Skip to content

fix(deps): bump nx 22.5.3 -> 22.7.7 (CVE-2026-71476 / GHSA-vp3h-ghgh-jr7g) - #1674

Closed
paigeCLL wants to merge 1 commit into
mainfrom
vuln-fix-DX-4948
Closed

paigeCLL wants to merge 1 commit into
mainfrom
vuln-fix-DX-4948

Conversation

@paigeCLL

@paigeCLL paigeCLL commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Bumps nx and all @nx/* packages from 22.5.3 to 22.7.7 to remediate a High severity Dependabot alert (#1416, GHSA-vp3h-ghgh-jr7g / CVE-2026-71476).
  • The vulnerability is a zip-slip / arbitrary file write (potentially RCE) in Nx's self-hosted HTTP remote cache tar extractor. This repo does not use the self-hosted remote cache or the deprecated @nx/*-cache packages, so exposure was theoretical — the bump closes the alert.
  • The patched extractor is a drop-in upgrade; no configuration or migration is needed.
  • Also adds a onlyBuiltDependencies list to pnpm-workspace.yaml so pnpm 10 allows the required postinstall scripts (lefthook, nx, esbuild, @swc/core) to run, which the git hooks depend on.

Verification

  • pnpm build — 17 projects ✅
  • pnpm lint — 4 projects ✅
  • pnpm test — 18 projects ✅

Refs: DX-4948, upstream advisory, fix PR nrwl/nx#36116

🤖 Generated with Claude Code

@github-actions

github-actions Bot commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor

🦋 Changeset is good to go

Latest commit: d6eb005

We got this.

Not sure what this means? Click here to learn what changesets are.

@paigeCLL
paigeCLL marked this pull request as draft October 14, 2026 21:29
@paigeCLL paigeCLL closed this Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant