Skip to content

chore(deps): Update all non-major dependencies - #820

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major-dependencies
Open

chore(deps): Update all non-major dependencies#820
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF
@nx/js (source) devDependencies minor 23.1.3 → 23.2.1 OpenSSF Scorecard
@types/node (source) devDependencies minor 26.2.0 → 26.5.1 OpenSSF Scorecard
@types/react (source) devDependencies minor ^19.2.18 → ^19.3.0 OpenSSF Scorecard
node (source) minor 24.19.0 → 24.21.0 OpenSSF Scorecard
nx (source) devDependencies minor 23.1.3 → 23.2.1 OpenSSF Scorecard
pnpm (source) packageManager minor 11.24.0 → 11.27.0 OpenSSF Scorecard
react (source) peerDependencies minor >=19.2.8 → >=19.3.0 OpenSSF Scorecard
react (source) devDependencies minor ^19.2.8 → ^19.3.0 OpenSSF Scorecard
react-dom (source) peerDependencies minor >=19.2.8 → >=19.3.0 OpenSSF Scorecard

Release Notes

nrwl/nx (@​nx/js)

v23.2.1

Compare Source

23.2.1 (2026-09-09)
🚀 Features
🩹 Fixes
  • angular: correct declaration maps and exports of buildable libraries (#​36373, #​36357)
  • core: separate daemon runtime env from graph identity (#​36565, #​36564)
  • core: validate the migrations path before extracting package migrations (#​36887)
  • core: release per-run process listeners and task history results (#​36866)
  • core: read the pnpm 12 min-release-age policy instead of deferring to an install (#​36915, #​36914)
  • core: carry minimumReleaseAge into pruned pnpm deploy output (#​36900, #​36899)
  • core: report how a plugin worker was lost instead of always calling it an exit (#​36894)
  • core: keep the cache in the workspace on CI (#​36922)
  • core: restore the wasm walker imports dropped by a stray cfg attribute (#​36924)
  • core: avoid mutating target options when resolving configurations (#​36934)
  • js: resolve tsconfig to absolute path so ${configDir} paths type-check without baseUrl (#​36445)
  • misc: scan package projects for env vars (#​36847)
  • release: exclude AI coding agents from the changelog Thank You section (#​36892)
  • release: use the release group name when resolving the previous tag for fixed groups (#​36554)
  • repo: provision JDK 17 for Gradle builds with mise (#​36965)
  • repo: guard JAVA17_HOME against an uninstalled JDK (#​36969)
  • rspack: write the normalized cache option in NxAppRspackPlugin (#​36905, #​36878)
❤️ Thank You

v23.2.0

Compare Source

23.2.0 (2026-09-02)
🚀 Features
  • angular: add support for Angular v22.1 (#​36521)
  • core: confirm before creating migration commits on the default branch (#​36314)
  • core: add a full-width TUI status bar and vim-style pane search (#​36263)
  • core: forward mouse and resize events to tasks running in the TUI's pty (#​36322)
  • core: add bun dependency-catalog support (#​36434)
  • core: derive stable repo key from normalized remote and relative path (#​36439)
  • core: add nx migrate --run-migration to run a single migration (#​36407)
  • core: let migration generators skip their AI step (#​36532)
  • core: show Cloud app link for remote cache instead of docs (#​36460)
  • core: add durable run state and a dark orchestration loop to nx migrate (#​36403)
  • core: add built-in support for oxfmt formatter alongside prettier (#​35089, #​30403)
  • core: filter static task output to failures and restore CI log grouping (#​36453)
  • core: let the daemon and plugin workers run inside agent sandboxes (#​36586)
  • dotnet: infer OpenApiDocumentsDirectory as a build output (#​36788)
  • linter: add the @​nx/oxlint plugin (#​36491)
  • linter: hash only lintable files for inferred oxlint tasks (#​36828)
  • misc: support vitest generation for node, nest, and express generators (#​36665)
  • nx-cloud: generate .nx/ci-config.yaml for agent distribution (#​36504)
  • nx-cloud: add nx start-nx-agents as an alias for nx-cloud start-nx-agents (#​36572)
  • nx-plugin: add vitest support for e2e tests (#​34041)
  • release: support tag-based project selection (#​36537)
  • repo: add react + vite + vitest + playwright example (#​35921)
  • storybook: adopt the storybook vitest addon for story testing (#​36648, #​33759)
  • testing: offer vitest consistently across generators with a unitTestRunner option (#​36715)
🩹 Fixes
  • angular: make webpack-related packages optional peer dependencies (#​36310)
  • angular: keep buildable libraries private (#​36545)
  • angular: import optional ng-packagr lazily (#​36632)
  • angular-rspack: speed up builds and align behavior with the esbuild application builder (#​36268, #​34936)
  • angular-rspack: stop builds crashing on non-array styleUrls (#​36550)
  • angular-rspack: rebuild components when their templates or styles change on Windows (#​36641, #​36619)
  • bundling: support TypeScript esbuildConfig files in the esbuild executor (#​36352, #​36349)
  • bundling: acknowledge @​swc/core build scripts when configuring rollup (#​36412)
  • bundling: resolve esbuild paths from workspace root instead of cwd (#​36830, #​34027)
  • bundling: allow overriding the css module hash algorithm (#​36837, #​36829)
  • core: speed up npm lockfile parsing (#​36216)
  • core: speed up lockfile parsing and catalog resolution (#​36223)
  • core: show performance report recommendations only when actionable (#​36344)
  • core: close daemon log descriptors after spawn to avoid Node 26 crash (#​36280)
  • core: prevent shell injection in nx import (#​36348)
  • core: correct the 22.6.0 gitignore and analytics migration wiring (#​36356)
  • core: support npm 12 and pnpm in the package provenance check (#​36354, #​36338)
  • core: honor pnpm minimumReleaseAge config on pnpm 11 (#​36335, #​36330)
  • core: support pnpm 11 patched dependency hashes (#​36360)
  • core: resolve name refs copied into pattern-matched target arrays (#​36359)
  • core: resolve source-loaded plugin transitive workspace imports (#​36296)
  • core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#​36302)
  • core: include continuous and default-config dependencies in show target (#​36374)
  • core: make unit tests pass locally regardless of invoking package manager (#​35994)
  • core: respect --aiAgents none to skip AI agent file generation (#​34944, #​34692)
  • core: use --config.frozen-lockfile=false for pnpm add during migrate (#​36337)
  • core: run selected projects with --exclude-task-dependencies (#​35562)
  • core: stop passing git revisions through a shell in affected commands (#​36379)
  • core: collect trickling watcher bursts fully on daemon force-flush (#​36391)
  • core: report tasks running in another Nx process in the inline TUI (#​36341)
  • core: stop ratatui cursor queries from racing the TUI event stream (#​36318)
  • core: render critical-path tasks as a nested list in the job summary (#​36394)
  • core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#​36411)
  • core: support multiple brace groups in workspace glob matching (#​36395)
  • core: handle CRLF line endings in pnpm multi-document lockfiles (#​36419, #​35828, #​35840)
  • core: correct glob pattern expansion for ZeroOrOne groups (#​31857)
  • core: stop re-querying confirmed cache misses in task orchestrator (#​36301, #​35632)
  • core: sample project graph perf span telemetry per session at 10% (#​36420)
  • core: strip terminal query sequences when replaying task output (#​36432)
  • core: preserve FORCE_COLOR=0 intent for forked child tasks (#​35293)
  • core: handle colons in target name when resolving inputs to generate graph (#​36429, #​33710)
  • core: merge default plugins through the source-map-aware merge path (#​36257)
  • core: keep nx migrate on the requested version when release-age gates interfere (#​36444)
  • core: avoid bogus duplicate project name errors when generating nested apps (#​36458)
  • core: make tui cloud icon visible on light terminal themes (#​36495)
  • core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#​36497)
  • core: bump pinned axios and brace-expansion past vulnerable versions (#​36507, #​36474)
  • core: parse pnpm lockfiles that omit the packages block (#​36512)
  • core: keep real dependencies when omitting peers from npm temp installs (#​36518)
  • core: normalize resolved module paths (#​36556, #​36549)
  • core: stop pruneProjectGraph from mutating the source project graph (#​36517, #​36470)
  • core: make preset empty work without github.com and improve template download errors (#​36508)
  • core: drain to stdout before exiting nx affected (#​36569, #​36568)
  • core: update brace-expansion to 5.0.9 for CVE-2026-14257 (#​36577)
  • core: restrict daemon and plugin worker socket access to the owning user (#​36370)
  • core: drain stdout before exiting nx run-many and nx run (#​36607, #​36606)
  • core: re-spawn nx migrate without a shell to preserve argv exactly (#​36215)
  • core: resolve main worktree root without a Windows verbatim prefix (#​36649, #​35637)
  • core: accept bun.lock lockfileVersion 2 and 3 (#​36666)
  • core: maintain cacheability when an executor target default applies (#​36477)
  • core: don't leave an unkillable nx process when a terminal closes (#​36683, #​36682)
  • core: honor the package manager's registry config in nx migrate (#​35954, #​35843)
  • core: resolve telemetry DNS in-process to avoid a getenv segfault (#​36673)
  • core: skip target group members without a target (#​36711, #​36712)
  • core: stop resending accumulated task hash results to the daemon when hashing tasks (#​36716)
  • core: apply package.json updates unblocked by later package groups (#​36636)
  • core: create external nodes for out-of-workspace link dependencies (#​36745)
  • core: point duplicate project names from worktrees at the fix (#​36734)
  • core: exclude volatile shell and editor env vars from the daemon (#​36642, #​36610)
  • core: stop the daemon before nx add installs a package (#​36767)
  • core: do not allowlist the analytics domain when analytics are off (#​36663, #​36486)
  • core: isolate pnpm version detection from workspace (#​36728, #​36727)
  • core: key the main-worktree-root cache on the workspace root (#​36768)
  • core: give pnpm a fresh cache dir per e2e run (#​36802)
  • core: apply targetDefaults options to an inferred target that is not redeclared (#​36717, #​36700)
  • core: devkit util - detect esm config with top level await (#​33644)
  • core: share worktree cache under ~/.nx so agent sandboxes can reach it (#​36514)
  • core: compare daemon workspace roots case-insensitively on Windows (#​36835, #​36722)
  • core: raise the nx package vitest timeout to cover the graph recompute spec (#​36850)
  • core: single-inference convert-to-inferred engine with centralized config (#​36547)
  • core: fall back to v8 for oversized daemon responses and length-prefix the wire protocol (#​36838)
  • core: use scoped config form for pnpm 11+ publish (#​36867, #​36860)
  • devkit: resolve ensurePackage against the workspace (#​36496)
  • devkit: honour cascading ignore files in tree walks and generator formatting (#​36575)
  • devkit: correct version floor validation for ranges and prereleases (#​36724)
  • devkit: reload TS config files fresh instead of serving stale cached modules (#​36656)
  • docker: run release pipeline docker commands without a shell (#​36505)
  • docker: skip unchanged version action projects (#​36542)
  • dotnet: make msbuild-analyzer run cancellable and kill it when the host process exits (#​36813)
  • dotnet: derive output paths from MSBuild instead of hardcoded assumptions (#​36804)
  • expo: keep the expo dev server alive under jest (#​36635)
  • expo: derive metro projectRoot and node_modules from the app being bundled (#​36650, #​36531)
  • gradle: emit valid Groovy when applying the plugin to an existing allprojects block (#​36697)
  • gradle: surface project graph timeout errors when the process ignores the kill signal (#​36713)
  • gradle: compile Kotlin in-process in the e2e fixture (#​36803)
  • gradle: support builds that configure subprojects from an ancestor build file (#​36693, #​36668)
  • gradle: retry nxProjectGraph on lock timeout and kill orphaned gradle builds on exit (#​36806)
  • js: support private methods and static blocks in babel preset (#​36218, #​36205)
  • js: parse pnpm/npm publish JSON containing braces in file paths (#​36241, #​36236)
  • js: resolve the verdaccio bin through its package.json (#​36479)
  • js: resolve package and extension-less tsconfig extends read from the tree (#​36271)
  • js: avoid duplicate node start without watch (#​36695, #​36694)
  • js: resolve override selectors in affected detection (#​36699, #​36698)
  • js: make pruned pnpm output installable and run its workspace modules (#​36139, #​36055, #​36066, #​36140, #​35425, #​18402)
  • js: keep the deprecated-prepend warning in the task's terminal output (#​36789)
  • js: detect all files changed during lock file update (#​34856)
  • linter: keep override parser when convert-to-flat-config uses FlatCompat (#​36363)
  • linter: use projectService for typed linting in flat configs (#​35727)
  • linter: restore the nx subpath ban in the create-* oxlint configs (#​36821)
  • linter: declare .gitignore as an input for inferred oxlint tasks (#​36869)
  • linter: flag banned external imports reached through internal projects (#​36654, #​36519)
  • linter: stop an inferred oxlint task from linting nested projects (#​36873)
  • maven: stop running maven and gradle graph analysis through a shell (#​36626)
  • maven: stop writing a failing task's output three times (#​36790)
  • misc: resolve CSS url() assets on Windows in postcss-cli-resources (#​36353, #​36336)
  • misc: suppress outdated disclaimer for unsupported AI agents with AGENTS.md (#​36324, #​36264)
  • misc: bump ci-workflow generator to node 24 and current action majors (#​36364)
  • misc: preserve package alias keys in generated package.json (#​35207)
  • misc: prevent crash when opening browser in Podman+WSL container (#​34639)
  • misc: move plugin internal imports to devkit/internal (#​36430)
  • misc: use workspaceRoot in workspaceModule path (#​35142)
  • misc: bump css-loader so npm can resolve rspack core 2 (#​36643)
  • misc: make generated code lint-clean under oxlint defaults (#​36749)
  • misc: de-flake the nx watch e2e suite (#​36758)
  • misc: ignore bundled snapshots when pruning npm lockfiles (#​36763, #​36672)
  • module-federation: do not cache static remote assets in the dev-server plugin (#​36279, #​36278)
  • module-federation: strip version suffix from npm dependency names for bun compatibility (#​34960)
  • nextjs: stop installing unused Next.js ESLint packages from the library generator (#​36779)
  • nextjs: describe the library generator and export its server entry (#​36776)
  • nextjs: stop installing unused babel-jest for generated apps (#​36765)
  • nextjs: respect the src option when setting sourceRoot in the application generator (#​36833, #​35181)
  • nextjs: expose compiler and inSourceTests options in the library generator (#​36780)
  • nextjs: make built next.config load without @​nx/next installed (#​36655, #​36511)
  • nx-dev: keep the kb index working for uncommitted articles (#​36588)
  • nx-dev: update docs pricing link (#​36625)
  • nx-dev: let six legacy backlink paths reach their redirects (#​36819)
  • nx-dev: show repository path in light mode (#​36818)
  • react: make module federation packages optional peer dependencies (#​36492)
  • react: write the dev-server port onto the generated serve target (#​36589)
  • react-native: include migration docs in the built package (#​36378)
  • release: only extract body issue references linked via closing keywords (#​36326, #​123)
  • release: ignore deleted projects in historical affectedness (#​36538)
  • release: support custom conventional commit types (#​36539)
  • release: skip changelog resolution for unversioned projects (#​36544)
  • release: preserve package.json formatting (#​36540)
  • release: Don't attribute commits with no author email to @find (#​36526)
  • release: resolve out-of-set local dependency versions (#​36334)
  • repo: bump decompress to safe version (#​36333)
  • repo: drop stale e2e dependsOn overrides that omit the local registry (#​36482)
  • repo: serialize cypress installs and skip the binary when unused (#​36493)
  • repo: tell review-pr agents to compare base and HEAD with git (#​36644)
  • repo: restore missing linux native binding entries to pnpm-lock (#​36785)
  • repo: stop CI cache churn from evicting the cargo caches (#​36801)
  • repo: serve nx executor schema reads from source in unit tests (#​36809)
  • repo: stop pnpm from installing inside nx script tasks (#​36839)
  • repo: stop parallel sandbox reviews from clobbering each other's registry (#​36840)
  • rspack: lazy-load @​rspack/core in create-compiler to avoid eager ESM resolution (#​36476)
  • rspack: preload @​rspack/core before loading rspack config files (#​36687, #​36685)
  • storybook: update configuration generator nx.json (#​34880, #​34879)
  • testing: add @​swc/core when configuring jest with the swc compiler (#​36409)
  • testing: reserve dev-server ports in the react-router e2e suite (#​36585)
  • testing: install typescript in npm e2e workspaces to keep tsquery off TypeScript 7 (#​36478)
  • testing: unblock Cypress component testing on Angular 22.1 (#​36637)
  • testing: prevent playwright from launching a redundant web server (#​36402, #​34698)
  • vite: prevent watch false leaking into dev server config (#​36080, #​36078)
  • vitest: honor watch config and keep --ui open in the test executor (#​36237, #​30263)
  • vitest: generate root vitest.config.ts instead of deprecated vitest.workspace (#​36316, #​36311)
  • vitest: prevent out-of-memory crash during atomized test graph creation (#​36339, #​36315)
  • vitest: use esm config files and import.meta.dirname (#​36605)
  • vitest: generate the requested e2e target in inferred workspaces and de-flake the generated plugin e2e (#​36623)
  • vitest: do not set projectType when inferring targets (#​36831, #​33989)
  • vitest: write each atomized target's coverage to its own directory (#​36658, #​36503)
  • webpack: disable extractComments on the swc terser minimizer (#​36238, #​36233)
  • webpack: bundle non-buildable library subpaths with fallback-array exports (#​36313, #​36309)
  • webpack: propagate watch option from executor to webpack config (#​34927, #​22945)
  • webpack: set optimization.minimize to its normalized object form (#​36815)
  • webpack: add development configuration to inferred build target (#​36832, #​33004)
❤️ Thank You
nodejs/node (node)

v24.21.0: 2026-09-08, Version 24.21.0 'Krypton' (LTS), @​aduh95

Compare Source

Notable Changes
  • [71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #​65495
  • [afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #​63949
  • [6274fccbd9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #​65542
  • [53cba013c7] - deps: update Undici to 7.29.1 (Node.js GitHub Bot) #​65789
  • [0529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #​65024
  • [41c7062b81] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #​64974
  • [5197b5a3c5] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #​65416
  • [35c635b032] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #​64965
Commits

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Lisbon)

  • Branch creation
    • "before 3am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies General dependency updates renovate Created by Renovate bot labels Sep 10, 2026
@github-actions github-actions Bot added the chore Maintenance tasks, dependency updates, housekeeping label Sep 10, 2026
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 4d4b814 to 8ea9885 Compare September 10, 2026 21:36
@renovate
renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 8ea9885 to 96c0bec Compare September 14, 2026 02:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore Maintenance tasks, dependency updates, housekeeping dependencies General dependency updates renovate Created by Renovate bot

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants