Skip to content

fix(deps): bump nx to 22.7.9 for security advisories #1685

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kalverra merged 5 commits into from
Oct 7, 2026
Merged

fix(deps): bump nx to 22.7.9 for security advisories #1685

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
42b4bbe
fix(deps): bump nx to 22.7.9 for OS command injection, daemon socket …
kalverra Oct 6, 2026
79c8c36
fix(deps): override axios to 1.20.0 pulled in by nx 22.7.9
kalverra Oct 6, 2026
1ecc86c
fix(deps): override brace-expansion to ^5.0.12 pulled in by nx 22.7.9
kalverra Oct 6, 2026
94ba9db
fix(deps): bump nx to 22.7.12 and override smol-toml to ^1.9.0
kalverra Oct 6, 2026
643ab30
Merge branch 'main' into DX-5545-bump-nx-22-7-9
kalverra Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/nx-security-bump-22-7-9.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"dot-github": patch
---

Bump nx and @nx/* from 22.5.3 to 22.7.12 for security advisories GHSA-w2vw-w76x-qr89 (OS command injection via git revisions), GHSA-w3vv-58gj-gw77 (daemon/plugin worker socket exposure), GHSA-vp3h-ghgh-jr7g (Zip-Slip in self-hosted remote cache), and GHSA-hrvq-x7jp-36xv (Nx vulnerability in versions <22.7.10). Add overrides for smol-toml, brace-expansion, and axios. Fixes DX-5545, DX-5544, DX-5540, DX-5538, DX-4948, DX-4947
16 changes: 8 additions & 8 deletions actions/ci-grafana-alert-test/dist/index.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 8 additions & 8 deletions apps/go-conditional-tests/dist/index.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions lefthook.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ pre-commit:
description: "Fix reusable workflows sync"
glob: "{workflows/*/*,.github/workflows/*}.{yml,yaml}"
run: pnpm workflows:fix --stage {staged_files}
stage_fixed: true
actionlint:
description: "Run actionlint"
glob: "{workflows/*/*,.github/workflows/*}.{yml,yaml}"
Expand All @@ -26,5 +27,7 @@ pre-commit:
build-artifacts:
description: "Build artifacts for affected projects"
glob: "*.{js,ts,json}"
env:
CI: "true"
run: pnpm build:affected
stage_fixed: true
3 changes: 2 additions & 1 deletion nx.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,5 +50,6 @@
"targetName": "lint"
}
}
]
],
"analytics": true
}
17 changes: 10 additions & 7 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,12 @@
"devDependencies": {
"@changesets/changelog-github": "^0.5.2",
"@changesets/cli": "^2.31.1",
"@nx/devkit": "22.5.3",
"@nx/esbuild": "22.5.3",
"@nx/eslint": "22.5.3",
"@nx/eslint-plugin": "22.5.3",
"@nx/js": "22.5.3",
"@nx/plugin": "22.5.3",
"@nx/devkit": "22.7.12",
"@nx/esbuild": "22.7.12",
"@nx/eslint": "22.7.12",
"@nx/eslint-plugin": "22.7.12",
"@nx/js": "22.7.12",
"@nx/plugin": "22.7.12",
"@swc-node/register": "1.11.1",
"@swc/cli": "0.7.10",
"@swc/core": "1.15.8",
Expand All @@ -48,7 +48,7 @@
"eslint-config-prettier": "10.1.8",
"jsdom": "~24.1.3",
"lefthook": "^1.13.6",
"nx": "22.5.3",
"nx": "22.7.12",
"prettier": "^3.9.9",
"rimraf": "^6.1.3",
"ts-node": "10.9.2",
Expand All @@ -60,6 +60,9 @@
"repository": "https://github.com/smartcontractkit/.github",
"pnpm": {
"overrides": {
"axios": "^1.20.0",
"brace-expansion": "^5.0.12",
"smol-toml": "^1.9.0",
"form-data": "4.0.6",
"shell-quote": "1.11.0",
"vite": "7.3.7",
Expand Down
Loading
Loading