Repository navigation
chore(deps): update Nx to 22.7.12 - #101
Merged
frontegg-david merged 1 commit intoOct 4, 2026
Merged
Conversation
Fixes two Dependabot alerts on nx 22.4.4 (development only): GHSA-vp3h-ghgh-jr7g (high, Zip-Slip in the self-hosted remote cache, fixed in 22.7.7) and GHSA-g2r8-wvmj-jf5w (medium, permissive CORS on the nx graph dev server, fixed in 22.7.2). Done with nx migrate 22.7.12: nx and every @nx/* package move to 22.7.12, along with the SWC versions Nx 22.7 expects (@swc-node/register ~1.12.1, @swc/core ~1.16.2, @swc/helpers ~0.5.23; tilde ranges kept). The migrations only add Nx's working directories (.nx/polygraph, .nx/self-healing, .claude/worktrees) to .gitignore and .prettierignore; the @nx/eslint lint-inputs migration made no change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. 🧰 Additional context used📚 Code guidelines (1)No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour. 📝 WalkthroughWalkthroughThe package manifest updates Nx and SWC dependency versions. The ignore files add exclusions for ChangesTooling dependency updates
Ignored generated paths
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~5 minutes Change: Other Merge Risk: ⚪ Minimal · up to The dependency update is consistent with the lockfile, and no merge-blocking risk is evident. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
This was referenced Oct 4, 2026
frontegg-david
added this pull request to stack #97
October 4, 2026 10:32
alexmercerpo
approved these changes
Oct 4, 2026
frontegg-david
added a commit
that referenced
this pull request
Oct 4, 2026
Resolves the remaining 51 open Dependabot alerts (#101 handles the two on nx itself). All of them are transitive dependencies in yarn.lock. - yarn up -R moves each vulnerable package to the newest version its parents' ranges allow: undici, js-yaml, baseline-browser-mapping, svgo, qs, browserslist, fast-uri, @humanfs/node, postcss-selector-parser, postcss, brace-expansion, tar, body-parser, webpack-dev-server, shell-quote, immutable, websocket-driver, http-proxy-middleware and @babel/core. - The floors in "resolutions" left by earlier alert fixes (qs, immutable, shell-quote, svgo, fast-uri, webpack-dev-server) are raised to the patched versions, so a re-resolve cannot go back below them. - Scoped resolutions where a parent pins a vulnerable version exactly or allows no patched one: nx/brace-expansion ^5.0.9 (nx pins 5.0.8) and sockjs/uuid ^11.1.1 (sockjs, under webpack-dev-server, allows only ^8.3.2 and uuid has no patched 8.x; sockjs only calls require('uuid').v4, which uuid 11 still exports). Also fixes advisories yarn npm audit reports that Dependabot has not raised: axios 1.18.0 to 1.20.0 (several high), ajv 8.12.0 to 8.20.0 (serve/ajv, serve pins it exactly) and 6.12.6 to 6.15.0, smol-toml 1.6.1 to 1.9.0 (nx/smol-toml, nx pins it exactly). Still reported: braces 3.0.3, which has no patched release, and deprecation notices (eslint 9.39.2, glob 10.5.0, memfs 3.6.0, whatwg-encoding). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack 9/10:
main← #92 ← #93 ← #94 ← #95 ← #96 ← #98 ← #99 ← #100 ← this ← #102Dependabot, part 1 of 2: the two alerts on
nxitself (development only).nx graphdev server permissive CORS policyChange
Done with
nx migrate 22.7.12andnx migrate --run-migrations:nxand every@nx/*package: 22.4.4 → 22.7.12.@swc-node/register~1.11.1 → ~1.12.1,@swc/core~1.15.11 → ~1.16.2,@swc/helpers~0.5.18 → ~0.5.23. Nx writes exact pins; I kept the repo's tilde ranges..gitignoreones add Nx's working directories (.nx/polygraph,.nx/self-healing,.claude/worktrees), and.nx/self-healingalso goes into.prettierignore.@nx/eslint: update-executor-lint-inputsmade no change.migrations.jsonis not committed.Verification (after
nx reset)yarn lint,yarn format:check,yarn build(13 projects): passnx run-many -t test(10 projects), core jest (67 suites, 2376 passed), core perf (48 passed), browser e2e (90 passed): pass🤖 Generated with Claude Code
Summary by CodeRabbit