Conversation
❌ Deploy Preview for nx-dev failed. Why did it fail? →
|
❌ Deploy Preview for nx-docs failed. Why did it fail? →
|
Contributor
|
View your CI Pipeline Execution ↗ for commit 476add0
☁️ Nx Cloud last updated this comment at |
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
jaysoo
force-pushed
the
NXC-4762
branch
2 times, most recently
from
August 4, 2026 20:31
8a07d19 to
521c1ce
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
nx and several plugins depend on minimatch, which pulls brace-expansion (GHSA-rgw5-rvv9-x895 DoS, third CVE in that package this year). All minimatch usages replaced with picomatch (nx, devkit, jest, playwright, react, rsbuild). minimatch, brace-expansion and balanced-match leave the published nx runtime dependency closure. Not pure 1:1: - picomatch only lets a leading `**/` match zero path segments in standalone patterns, not inside `{a,b}` brace alternation, so combineGlobPatterns output missed root-level files. New splitGlobPatterns() (local copy in devkit for the +/-1 nx major compat contract); jest plugin and project-glob-changes pass pattern arrays instead. - picomatch throws on empty patterns and invalid makeRe input where minimatch returned false/null: guards added at the affected sites. - `!(x)` is a real extglob now (micromatch semantics), which makes the min-release-age yarn matcher closer to yarn's own behavior. Dev-tree transitives (eslint, glob, verdaccio, typedoc) still pull minimatch, so the pnpm overrides stay; brace-expansion override bumped to 5.0.9 (the patched version). Fixes NXC-4762
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Co-authored-by: jaysoo <jaysoo@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Nx Cloud is proposing a fix for your failed CI:
We updated getPackageManagerCommand in e2e/utils/command-utils.ts to use yarn install --no-immutable for yarn berry (v2+), mirroring the existing pnpm install --no-frozen-lockfile pattern that addresses the same CI-immutable-mode problem. This fixes the YN0028 error that the PR triggered by introducing picomatch as a new runtime dependency: that addition caused yarn 4's lockfile migration to need 401+ new package entries, which was deterministically blocked by yarn's default --immutable mode when CI=true. With --no-immutable, the beforeAll lockfile-refresh step can proceed as intended.
Warning
❌ We could not verify this fix.
diff --git a/e2e/utils/command-utils.ts b/e2e/utils/command-utils.ts
index 66cd0fd9..76b4c287 100644
--- a/e2e/utils/command-utils.ts
+++ b/e2e/utils/command-utils.ts
@@ -164,7 +164,12 @@ export function getPackageManagerCommand({
? 'yarn nx'
: `yarn --silent nx`,
runUninstalledPackage: 'npx --yes',
- install: 'yarn',
+ // --no-immutable: yarn berry (v2+) detects CI and would otherwise default
+ // to --immutable, blocking lockfile updates in e2e setup steps.
+ install:
+ yarnMajorVersion && +yarnMajorVersion >= 2
+ ? 'yarn install --no-immutable'
+ : 'yarn',
ciInstall: 'yarn --frozen-lockfile',
addProd: isYarnWorkspace ? 'yarn add -W' : 'yarn add',
addDev: isYarnWorkspace ? 'yarn add -DW' : 'yarn add -D',
🔔 Heads up, your workspace has pending recommendations ↗ to auto-apply fixes for similar failures.
Or Apply changes locally with:
npx nx-cloud apply-locally sOm5-yPMY
Apply fix locally with your editor ↗ View interactive diff ↗
🎓 Learn more about Self-Healing CI on nx.dev
Follow-up to the minimatch -> picomatch swap, addressing defects in the
compatibility code rather than the swap itself.
expandGlobPatternBraces:
- scan past comma-free groups instead of bailing on the first one, so a
range or `{token}` before an alternation no longer disables expansion
- treat backslash-escaped braces as literals; splitting them produced
patterns that matched neither what minimatch nor raw picomatch matched
- build results with a loop; the spread hit the argument limit and
reported a misleading RangeError
- correct the docstring: results are not brace-free, groups without a
top-level comma are what gets skipped, and output is the product of
the alternation widths
splitGlobPatterns now never emits an empty pattern, in both the nx and
devkit copies. picomatch rejects '' where minimatch matched nothing, so
every downstream length check becomes correct for free.
filterUsingGlobPatterns:
- drop empty expansion products so `{,a}` and a bare `!` stop throwing
- remove the './' strip, which existed for a minimatch limitation
picomatch does not have and was what manufactured the empty pattern.
This also restores the `<root>/**/*` fast path for root-level projects
- pass `posix: true` so `[!a]` stays a negated class; without it the
match inverted, which silently changed the hashed file set
- skip compiling positive matchers when the fast path already matches
glob() / globAsync():
- apply splitGlobPatterns, so a combined `{**/a,**/b}` glob keeps
matching root-level files
- treat a list of only negations as everything not excluded, matching
NxGlobSet::is_match in src/native/glob.rs
- leave `!(` extglobs to picomatch instead of stripping the `!`
- name the offending entry in the error instead of a synthesized glob
@nx/jest now reuses nx core's buildPackageJsonPatterns and
buildPackageJsonWorkspacesMatcher rather than a local copy, so the two
can no longer disagree about which package.json files are in the
workspaces. picomatch is no longer a dependency of @nx/jest.
buildPackageJsonPatterns also learns the `!(` extglob guard.
hasRsbuildPlugin matches a project directory rather than a file, so it
passes `strictSlashes: true` to keep `<root>/**` from matching `<root>`.
Docs and one comment updated to stop naming minimatch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
nx and several plugins depend on minimatch, which pulls brace-expansion (GHSA-rgw5-rvv9-x895 DoS, third CVE in that package this year).
Expected Behavior
All minimatch usages replaced with picomatch (nx, devkit, jest, playwright, react, rsbuild); minimatch/brace-expansion/balanced-match leave the published
nxruntime dependency closure (some@nx/*plugins still pull minimatch transitively via upstream deps, e.g. @nx/jest via @jest/reporters). Not pure 1:1: picomatch does not give**/zero-segment treatment inside{a,b}brace alternation, so combined plugin globs are split (splitGlobPatterns) and hasher filesets are brace-expanded (expandGlobPatternBraces); empty-pattern throws are guarded. The jest workspaces matcher and tree-aware glob now honor negated patterns correctly (previously negations made everything match), which can change inferred jest targets for workspaces using negated entries. brace-expansion override bumped to patched 5.0.9 for the remaining dev-tree transitives.Related Issue(s)
Fixes NXC-4762
View session information ↗.