Skip to content

feat: add NX workspace fixtures and documentation#755

Open
Demiserular wants to merge 1 commit into
OWASP:mainfrom
Demiserular:feat/nx-workspace-fixtures
Open

feat: add NX workspace fixtures and documentation#755
Demiserular wants to merge 1 commit into
OWASP:mainfrom
Demiserular:feat/nx-workspace-fixtures

Conversation

@Demiserular

@Demiserular Demiserular commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

I added NX workspace fixtures and documentation to demonstrate CVE Lite CLI compatibility with NX integrated and package-based monorepo configurations, including a fixture that documents the known gap in mixed scenario handling.

Why this change

CVE Lite CLI needed verified NX workspace examples and documentation to help users understand how to scan NX monorepos. Testing revealed a known gap in mixed scenarios (root lockfile + nested lockfiles) that needed to be documented with workarounds.

What changed

  • Added examples/nx-integrated fixture for NX integrated repos (single root lockfile)
  • Added examples/nx-package-based fixture for NX package-based repos (per-project lockfiles under apps/ and libs/)
  • Added examples/nx-mixed fixture demonstrating mixed scenario gap with README documenting the workaround
  • Added website/docs/nx-workspaces.md with NX scanning guide and recommended command cve-lite . --search-depth 4
  • Updated examples/readme.md with all three NX fixtures in the table and usage commands

Validation

Tested all three fixtures:

  • nx-integrated: Successfully scans root lockfile and finds vulnerable axios@0.19.0
  • nx-package-based: With --search-depth 4, discovers both nested lockfiles, scans independently, labels findings by folder path, provides project-specific fix commands
  • nx-mixed: Confirms documented gap - only root lockfile scanned, nested lockfile not discovered (expected behavior)

User-facing impact

Does this change:

  • affect scanning behavior
  • affect output formatting
  • affect JSON output
  • affect docs only

Notes

Fixes #688
Scope: Fixtures and docs only. No code changes for mixed scenario handling (out of scope - will be handled separately using these fixtures for testing). The mixed scenario gap is documented in both the docs and the fixture README with workarounds provided.

- Add examples/nx-integrated fixture for NX integrated repos
- Add examples/nx-package-based fixture for NX package-based repos
- Add examples/nx-mixed fixture demonstrating mixed scenario gap
- Add website/docs/nx-workspaces.md with NX scanning guide
- Update examples/readme.md with NX fixtures

Scope: Fixtures and docs only. No code changes for mixed scenario handling
(out of scope - will be handled separately using these fixtures for testing).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: verify and fix CVE Lite CLI compatibility with NX workspaces

1 participant