@nx/devkit - npm Package Compare versions

Comparing version 23.0.0-beta.9 to 23.0.0-beta.10

dist/src/utils/installed-version.d.ts

+import type { Tree } from 'nx/src/devkit-exports';
+/**
+ * Returns the concrete version of a package as resolved by Node module
+ * resolution from the workspace. Reads the installed package's own
+ * `package.json` — not the workspace's declared range.
+ *
+ * Use this from executor / runtime contexts where node_modules is present.
+ * Generator-time code should use `getDeclaredPackageVersion` instead.
+ *
+ * Returns `null` when the package is not resolvable.
+ */
+export declare function getInstalledPackageVersion(packageName: string): string | null;
+/**
+ * Returns the declared version of a package as read from the workspace's
+ * `package.json`, normalized to a plain semver string (range markers
+ * stripped) suitable for arithmetic comparisons (e.g. `lt(v, '1.37.0')`).
+ *
+ * When the package is missing or declared as `latest`/`next`, falls back to
+ * the cleaned `latestKnownVersion` if provided; otherwise returns `null`.
+ *
+ * Use this from generator-time contexts where node_modules is not assumed
+ * to be present. Executor / runtime code should use
+ * `getInstalledPackageVersion` instead.
+ */
+export declare function getDeclaredPackageVersion(tree: Tree, packageName: string, latestKnownVersion?: string): string | null;
+export declare const NON_SEMVER_DIST_TAGS: readonly ["latest", "next"];
+export type NonSemverDistTag = (typeof NON_SEMVER_DIST_TAGS)[number];
+export declare function isNonSemverDistTag(version: string): version is NonSemverDistTag;
+export declare function normalizeSemver(version: string): string | null;

dist/src/utils/installed-version.js

+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NON_SEMVER_DIST_TAGS = void 0;
+exports.getInstalledPackageVersion = getInstalledPackageVersion;
+exports.getDeclaredPackageVersion = getDeclaredPackageVersion;
+exports.isNonSemverDistTag = isNonSemverDistTag;
+exports.normalizeSemver = normalizeSemver;
+const devkit_internals_1 = require("nx/src/devkit-internals");
+const semver_1 = require("semver");
+const package_json_1 = require("./package-json");
+/**
+ * Returns the concrete version of a package as resolved by Node module
+ * resolution from the workspace. Reads the installed package's own
+ * `package.json` — not the workspace's declared range.
+ *
+ * Use this from executor / runtime contexts where node_modules is present.
+ * Generator-time code should use `getDeclaredPackageVersion` instead.
+ *
+ * Returns `null` when the package is not resolvable.
+ */
+function getInstalledPackageVersion(packageName) {
+    try {
+        const { packageJson } = (0, devkit_internals_1.readModulePackageJson)(packageName);
+        return packageJson.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Returns the declared version of a package as read from the workspace's
+ * `package.json`, normalized to a plain semver string (range markers
+ * stripped) suitable for arithmetic comparisons (e.g. `lt(v, '1.37.0')`).
+ *
+ * When the package is missing or declared as `latest`/`next`, falls back to
+ * the cleaned `latestKnownVersion` if provided; otherwise returns `null`.
+ *
+ * Use this from generator-time contexts where node_modules is not assumed
+ * to be present. Executor / runtime code should use
+ * `getInstalledPackageVersion` instead.
+ */
+function getDeclaredPackageVersion(tree, packageName, latestKnownVersion) {
+    const declared = (0, package_json_1.getDependencyVersionFromPackageJson)(tree, packageName);
+    if (declared && !isNonSemverDistTag(declared)) {
+        const normalized = normalizeSemver(declared);
+        if (normalized)
+            return normalized;
+    }
+    return latestKnownVersion ? normalizeSemver(latestKnownVersion) : null;
+}
+exports.NON_SEMVER_DIST_TAGS = ['latest', 'next'];
+function isNonSemverDistTag(version) {
+    return exports.NON_SEMVER_DIST_TAGS.includes(version);
+}
+function normalizeSemver(version) {
+    return (0, semver_1.clean)(version) ?? (0, semver_1.coerce)(version)?.version ?? null;
+}

dist/src/utils/version-floor.d.ts

+import type { Tree } from 'nx/src/devkit-exports';
+/**
+ * Throws a standardized error when a package is installed at a version below
+ * a plugin's supported floor.
+ *
+ * Use this at every site where a plugin determines the installed version of
+ * a supported package is below its declared floor, so the message is
+ * consistent across plugins.
+ *
+ * @param packageName Name of the package (e.g. `@angular/core`).
+ * @param installedVersion Version detected in the workspace (e.g. `18.2.0`).
+ * @param floor Lowest version the plugin supports (e.g. `19.0.0`).
+ */
+export declare function throwForUnsupportedVersion(packageName: string, installedVersion: string, floor: string): never;
+/**
+ * Asserts that a package detected in the workspace is at or above the
+ * plugin's supported floor. No-op when the package is not detected
+ * (fresh-install path) or when declared as `latest`/`next`. Throws via
+ * `throwForUnsupportedVersion` (with the original declared range for
+ * clarity) when below floor.
+ *
+ * Use from generator entry points to fail fast on unsupported workspaces
+ * before writing any incompatible config.
+ */
+export declare function assertSupportedPackageVersion(tree: Tree, packageName: string, minSupportedVersion: string): void;

dist/src/utils/version-floor.js

+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.throwForUnsupportedVersion = throwForUnsupportedVersion;
+exports.assertSupportedPackageVersion = assertSupportedPackageVersion;
+const semver_1 = require("semver");
+const installed_version_1 = require("./installed-version");
+const package_json_1 = require("./package-json");
+/**
+ * Throws a standardized error when a package is installed at a version below
+ * a plugin's supported floor.
+ *
+ * Use this at every site where a plugin determines the installed version of
+ * a supported package is below its declared floor, so the message is
+ * consistent across plugins.
+ *
+ * @param packageName Name of the package (e.g. `@angular/core`).
+ * @param installedVersion Version detected in the workspace (e.g. `18.2.0`).
+ * @param floor Lowest version the plugin supports (e.g. `19.0.0`).
+ */
+function throwForUnsupportedVersion(packageName, installedVersion, floor) {
+    throw new Error(`Unsupported version of \`${packageName}\` detected.\n\n` +
+        `  Installed: ${installedVersion}\n` +
+        `  Supported: >= ${floor}\n\n` +
+        `Update \`${packageName}\` to ${floor} or higher.`);
+}
+/**
+ * Asserts that a package detected in the workspace is at or above the
+ * plugin's supported floor. No-op when the package is not detected
+ * (fresh-install path) or when declared as `latest`/`next`. Throws via
+ * `throwForUnsupportedVersion` (with the original declared range for
+ * clarity) when below floor.
+ *
+ * Use from generator entry points to fail fast on unsupported workspaces
+ * before writing any incompatible config.
+ */
+function assertSupportedPackageVersion(tree, packageName, minSupportedVersion) {
+    const declared = (0, package_json_1.getDependencyVersionFromPackageJson)(tree, packageName);
+    if (!declared || (0, installed_version_1.isNonSemverDistTag)(declared)) {
+        return;
+    }
+    const cleaned = (0, installed_version_1.normalizeSemver)(declared);
+    if (cleaned && (0, semver_1.lt)(cleaned, minSupportedVersion)) {
+        throwForUnsupportedVersion(packageName, declared, minSupportedVersion);
+    }
+}

dist/internal.d.ts

@@ -1,2 +0,2 @@
-export { signalToCode, createProjectRootMappingsFromProjectConfigurations, PluginCache, safeWriteFileCache, } from 'nx/src/devkit-internals';
+export { signalToCode, createProjectRootMappingsFromProjectConfigurations, PluginCache, safeWriteFileCache, emitPluginWorkerLog, } from 'nx/src/devkit-internals';
 export { determineArtifactNameAndDirectoryOptions, getRelativeCwd, type FileExtensionType, } from './src/generators/artifact-name-and-directory-utils';
@@ -12,2 +12,4 @@ export { getE2EWebServerInfo, type E2EWebServerDetails, } from './src/generators/e2e-web-server-info-utils';
 export { addPlugin } from './src/utils/add-plugin';
+export { getDeclaredPackageVersion, getInstalledPackageVersion, } from './src/utils/installed-version';
+export { assertSupportedPackageVersion } from './src/utils/version-floor';
 export { createAsyncIterable, combineAsyncIterables, mapAsyncIterable, } from './src/utils/async-iterable';
@@ -14,0 +16,0 @@ export { calculateHashForCreateNodes, calculateHashesForCreateNodes, } from './src/utils/calculate-hash-for-create-nodes';

dist/internal.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.dasherize = exports.classify = exports.capitalize = exports.camelize = exports.checkAndCleanWithSemver = exports.eachValueFrom = exports.logShowProjectCommand = exports.getNamedInputs = exports.findPluginForConfigFile = exports.clearRequireCache = exports.loadConfigFile = exports.getCatalogManager = exports.calculateHashesForCreateNodes = exports.calculateHashForCreateNodes = exports.mapAsyncIterable = exports.combineAsyncIterables = exports.createAsyncIterable = exports.addPlugin = exports.addE2eCiTargetDefaults = exports.addBuildTargetDefaults = exports.promptWhenInteractive = exports.resolveImportPath = exports.ensureRootProjectName = exports.determineProjectNameAndRootOptions = exports.toProjectRelativePath = exports.deleteMatchingProperties = exports.processTargetOutputs = exports.NoTargetsToMigrateError = exports.migrateProjectExecutorsToPluginV1 = exports.migrateProjectExecutorsToPlugin = exports.AggregatedLog = exports.forEachExecutorOptions = exports.getE2EWebServerInfo = exports.getRelativeCwd = exports.determineArtifactNameAndDirectoryOptions = exports.safeWriteFileCache = exports.PluginCache = exports.createProjectRootMappingsFromProjectConfigurations = exports.signalToCode = void 0;
+exports.dasherize = exports.classify = exports.capitalize = exports.camelize = exports.checkAndCleanWithSemver = exports.eachValueFrom = exports.logShowProjectCommand = exports.getNamedInputs = exports.findPluginForConfigFile = exports.clearRequireCache = exports.loadConfigFile = exports.getCatalogManager = exports.calculateHashesForCreateNodes = exports.calculateHashForCreateNodes = exports.mapAsyncIterable = exports.combineAsyncIterables = exports.createAsyncIterable = exports.assertSupportedPackageVersion = exports.getInstalledPackageVersion = exports.getDeclaredPackageVersion = exports.addPlugin = exports.addE2eCiTargetDefaults = exports.addBuildTargetDefaults = exports.promptWhenInteractive = exports.resolveImportPath = exports.ensureRootProjectName = exports.determineProjectNameAndRootOptions = exports.toProjectRelativePath = exports.deleteMatchingProperties = exports.processTargetOutputs = exports.NoTargetsToMigrateError = exports.migrateProjectExecutorsToPluginV1 = exports.migrateProjectExecutorsToPlugin = exports.AggregatedLog = exports.forEachExecutorOptions = exports.getE2EWebServerInfo = exports.getRelativeCwd = exports.determineArtifactNameAndDirectoryOptions = exports.emitPluginWorkerLog = exports.safeWriteFileCache = exports.PluginCache = exports.createProjectRootMappingsFromProjectConfigurations = exports.signalToCode = void 0;
 var devkit_internals_1 = require("nx/src/devkit-internals");
@@ -9,2 +9,3 @@ Object.defineProperty(exports, "signalToCode", { enumerable: true, get: function () { return devkit_internals_1.signalToCode; } });
 Object.defineProperty(exports, "safeWriteFileCache", { enumerable: true, get: function () { return devkit_internals_1.safeWriteFileCache; } });
+Object.defineProperty(exports, "emitPluginWorkerLog", { enumerable: true, get: function () { return devkit_internals_1.emitPluginWorkerLog; } });
 // Generators
@@ -40,2 +41,7 @@ var artifact_name_and_directory_utils_1 = require("./src/generators/artifact-name-and-directory-utils");
 Object.defineProperty(exports, "addPlugin", { enumerable: true, get: function () { return add_plugin_1.addPlugin; } });
+var installed_version_1 = require("./src/utils/installed-version");
+Object.defineProperty(exports, "getDeclaredPackageVersion", { enumerable: true, get: function () { return installed_version_1.getDeclaredPackageVersion; } });
+Object.defineProperty(exports, "getInstalledPackageVersion", { enumerable: true, get: function () { return installed_version_1.getInstalledPackageVersion; } });
+var version_floor_1 = require("./src/utils/version-floor");
+Object.defineProperty(exports, "assertSupportedPackageVersion", { enumerable: true, get: function () { return version_floor_1.assertSupportedPackageVersion; } });
 var async_iterable_1 = require("./src/utils/async-iterable");
@@ -42,0 +48,0 @@ Object.defineProperty(exports, "createAsyncIterable", { enumerable: true, get: function () { return async_iterable_1.createAsyncIterable; } });

package.json

 {
   "name": "@nx/devkit",
-  "version": "23.0.0-beta.9",
+  "version": "23.0.0-beta.10",
   "private": false,
@@ -62,4 +62,4 @@ "type": "commonjs",
   "devDependencies": {
-    "jest": "^30.0.2",
-    "nx": "23.0.0-beta.9"
+    "jest": "30.3.0",
+    "nx": "23.0.0-beta.10"
   },
@@ -66,0 +66,0 @@ "peerDependencies": {

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 8 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 8 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

287655

3.01%

Number of package files

124

3.33%

Lines of code

6723

2.5%

No dependency changes