[dependabot]

Bumps nx from 23.2.1 to 23.3.0.

Release notes

Sourced from nx's releases.

23.3.0 (2026-10-07)

🚀 Features

• angular: support ngrx v22 (#36950)
• angular-rspack: scaffold and run SSR apps on the @​angular/ssr application engine (#36298)
• core: emit a runbook and per-step instructions for orchestrated migrate runs (#36766)
• core: report the cache location alongside usage (#36959)
• core: share one workspace walk across processes through the files archive (#36980)
• core: hash a continuous dependency's inputs into the task it serves (#37017)
• core: guarantee terminal output files and add an agent-friendly summary output style (#36703)
• core: add includeIgnored filesets and let the workspace context own the daemon's watch (#37025)
• core: cache plugin capabilities so reading them costs at most one load (#36999)
• core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#36918)
• core: add sandbox target configuration for observed-IO opt-out (#36853)
• core: hash tasks from Nx Cloud I/O snapshots (#37036)
• core: replace the sandbox target property with ultracache (#37165)
• core: opt in to selecting affected tasks instead of projects (#36825)
• core: record unresolved migrations and cap retries in orchestrated migrate runs (#36986)
• core: report an active orchestrated migrate run instead of resuming it (#36988)
• core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#36989)
• core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#37242)
• core: explain why each task is affected with --explain (#36885)
• core: run a final agent validation pass at the end of an orchestrated migrate run (#37069)
• js: cache TypeScript reference expansion during createNodes (#37003, #37002)
• linter: add a batched @​nx/oxlint:lint executor (#36827)
• nx-cloud: add nx cloud demo link to cloud prompts (#36956)
• nx-cloud: remove the never option from the nx cloud prompt (#37079)
• repo: add a .NET example for @​nx/dotnet (#36701)
• testing: support cypress v16 (#36953)
• vitest: support vitest 5 (#37142)

🩹 Fixes

• angular: correct declaration maps and exports of buildable libraries (#36373, #36357)
• angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#36972, #36970)
• angular-rspack: keep class field closures per instance in minified builds (#37066, #37050)
• angular-rspack: update piscina to address critical vulnerability (#37252)
• bundling: write the esbuild bundle to an overridden outputPath (#37101, #37091)
• bundling: clear typescript update timer when a rollup build closes its watch program (#37196)
• core: separate daemon runtime env from graph identity (#36565, #36564)
• core: validate the migrations path before extracting package migrations (#36887)
• core: release per-run process listeners and task history results (#36866)
• core: read the pnpm 12 min-release-age policy instead of deferring to an install (#36915, #36914)
• core: carry minimumReleaseAge into pruned pnpm deploy output (#36900, #36899)
• core: report how a plugin worker was lost instead of always calling it an exit (#36894)
• core: keep the cache in the workspace on CI (#36922)
• core: restore the wasm walker imports dropped by a stray cfg attribute (#36924)
• core: avoid mutating target options when resolving configurations (#36934)
• core: carry pnpm's package-manager document into the pruned lockfile (#36947)

... (truncated)

Commits

• 2b305ee fix(core): accept --final-validation with a migrate CLI pinned below 23.2.0 (...
• d133deb fix(core): size the default cache bound from its own filesystem (#37269)
• cd1ea02 fix(core): reuse the stored ultracache configurations without an age limit (#...
• e09f772 fix(core): stop merging declared negations into ultracache file groups (#37304)
• a0dc568 chore(core): update smol-toml to 1.9.0 for GHSA-r4xh-jqrq-34v2 (#37293)
• a26644b fix(core): answer daemon output tracking from the workspace context (#37217)
• 3ec060f fix(core): keep ultracache exclusions with the globs they trim (#37285)
• af0b4fb feat(core): run a final agent validation pass at the end of an orchestrated m...
• ead0427 fix(core): skip batch cache lookups for deferred tasks until their deps run (...
• da9d339 feat(core): explain why each task is affected with --explain (#36885)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

lambdas/yarn.lock

Name	Version	Vulnerability	Severity
undici	7.29.0	undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects	high
		undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent	high
		undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation	high
		undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool	high
		undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	high
		undici vulnerable to Denial of Service via unrequested WebSocket subprotocol	high
		undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering	moderate
		undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor	moderate
		undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	moderate
		undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens	moderate
		undici vulnerable to Denial of Service via orphaned RetryHandler response body	moderate
		undici vulnerable to Denial of Service via unbounded decompression of compressed responses	moderate
		undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches	moderate
		undici vulnerable to Denial of Service via WebSocketStream unclean close	moderate
		undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression	moderate
		undici vulnerable to downstream response splitting via retry interceptor	low
		undici vulnerable to response truncation via oversized chunked responses in the dump interceptor	low
		undici vulnerable to caching and replay of unsafe HTTP method responses	low

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/undici	7.29.0	🟢 8.2	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Code-Review 🟢 7 Found 15/21 approved changesets -- score normalized to 7 Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 8 binaries present in source code Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Vulnerabilities 🟢 9 1 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ -1 no releases found Fuzzing 🟢 10 project is fuzzed SAST 🟢 10 SAST tool is run on all commits CI-Tests 🟢 10 24 out of 24 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 58 contributing companies or organizations
npm/@nx/nx-darwin-arm64	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-darwin-x64	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-freebsd-x64	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-linux-arm-gnueabihf	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-linux-arm64-gnu	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-linux-arm64-musl	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-linux-x64-gnu	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-linux-x64-musl	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-win32-arm64-msvc	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/@nx/nx-win32-x64-msvc	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits
npm/ignore	7.0.6	🟢 3.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 1 Found 4/26 approved changesets -- score normalized to 1 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/nx	23.3.0	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 7 binaries present in source code Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 7 SAST tool detected but not run on all commits

Scanned Files

• lambdas/yarn.lock

[edersonbrilhante]

@dependabot recreate

[edersonbrilhante]

@dependabot rebase

[edersonbrilhante]

@dependabot recreate