chore(deps-dev): bump nx from 21.3.11 to 22.7.2

[dependabot]

Bumps nx from 21.3.11 to 22.7.2.

Release notes

Sourced from nx's releases.

22.7.2 (2026-05-14)

🚀 Features

• gradle: stream batch task results to nx as they finish (#35487)
• nx-dev: track docs analytics for code copy, LLM prompt, YouTube (#35526)
• testing: add migration for Jest 30 snapshot guide link (#35629)

🩹 Fixes

• angular: disable vitest watch by default (#35493)
• angular-rspack: keep root-scoped assets out of per-locale i18n emit (#35621)
• bundling: include tsconfig solution input for rollup (#35476)
• bundling: include tsconfig solution input for webpack (#35477, #35476)
• core: bump axios to 1.16.0 for all packages (#35568)
• core: add provenance check in nx console status path (#35485)
• core: remove access control header from graph app (#35494)
• core: ensure verbose logs go to stderr and daemon logs are properly decorated (#34358)
• core: show flaky-task count in run summary (#35491)
• core: unique telemetry user_id; expose workspace_id dimension (#35553)
• core: update minimatch to 10.2.5 (#35569, #34660)
• core: restore use-legacy-versioning shim for @​nx/js@​21 ensurePackage path (#35574)
• core: isolate NX_PARALLEL env var in parallel-related specs (#35579)
• core: skip handleimport miss path when nx key packages are absent (#35596)
• core: use gethostuuid(3) instead of ioreg on macOS (#35599)
• core: isolate cache env vars in splitArgs spec (#35584)
• core: enable node's native v8 compile cache support (#35415, #20454)
• core: support skipped batch tasks end-to-end and fix TUI double logs (#35617)
• core: keep TUI task selection on the in-progress section (#35640)
• core: allow nx mcp to run outside of an Nx workspace (#35655)
• core: cast perf entries to PerformanceMeasure for detail access (43c0c821ba)
• devkit: exclude dist from jest module path scan (#35615)
• devkit: expand @​nx/devkit/internal re-exports for cherry-picked v23 deep-import migration (#35541)
• dotnet: correct output paths for Web SDK and centralized dist setups (#35398)
• gradle: exclude batch-runner from jest haste-map crawl (#35501)
• gradle: exclude project-graph from jest module path scan (#35609)
• gradle: support Windows file paths (#35184, #34987)
• js: strip glob from inferred outputs before resolving as path (#35463, #35452)
• js: reference vitest.config in eslint dep-checks for vitest libs (#35460, #33670, #35450)
• js: include transitive workspace deps in pruned pnpm lockfile (#35532, #35347, #34655)
• linter: prevent ENOENT crash in getRelativeImportPath for unresolvable paths (#35007, #13872, #34066, #30491, #16716, #35006, #21889, #32190)
• maven: skip attached artifacts that fail to materialize in batch record (#35473)
• maven: serialize Maven 4 build state recording (#35555)
• maven: widen runCLI timeout for --no-batch maven.test.ts cases (#35589)
• nx-dev: document nested CLI subcommands beyond two levels (#35519)
• nx-dev: short-circuit bot probes in framer rewrite edge function (#35527)
• react: withSvgr migration preserves other properties (#35484)
• repo: clear NX_INVOCATION_ROOT_PID in run-native-target to avoid recursion false-positive (443dee0b22)
• repo: revert deep-import rewrites that targeted v23-only @​nx/devkit/internal entry (ac8187963d)
• repo: unblock 22.7.x cargo tests and nx-build e2e (#34285)

... (truncated)

Commits

• 4e9ea1b chore(core): refresh stale TUI snapshots on 22.7.x
• d02dc54 fix(repo): unblock 22.7.x cargo tests and nx-build e2e
• 7e4bce9 feat(testing): add migration for Jest 30 snapshot guide link (#35629)
• 43c0c82 fix(core): cast perf entries to PerformanceMeasure for detail access
• 0cfc6bc fix(core): allow nx mcp to run outside of an Nx workspace (#35655)
• df0e414 chore(core): remove dead TUI selection lifecycle helpers (#35649)
• a0f7a52 fix(core): keep TUI task selection on the in-progress section (#35640)
• 93813e9 fix(core): support skipped batch tasks end-to-end and fix TUI double logs (#3...
• c514039 fix(core): enable node's native v8 compile cache support (#35415)
• 75e3498 fix(core): isolate cache env vars in splitArgs spec (#35584)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nx since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2fe12b1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ignored	Preview	Aug 4, 2026 2:25pm
hyperdx-storybook	Ignored	Preview	Aug 4, 2026 2:25pm

[greptile-apps]

PR author is in the excluded authors list.

[github-actions]

🟢 Tier 1 — Trivial

Docs, images, lock files, or a dependency bump. No functional code changes detected.

Why this tier:

• Bot author: dependabot[bot]

Review process: Auto-merge once CI passes. No human review required.
SLA: Resolves automatically.

Stats

• Production files changed: 1
• Production lines changed: 2
• Branch: dependabot/npm_and_yarn/nx-22.7.2
• Author: dependabot[bot]

To override this classification, remove the review/tier-1 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[github-actions]

E2E Test Results

❌ Error reading test results: ENOENT: no such file or directory, scandir 'all-test-results'

View full report →

[github-actions]

<!-- deep-review -->

Deep Review

✅ No critical issues found.

This is a manifest + lockfile change only (package.json:29, yarn.lock). Verified clean, so no need to chase these: the lockfile's root workspace descriptor records nx: "npm:22.7.2" (yarn.lock:17952) matching the manifest, so yarn install --immutable won't fail on descriptor drift; there are no @nx/* or @nrwl/* plugin packages anywhere in the repo, so the usual plugin-version-skew risk of an nx major does not exist here; @nx/nx-linux-x64-musl@22.7.2 is present for the Alpine image build; and the missing changeset is explicitly waived by AGENTS.md for internal-tooling changes.

The substance of this review is that a major version jump (21 → 22) landed with zero migration artifacts, against an nx.json that still uses pre-Nx-17 config shapes.

🟡 P2 -- recommended

• package.json:29 -- The 21→22 major bump committed no nx migrate output, leaving nx.json with the legacy tasksRunnerOptions / cacheableOperations shape (nx.json:17-24) and nested affected.defaultBase (nx.json:2-4) never validated against the 22.x schema.
  • Fix: Run npx nx@22.7.2 migrate 22.7.2 && npx nx migrate --run-migrations, commit the resulting nx.json, and confirm npx nx show projects succeeds against 22.7.2 before merging.
  • _{correctness, maintainability, reliability}
• .github/workflows/main.yml:92 -- Integration sharding depends entirely on nx forwarding post--- args to jest, an undocumented behavior this major bump could change, and nothing asserts it still works.
  • Fix: Add a step asserting the shard argument reaches jest, such as grepping nx run-many -t ci:int --dry-run -- --shard=1/4 output for --shard=1/4, or reconciling each shard's executed test-file count against the full suite.
  • _{testing, learnings-researcher}

🔵 P3 nitpicks (6)

• nx.json:21 -- Pre-existing: cacheableOperations lists test (defined in no package) and dev:build (defined only in packages/common-utils) while omitting ci:build, ci:lint, ci:unit, and ci:int — the targets CI and the Makefile actually run.
  • Fix: Replace the list with the ci:* target names, or move caching to per-target cache: true entries under targetDefaults as part of the migration above.
• nx.json:1 -- No $schema key, so neither editors nor CI validate this file against the nx version now installed.
  • Fix: Add "$schema": "./node_modules/nx/schemas/nx-schema.json" as the first key.
• .github/workflows/main.yml:24 -- Pre-existing: the lint job installs with bare yarn install while unit, integration-shards, and clickhouse-static-build use --immutable, making the fastest gate the least strict about exactly the file pair this diff changes.
  • Fix: Change the lint job's install step to yarn install --immutable to match the other three jobs.
• scripts/dev-env.sh:65 -- NX_CACHE_DIRECTORY is a fixed, unversioned path shared across all worktrees with no reset logic, so a cache populated by nx 21 in one worktree is read by nx 22 after checking out this branch.
  • Fix: Namespace the cache path by the installed nx major version, or clear the directory when the detected major differs from a marker written on first use.
• .github/workflows/deep-resolve.yml:128 -- Pre-existing: the job enables corepack but never runs yarn install, yet instructs yarn lint:fix (:161), so npx nx there resolves an ad-hoc registry version rather than the pinned 22.7.2.
  • Fix: Add a yarn install --immutable step between corepack enable and the agent step so that path uses the locked nx version.
• .github/workflows/main.yml:30 -- PR CI exercises only ci:build, ci:lint, ci:unit, and ci:int, so the lint:fix target relied on by Makefile:107 and deep-resolve.yml:161 is first run under nx 22 only after merge.
  • Fix: Extend an existing job with npx nx run-many -t lint:fix --dry-run so the target is smoke-checked pre-merge.

---

Reviewers (7): correctness, testing, maintainability, project-standards, reliability, learnings-researcher, validator

Testing gaps:

• No cheap nx preflight (npx nx show projects or npx nx report) runs before the first real nx invocation, so a config or task-graph rejection surfaces as an opaque make ci-build failure across lint, unit, all four integration shards, and e2e simultaneously rather than as a clear config error.
• Nothing reconciles per-shard jest test counts against the full suite, so a silent loss or overlap of the shard split produces four passing-but-redundant shards detectable only via the 16-minute timeout at .github/workflows/main.yml:51.
• Nothing asserts nx caching remains active; if cacheableOperations stops being honored, targetDefaults (nx.json:9-16) has no cache key to fall back on and the only symptom is slower builds with zero failure signal.
• packages/common-utils/CHANGELOG.md records the prior nx 16→21 jump as a bare one-line version note with no compatibility statement, so there is no institutional precedent or runbook for validating an nx major in this repo.

Review limitations: Bash was unavailable for the entire run (bwrap wrapper failure), WebFetch/WebSearch were denied, and node_modules/ is not installed — so nx 22's actual handling of the legacy nx.json keys, and its run-many argument-forwarding behavior, could not be verified from either upstream docs or installed sources. Both P2 findings are scoped to what is verifiable from the repo: the config-versus-major mismatch and the absent verification are established facts; the resulting nx-22 behavior is not. One additional finding (a resolutions entry clamping nx 22's pinned brace-expansion 5.0.5 down to 2.1.2) was raised and then dropped after an independent validator established the same override collapse already existed pre-diff via @typescript-eslint/typescript-estree, with no reachable failure path in this repo. ce-agent-native-reviewer was not spawned: a devDependency lockfile bump adds no user-facing action for an agent to reach parity with.

[teeohhem]

@dependabot recreate

[github-actions]

Deep Review

✅ No critical issues found. This is a dev-dependency-only change: root package.json moves nx from 21.3.11 to 22.7.2 and yarn.lock picks up nx@npm:22.7.2 plus ten @nx/nx-<platform>@npm:22.7.2 native binaries. No @nx/* plugin packages exist in the lockfile, so there is no 21.x/22.x version split, and nothing ships into the runtime image. The risk is confined to the build/CI task graph.

🟡 P2 -- recommended

• nx.json:21 -- A major nx bump (21 → 22) landed with nx.json untouched, so no nx migrate output accompanies it and the workspace still declares caching through the legacy tasksRunnerOptions.default.options.cacheableOperations array rather than per-target cache flags in targetDefaults.
  • Fix: Run nx migrate 22.7.2 followed by nx migrate --run-migrations and commit the resulting nx.json changes alongside the version bump.
• nx.json:21 -- The cacheable-target list names build, dev:build, lint, and test, but every CI entry point drives differently-named targets (npx nx run-many -t ci:int in .github/workflows/main.yml:92, npx nx run-many -t ci:build in .github/actions/e2e-setup/action.yml, and ci:build/ci:lint/ci:unit via the Makefile), so the targets CI actually runs are outside the cacheable set.
  • Fix: Declare "cache": true on the ci:build, ci:lint, ci:unit, and ci:int entries under targetDefaults so CI task results are cacheable under the new version.
• package.json:29 -- Nothing in the change records that the repo's own required validation commands were run against the new task runner, and AGENTS.md names make ci-build, make ci-lint, and make ci-unit as the validation gate for tooling changes.
  • Fix: Run make ci-build, make ci-lint, and make ci-unit on this branch and confirm the nx task graph and affected-detection still resolve before merging.
  • _{project-standards}

🔵 P3 nitpicks (1)

• nx.json:3 -- affected.defaultBase is the superseded location for the affected-detection base; the current key is a top-level defaultBase.
  • Fix: Move defaultBase: "main" to the top level of nx.json and drop the affected wrapper.

---

Reviewers (6): project-standards (returned, zero findings), correctness, testing, maintainability, security, learnings-researcher (dispatched; had not returned when this report was assembled — their findings are not represented here).

Coverage caveats:

• Bash, git, Grep, and Glob were all unavailable in this environment (bwrap: Can't create file at /home/.mcp.json: Permission denied on every shell call), so the literal git diff could not be read. The reviewed scope was reconstructed from the working tree and .git/refs and is therefore high-confidence but not diff-verified.
• Assertions about nx 22 runtime behavior could not be verified against release artifacts (no network, no node_modules inspection); the findings above rest on repo contents only and deliberately avoid claiming specific nx 22 removals.
• packages/api/CLAUDE.md, packages/app/CLAUDE.md, and packages/common-utils/CLAUDE.md do not exist, so package-scoped standards could not be checked.
• Line numbers in nx.json are approximate — the file was read via a reformatting intermediary rather than directly.

Testing gaps:

• No verification that make ci-build / make ci-lint / make ci-unit still succeed under nx 22.7.2 with the unmodified nx.json.
• Cache-hit behavior after the bump is unverified; a silently inert cache config degrades CI time without failing any check.

[teeohhem]

@claude please evaluate the linting failure on this branch and suggest a path forward

[github-actions]

Claude finished @teeohhem's task in 6m 0s —— View job

---

Lint failure: root cause found

• Fetch CI status and lint job log
• Diagnose root cause
• Suggest path forward

The lint job isn't failing on an ESLint rule. It fails in step 5, Build dependencies (make ci-build), before any linting happens — and nx dies instantly:

npx nx run-many -t ci:build
 NX   (0 , brace_expansion_1.expand) is not a function
make: *** [Makefile:111: ci-build] Error 1

Same error takes down unit, all four Integration shards, all four E2E shards, and ClickHouse Bundle Build — every job whose first real step invokes nx. nx 22 cannot start at all in this workspace.

Root cause

The root resolutions block clamps every brace-expansion descriptor in the tree:

// package.json:79
"brace-expansion": "^2.1.2",

That collapses the whole graph to a single lockfile entry (yarn.lock:12342-12344, brace-expansion@npm:2.1.2), and 2.x only has a default CJS export:

// node_modules/brace-expansion/index.js:3
module.exports = expandTop;   // no named `.expand`

The 21 → 22 bump changes which API shape nx needs:

	nested minimatch	how it imports brace-expansion	under the ^2.1.2 clamp
nx 21.3.11	9.0.3	__importDefault(require(...)) → .default	✅ works (esModuleInterop wraps the CJS fn)
nx 22.7.2	10.2.5 (yarn.lock:22241)	require("brace-expansion").expand(...)	❌ .expand is undefined

nx 22 also pins brace-expansion: npm:5.0.5 directly (yarn.lock:22184); the resolution rewrites that to 2.1.2 too. minimatch 10.x needs the 5.x named-export API (yarn.lock:21316 → brace-expansion: ^5.0.5), and calls it as (0, brace_expansion_1.expand)(pattern, { max: options.braceExpandMax }). Since nx expands brace patterns during workspace/task-graph construction, this throws on the very first invocation — deterministic, not flaky.

This is a latent bug on main too, which the earlier deep-review flagged and then dropped. Four other copies of minimatch 10 in the tree are already broken by the same clamp and will throw the moment a brace pattern reaches them:

• node_modules/glob/node_modules/minimatch/dist/commonjs/index.js:157
• node_modules/@typescript-eslint/utils/node_modules/minimatch/...
• node_modules/@typescript-eslint/type-utils/node_modules/minimatch/...
• node_modules/@eslint-react/ast/node_modules/minimatch/...

Today nothing in CI feeds them a {a,b} pattern, so it stays invisible. nx 22 is just the first consumer that hits it on startup.

On the security intent of the clamp

Worth knowing before loosening it: the pinned 2.1.2 carries the exponential-blowup / ReDoS fixes (CVE-2025-5889 class, fixed in 1.1.12 / 2.0.2 / 3.0.1 / 4.0.1 — so 5.0.5 has them too). It does not carry the fix for the newer OOM advisory it ships as documentation (node_modules/brace-expansion/ADVISORY-CVE-2026-14257.md, "affected: all versions up to and including 5.0.7") — there is no maxLength / EXPANSION_MAX_LENGTH bound anywhere in 2.1.2's index.js.

So letting the 5.x line resolve to 5.0.5 regresses nothing: 5.0.5 is patched for the same CVE the clamp was added for, and both versions are equally exposed to the OOM one. The blanket clamp buys no extra protection over per-line pins — it only breaks the 5.x API contract.

Path forward

Option A (recommended) — replace the blanket clamp with per-line pins. Yarn resolution patterns can carry a range, so each major line keeps its own API shape:

-    "brace-expansion": "^2.1.2",
+    "brace-expansion@^1.1.7": "^1.1.12",
+    "brace-expansion@^2.0.1": "^2.1.2",

The five descriptors in the tree are ^1.1.7 (minimatch 3.x), ^2.0.1 (minimatch 8/9), ^5.0.2, ^5.0.5, and nx's exact 5.0.5. The two 5.x ranges and the exact pin then resolve naturally within the 5.x line — which is both what minimatch 10 needs and already patched. No catch-all, so no ordering subtleties. This also fixes the four latent minimatch-10 breakages above.

Option B — keep the catch-all, add scoped overrides ahead of it. Yarn's reduceDependency hook iterates manifest.resolutions in insertion order and returns on the first match (verified in .yarn/releases/yarn-4.13.0.cjs), so specific entries must be listed before the catch-all:

+    "brace-expansion@^5.0.2": "^5.0.5",
+    "brace-expansion@^5.0.5": "^5.0.5",
+    "brace-expansion@5.0.5": "5.0.5",
     "brace-expansion": "^2.1.2",

Works, but depends on ordering semantics that aren't obvious to the next reader, and leaves the latent minimatch-10 bug in place for any future 5.x descriptor. I'd prefer A.

Option C — hold the bump. Legitimate if you'd rather not touch resolutions under time pressure. nx is a devDependency and nothing here ships into the runtime image, so there's no urgency to land 22.x.

Suggested sequencing: land Option A as its own small PR against main — it's an independent bug fix, not part of this bump — then @dependabot recreate here so the version bump comes in clean. (Note that pushing a commit directly to this branch would stop Dependabot from rebasing it.)

Verify with:

yarn install --mode=update-lockfile   # confirm 5.x descriptors are no longer rewritten to 2.1.2
npx nx show projects                  # cheapest reproduction of the crash
make ci-build && make ci-lint && make ci-unit
yarn npm audit --all --recursive      # confirm no line lands on a pre-CVE-2025-5889 version

If you want me to implement Option A, say the word and I'll open it against main.

What I could not verify here

Bash in this environment is allowlist-restricted and I couldn't reach the npm registry, so I could not run yarn install to produce a verified lockfile, nor confirm the newest published patch in each brace-expansion line (npm view brace-expansion versions). Pin the 1.x entry to whatever the newest 1.1.x actually is when you apply it. Everything above about the failure mechanism is read directly from the CI log, yarn.lock, and the installed sources — the local node_modules here is an nx 21.3.11 install, which is what let me confirm the 21-vs-22 minimatch difference directly.

I also have not checked whether nx 22 surfaces further problems past startup (nx.json still uses the pre-17 tasksRunnerOptions.cacheableOperations shape that both prior deep reviews flagged, and no nx migrate output accompanies this bump). Fixing brace-expansion unblocks nx enough to find out.

--- • branch dependabot/npm_and_yarn/nx-22.7.2