Update Nx packages to v23.3.0

[renovate]

Updates nx and @nx/js together to 23.3.0 to keep the Nx dependency graph consistent. The new Nx postinstall remains explicitly disabled; Nx runs using its prebuilt platform package.

Validation: frozen pnpm install, format check, lint, and all 42 package test targets pass locally.

---

This PR contains the following updates:

Package	Change	Age	Confidence
@nx/js (source)	23.2.0 → 23.3.0

---

Release Notes

nrwl/nx (@​nx/js)

v23.3.0

Compare Source

23.3.0 (2026-10-07)

🚀 Features

• angular: support ngrx v22 (#​36950)
• angular-rspack: scaffold and run SSR apps on the @​angular/ssr application engine (#​36298)
• core: emit a runbook and per-step instructions for orchestrated migrate runs (#​36766)
• core: report the cache location alongside usage (#​36959)
• core: share one workspace walk across processes through the files archive (#​36980)
• core: hash a continuous dependency's inputs into the task it serves (#​37017)
• core: guarantee terminal output files and add an agent-friendly summary output style (#​36703)
• core: add includeIgnored filesets and let the workspace context own the daemon's watch (#​37025)
• core: cache plugin capabilities so reading them costs at most one load (#​36999)
• core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#​36918)
• core: add sandbox target configuration for observed-IO opt-out (#​36853)
• core: hash tasks from Nx Cloud I/O snapshots (#​37036)
• core: replace the sandbox target property with ultracache (#​37165)
• core: opt in to selecting affected tasks instead of projects (#​36825)
• core: record unresolved migrations and cap retries in orchestrated migrate runs (#​36986)
• core: report an active orchestrated migrate run instead of resuming it (#​36988)
• core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#​36989)
• core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#​37242)
• core: explain why each task is affected with --explain (#​36885)
• core: run a final agent validation pass at the end of an orchestrated migrate run (#​37069)
• js: cache TypeScript reference expansion during createNodes (#​37003, #​37002)
• linter: add a batched @​nx/oxlint:lint executor (#​36827)
• nx-cloud: add nx cloud demo link to cloud prompts (#​36956)
• nx-cloud: remove the never option from the nx cloud prompt (#​37079)
• repo: add a .NET example for @​nx/dotnet (#​36701)
• testing: support cypress v16 (#​36953)
• vitest: support vitest 5 (#​37142)

🩹 Fixes

• angular: correct declaration maps and exports of buildable libraries (#​36373, #​36357)
• angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#​36972, #​36970)
• angular-rspack: keep class field closures per instance in minified builds (#​37066, #​37050)
• angular-rspack: update piscina to address critical vulnerability (#​37252)
• bundling: write the esbuild bundle to an overridden outputPath (#​37101, #​37091)
• bundling: clear typescript update timer when a rollup build closes its watch program (#​37196)
• core: separate daemon runtime env from graph identity (#​36565, #​36564)
• core: validate the migrations path before extracting package migrations (#​36887)
• core: release per-run process listeners and task history results (#​36866)
• core: read the pnpm 12 min-release-age policy instead of deferring to an install (#​36915, #​36914)
• core: carry minimumReleaseAge into pruned pnpm deploy output (#​36900, #​36899)
• core: report how a plugin worker was lost instead of always calling it an exit (#​36894)
• core: keep the cache in the workspace on CI (#​36922)
• core: restore the wasm walker imports dropped by a stray cfg attribute (#​36924)
• core: avoid mutating target options when resolving configurations (#​36934)
• core: carry pnpm's package-manager document into the pruned lockfile (#​36947)
• core: keep agentic migrations within the Windows command line limit (#​36578, #​36551)
• core: give plugin workers a minute to receive the load message (#​36977)
• core: detect changes in paths that git escapes (#​36660, #​35722)
• core: combine Windows watcher recursive root and rescan recovery (#​36912)
• core: deduplicate external inputs before hash plan allocation (#​36992)
• core: make nx planning and hashing faster (#​36994)
• core: keep continuous dependencies reached through a project without the target (#​37024)
• core: load the native binding from one path per vitest worker (#​37039)
• core: bump smol-toml to 1.7.1 for GHSA-7w5x-hrqm-74c2 (#​37059, #​37011)
• core: make nx migrate resolve the requested nx version under npm 12 (#​36901, #​36762)
• core: send task workers a task graph without run results (#​37015)
• core: carry task terminal outputs to plugins by path (#​36787)
• core: accept pr and canary releases in the migrate provenance check (#​36976)
• core: show the underlying errors when the project graph fails (#​37103)
• core: resolve project glob groups by prefix and literal lookup when hashing (#​37068)
• core: skip Nx Console and AI agents checks in CI and speed up e2e browser and port helpers (#​37119)
• core: watch with notify's CORE event mask so file reads cannot overflow inotify (#​37136)
• core: support pnpm 12 install configuration and shims (#​37116)
• core: reduce package-json inference overhead (#​37089)
• core: narrow workspace glob searches to literal directory prefixes (#​37126)
• core: read glob syntax from the glob parser in one place (#​37169)
• core: prevent stale lockfile caches from breaking the project graph (#​37210)
• core: pass only ultracache config to the snapshot eligibility walk (#​37212)
• core: speed up daemon start by collecting ignore files in one walk (#​37211)
• core: copy cached outputs into the workspace in parallel (#​37085, #​37090)
• core: remove axios from the published nx package (#​36706)
• core: make glob escapes work the same on every platform (#​37215)
• core: build the daemon's ignore rules from the file scan (#​37220)
• core: traverse past module-format package.json stubs when locating npm dependencies (#​36985, #​36984)
• core: cache only declared outputs under ultracache (#​37243)
• core: treat a cache record whose artifacts are missing as a miss (#​37111, #​37110)
• core: close the task DB before nx reset deletes workspace-data (#​37250)
• core: let nx reset finish after the Nx Cloud cleanup step (#​37251)
• core: skip batch cache lookups for deferred tasks until their deps run (#​37259)
• core: keep ultracache exclusions with the globs they trim (#​37285)
• core: answer daemon output tracking from the workspace context (#​37217, #​37086)
• core: stop merging declared negations into ultracache file groups (#​37304)
• core: omit empty user next steps in create-nx-workspace agent output (#​37277)
• core: reuse the stored ultracache configurations without an age limit (#​37305)
• core: size the default cache bound from its own filesystem (#​37269)
• core: accept --final-validation with a migrate CLI pinned below 23.2.0 (#​37294)
• docker: skip unused git lookups during target inference (#​37124)
• dotnet: declare evaluated inputs, invalidate on imports, and keep restore products out of cached outputs (#​36958)
• dotnet: ship the ci-workflow templates and detect Microsoft.Testing.Platform projects (#​36981)
• expo: gate the sdk 54 jest migration on the jest config instead of package.json (#​36834, #​35669)
• js: resolve tsconfig to absolute path so ${configDir} paths type-check without baseUrl (#​36445)
• js: handle empty npm view output in release-publish executor (#​36397, #​36358)
• js: export NodeExecutorOptions from @​nx/js/executors (#​37143)
• js: keep internal tsconfig project references on Windows (#​37058, #​37053)
• linter: reuse the project graph inside ESLint concurrency workers (#​37080)
• linter: reduce repeated path normalization during ESLint inference (#​37125)
• misc: scan package projects for env vars (#​36847)
• misc: record pnpm 11 build script decisions in generators (#​36814)
• module-federation: skip undeclared default packages when sharing (#​37223, #​37108)
• nextjs: bundle the server entry of Rollup-built libraries (#​36778)
• nextjs: use out/ as default output dir when output is export (#​34530)
• nx-dev: stop reading removed NextRequest.geo in AI api routes (#​37275)
• react: make freshly generated react and rspack workspaces usable (#​36964)
• release: exclude AI coding agents from the changelog Thank You section (#​36892)
• release: use the release group name when resolving the previous tag for fixed groups (#​36554)
• release: redact the token in the GitHub and GitLab release error output (#​36852)
• release: optimize publish metadata query for JS projects (#​37013)
• release: preserve private dev-only workspace dependencies (#​37193, #​37192)
• repo: provision JDK 17 for Gradle builds with mise (#​36965)
• repo: guard JAVA17_HOME against an uninstalled JDK (#​36969)
• repo: force-fetch the website branch in the docs sync skill (#​36973)
• repo: pin npm 11 for nightly e2e tests (#​37018)
• repo: bump next past the critical RCE advisories (#​36983)
• repo: point a seeded e2e workspace at the local pnpm store (#​37140)
• repo: run pnpm -v outside the repo in e2e utils (#​37151)
• repo: make e2e base workspace template failures clean and uncached (#​37194)
• repo: pin hyperfine to 1.20.0 in CI agents (c8dda36996)
• repo: hash local registry storage from sources again (#​37303)
• rspack: write the normalized cache option in NxAppRspackPlugin (#​36905, #​36878)
• testing: resolve coverageDirectory like jest and emit forward-slash outputs (#​37074, #​36910)
• testing: hold the Cypress 16 migration only when a Vite component testing project resolves Vite 7 (#​37123)
• vite: correct tsconfig paths fallback resolution (#​36424, #​36400)
• vite: wait for raced esm modules before retrying config load (#​37042)
• vite: defer nxViteTsPaths tsconfig parsing during graph construction (#​37182)
• vitest: memoize ancestor tsconfig walks in createNodes (#​37027)
• vitest: widen the vitest peerDependency to allow v5 (#​37055, #​37051)
• vitest: infer inputs for setup files outside the project root (#​36920)
• web: add --port to @​nx/web:app and reserve e2e ports (#​37254)
• webpack: cap the generated webpack version below 5.111.0 (#​37034)

❤️ Thank You

• AgentEnder @​AgentEnder
• alexandrucojocaru-creatopy
• Alfredo Sumaran
• Burak Erdemci @​BurakErdemci
• Caleb Ukle
• Charlie Croom
• Christina Huege @​chrstnbrn
• christopher-buss @​christopher-buss
• Craigory Coppola @​AgentEnder
• Danny Wilson
• Denis Frenademetz @​skrtheboss
• Eduardo Speroni @​edusperoni
• Emily Xiong @​xiongemi
• Federico Bartoli
• Francesco Agnoletto
• FrozenPandaz @​FrozenPandaz
• Gaurav Dubey @​gaurav0107
• Jack Hsu @​jaysoo
• Jack Stevenson
• Jason Jean @​FrozenPandaz
• Jay Bell
• Juan Franco @​jcaracciolo
• Juan Franco Caracciolo
• Jupiter Jayna @​sdjayna
• Juri Strumpflohner @​juristr
• Kaan Çelebi @​kaanisthatyou
• Kyle Cannon @​kylecannon
• Leosvel Pérez Espinosa @​leosvelperez
• MaxKless @​MaxKless
• Miroslav Jonaš @​meeroslav
• Nicolas Beaussart @​beaussan
• Quentin Emo @​xItsSky
• ShwethaSundar
• Stephen Jayna
• zlajson
• Zlatko Rekic

v23.2.1

Compare Source

23.2.1 (2026-09-09)

🚀 Features

• core: report the cache location alongside usage (#​36959)
• repo: add a .NET example for @​nx/dotnet (#​36701)

🩹 Fixes

• angular: correct declaration maps and exports of buildable libraries (#​36373, #​36357)
• core: separate daemon runtime env from graph identity (#​36565, #​36564)
• core: validate the migrations path before extracting package migrations (#​36887)
• core: release per-run process listeners and task history results (#​36866)
• core: read the pnpm 12 min-release-age policy instead of deferring to an install (#​36915, #​36914)
• core: carry minimumReleaseAge into pruned pnpm deploy output (#​36900, #​36899)
• core: report how a plugin worker was lost instead of always calling it an exit (#​36894)
• core: keep the cache in the workspace on CI (#​36922)
• core: restore the wasm walker imports dropped by a stray cfg attribute (#​36924)
• core: avoid mutating target options when resolving configurations (#​36934)
• js: resolve tsconfig to absolute path so ${configDir} paths type-check without baseUrl (#​36445)
• misc: scan package projects for env vars (#​36847)
• release: exclude AI coding agents from the changelog Thank You section (#​36892)
• release: use the release group name when resolving the previous tag for fixed groups (#​36554)
• repo: provision JDK 17 for Gradle builds with mise (#​36965)
• repo: guard JAVA17_HOME against an uninstalled JDK (#​36969)
• rspack: write the normalized cache option in NxAppRspackPlugin (#​36905, #​36878)

❤️ Thank You

• AgentEnder @​AgentEnder
• Caleb Ukle
• Claude
• Craigory Coppola @​AgentEnder
• Denis Frenademetz @​skrtheboss
• Eduardo Speroni @​edusperoni
• Federico Bartoli
• FrozenPandaz @​FrozenPandaz
• Jack Stevenson
• Jason Jean @​FrozenPandaz
• Jupiter Jayna @​sdjayna
• Juri Strumpflohner @​juristr
• Leosvel Pérez Espinosa @​leosvelperez
• Nicolas Beaussart @​beaussan
• ShwethaSundar
• Stephen Jayna

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6f218948-a4dc-4377-ada4-c959dde38c29

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.82%. Comparing base (77a7c42) to head (4843a36).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #986   +/-   ##
=======================================
  Coverage   97.82%   97.82%           
=======================================
  Files          92       92           
  Lines        3133     3133           
  Branches      554      554           
=======================================
  Hits         3065     3065           
  Misses         24       24           
  Partials       44       44           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.