aglinxinyuan commented on code in PR #7378:
URL: https://github.com/apache/texera/pull/7378#discussion_r3733183045
##########
frontend/package.json:
##########
@@ -123,7 +123,7 @@
"eslint-plugin-rxjs-angular": "2.0.1",
"jsdom": "25.0.1",
"nodecat": "2.0.0",
- "nx": "23.0.1",
+ "nx": "23.0.2",
"playwright": "1.59.1",
"prettier": "3.2.5",
Review Comment:
Good catch — confirmed, and fixed in c255d8e547.
`@nx/[email protected]` pulls `@nx/[email protected]`, which pins `nx:
"npm:23.0.1"` *exactly*, so Yarn kept a nested
`node_modules/@nx/workspace/node_modules/nx` at 23.0.1 next to the hoisted
23.0.2 — the vulnerable extractor was still on disk after the top-level bump.
`@nx/angular` is the only direct `@nx/*` dependency, so bumping it to 23.0.2
carries the rest of the family (`devkit`, `eslint`, `js`, `module-federation`,
`rspack`, `web`, `webpack`, `workspace`) with it. After re-running `yarn
install` the lockfile converges:
| | before | after |
| --- | --- | --- |
| `nx` | 23.0.1 + 23.0.2 | 23.0.2 |
| `@nx/*` | 23.0.1 + 23.0.2 | 23.0.2 |
| `@nx/nx-<platform>` binaries | both sets | one set |
| `axios` | 1.16.0 + 1.16.1 | 1.16.1 |
The `axios` collapse is a side benefit — nx 23.0.2 bumped its own pin to
1.16.1. Net `yarn.lock` change is -325/+93.
Verified locally: `yarn install --immutable`, `yarn format:ci`, `yarn
build:ci` (nx reports `Successfully ran target build for project gui`), and
`check_binary_deps.py npm frontend/dist/3rdpartylicenses.json` → `OK: 128 npm
packages match LICENSE-binary`. Both packages are dev-only, so no
`LICENSE-binary` sync was needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
