,7 @@ function applyVerbosity(options, schema, isVerbose) {
 }
 function combineOptionsForExecutor(commandLineOpts, config, target, schema, defaultProjectName, relativeCwd, isVerbose = false) {
     const r = convertAliases(coerceTypesInOptions(convertToCamelCase(commandLineOpts, schema), schema), schema, false);
-    let combined = target.options || {};
+    let combined = { ...target.options };
     if (config && target.configurations && target.configurations[config]) {
         Object.assign(combined, target.configurations[config]);
     }

package/dist/src/utils/path.d.ts

@@ -8,6 +8,12 @@ export declare function normalizePath(osSpecificPath: string): string;
  * This should not be used to read files on disk because of the removal of Windows drive letters.
  */
 export declare function joinPathFragments(...fragments: string[]): string;
+/**
+ * True when `relativePath` stays inside the directory it is resolved against.
+ * Absolute paths are rejected because `path.join` silently treats them as
+ * relative, so they would otherwise slip past a `..` check.
+ */
+export declare function isContainedRelativePath(relativePath: string): boolean;
 /**
  * When running a script with the package manager (e.g. `npm run`), the package manager will
  * traverse the directory tree upwards until it finds a `package.json` and will set `process.cwd()`

package/dist/src/utils/path.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizePath = normalizePath;
 exports.joinPathFragments = joinPathFragments;
+exports.isContainedRelativePath = isContainedRelativePath;
 exports.getCwd = getCwd;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
@@ -23,6 +24,20 @@ function normalizePath(osSpecificPath) {
 function joinPathFragments(...fragments) {
     return normalizePath(path.join(...fragments));
 }
+/**
+ * True when `relativePath` stays inside the directory it is resolved against.
+ * Absolute paths are rejected because `path.join` silently treats them as
+ * relative, so they would otherwise slip past a `..` check.
+ */
+function isContainedRelativePath(relativePath) {
+    if (path.isAbsolute(relativePath)) {
+        return false;
+    }
+    const normalized = path.normalize(relativePath);
+    return !(normalized === '..' ||
+        normalized.startsWith(`..${path.sep}`) ||
+        normalized.startsWith(`..${path.posix.sep}`));
+}
 /**
  * When running a script with the package manager (e.g. `npm run`), the package manager will
  * traverse the directory tree upwards until it finds a `package.json` and will set `process.cwd()`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "23.2.0-rc.2",
+  "version": "23.2.1",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -185,16 +185,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "23.2.0-rc.2",
-    "@nx/nx-darwin-x64": "23.2.0-rc.2",
-    "@nx/nx-freebsd-x64": "23.2.0-rc.2",
-    "@nx/nx-linux-arm-gnueabihf": "23.2.0-rc.2",
-    "@nx/nx-linux-arm64-gnu": "23.2.0-rc.2",
-    "@nx/nx-linux-arm64-musl": "23.2.0-rc.2",
-    "@nx/nx-linux-x64-gnu": "23.2.0-rc.2",
-    "@nx/nx-linux-x64-musl": "23.2.0-rc.2",
-    "@nx/nx-win32-arm64-msvc": "23.2.0-rc.2",
-    "@nx/nx-win32-x64-msvc": "23.2.0-rc.2"
+    "@nx/nx-darwin-arm64": "23.2.1",
+    "@nx/nx-darwin-x64": "23.2.1",
+    "@nx/nx-freebsd-x64": "23.2.1",
+    "@nx/nx-linux-arm-gnueabihf": "23.2.1",
+    "@nx/nx-linux-arm64-gnu": "23.2.1",
+    "@nx/nx-linux-arm64-musl": "23.2.1",
+    "@nx/nx-linux-x64-gnu": "23.2.1",
+    "@nx/nx-linux-x64-musl": "23.2.1",
+    "@nx/nx-win32-arm64-msvc": "23.2.1",
+    "@nx/nx-win32-x64-msvc": "23.2.1"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",