fix(deps, frontend, v1.2): update dependency nx to v23.0.2 by github-actions[bot] · Pull Request #7379 · apache/texera

github-actions · 2026-08-07T03:50:47Z

What changes were proposed in this PR?

Automated backport of #7378 to release/v1.2.

Source: 42e09f5 · automation run

Any related issues, documentation, discussions?

Backport of #7378. Fixes CVE-2026-71476, CVE-2025-36852 (see #7378 for details).

How was this PR tested?

Release-branch CI runs on this branch once the conflicts are resolved and this PR is marked ready for review.

Was this PR authored or co-authored using generative AI tooling?

No.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [nx](https://nx.dev) ([source](https://redirect.github.com/nrwl/nx/tree/HEAD/packages/nx)) | [`23.0.1` → `23.0.2`](https://renovatebot.com/diffs/npm/nx/23.0.1/23.0.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/nx/23.0.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nx/23.0.1/23.0.2?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6912) for more information. --- ### Nx: Zip-Slip in the self-hosted remote cache [CVE-2026-71476](https://nvd.nist.gov/vuln/detail/CVE-2026-71476) / [GHSA-vp3h-ghgh-jr7g](https://redirect.github.com/advisories/GHSA-vp3h-ghgh-jr7g) <details> <summary>More information</summary> #### Details ##### Summary The Nx **self-hosted HTTP remote cache** extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path (MITM) — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache. ##### Affected Packages > [!IMPORTANT] > **Nx's default local cache and Nx Cloud are NOT affected.** The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (`NX_SELF_HOSTED_REMOTE_CACHE_SERVER`, `@nx/s3-cache`, etc.) are affected. Two self-hosted cache surfaces are affected: 1. **The built-in HTTP remote cache** (`NX_SELF_HOSTED_REMOTE_CACHE_SERVER`, in `nx`) — **fixed** in the patched release. 2. **The self-hosted cache packages** — `@nx/s3-cache`, `@nx/gcs-cache`, `@nx/azure-cache`, `@nx/shared-fs-cache` (and their `@nx/powerpack-*` predecessors) — the same flaw in their own extractor. **Deprecated** (CVE-2025-36852) and not patched; migrate off (see Remediation). The shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched `nx` release. ##### Remediation **Upgrade to Nx `22.7.7` or `23.0.2` (or later).** The patched extractor is a drop-in — no configuration change is required. ##### If you use the S3, GCS, Azure, or shared-filesystem cache packages `@nx/s3-cache`, `@nx/gcs-cache`, `@nx/azure-cache`, and `@nx/shared-fs-cache` (and their `@nx/powerpack-*` predecessors) are separately versioned packages and are **already deprecated** (see CVE-2025-36852). Upgrading `nx` hardens the shared restore step, but it does not fully secure these packages. The remediation for them is to **migrate off** — to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache — per the deprecation guidance: https://nx.dev/docs/reference/deprecated/self-hosted-cache-packages ##### Details When Nx retrieves an artifact from the self-hosted HTTP remote cache, it downloads a gzipped tar archive and extracts it. The extractor joined each untrusted tar entry name directly onto the output directory and unpacked it with `tar`'s **unguarded** `Entry::unpack()`, which performs no containment check: ```rust // vulnerable let path_on_disk = output_dir.join(entry_path); // entry_path is attacker-controlled fs::create_dir_all(path_on_disk.parent()…)?; entry.unpack(&path_on_disk)?; ``` In addition, restore now copies **only** the declared task outputs (never the whole cache directory), confined to the workspace root; parent directories are realized as real directories so a write can never traverse a symlink; declared outputs that resolve outside the workspace are rejected; and the malformed-input cases return errors instead of panicking. ##### References - Fix: [https://github.com/nrwl/nx/pull/36116](https://redirect.github.com/nrwl/nx/pull/36116) (merged) - TLS-verification warning follow-up: [https://github.com/nrwl/nx/pull/36132](https://redirect.github.com/nrwl/nx/pull/36132) (merged) - Vulnerable extractor introduced in Nx 20.8.0: [https://github.com/nrwl/nx/pull/30593](https://redirect.github.com/nrwl/nx/pull/30593) ##### Credits - **Lidor B.**, Novee Security — Reporter - **Assaf Levkovich**, Novee Security — Reporter #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g](https://redirect.github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g) - [https://github.com/nrwl/nx/pull/36116](https://redirect.github.com/nrwl/nx/pull/36116) - [https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee](https://redirect.github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee) - [https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30](https://redirect.github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30) - [https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9](https://redirect.github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9) - [https://github.com/nrwl/nx](https://redirect.github.com/nrwl/nx) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-vp3h-ghgh-jr7g) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>nrwl/nx (nx)</summary> ### [`v23.0.2`](https://redirect.github.com/nrwl/nx/releases/tag/23.0.2) [Compare Source](https://redirect.github.com/nrwl/nx/compare/23.0.1...23.0.2) ##### 23.0.2 (2026-07-10) ##### 🚀 Features - **core:** re-add isCacheableTask helper ([#36177](https://redirect.github.com/nrwl/nx/pull/36177)) ##### 🩹 Fixes - **bundling:** prevent TS6059 when an app imports a workspace lib from source ([#36217](https://redirect.github.com/nrwl/nx/pull/36217), [#35017](https://redirect.github.com/nrwl/nx/issues/35017)) - **core:** prefer module.registerHooks to avoid DEP0205 deprecation warning ([#36081](https://redirect.github.com/nrwl/nx/pull/36081)) - **core:** prevent nx migrate crash when include=optional filters out the target package ([#36087](https://redirect.github.com/nrwl/nx/pull/36087)) - **core:** make nx migrate honor preapproved packages and emit a valid temp workspace ([#36086](https://redirect.github.com/nrwl/nx/pull/36086)) - **core:** skip daemon project-graph recompute on no-op file rewrites ([#36082](https://redirect.github.com/nrwl/nx/pull/36082)) - **core:** prevent the TUI from auto-selecting a completed task when a batch finishes ([#35833](https://redirect.github.com/nrwl/nx/pull/35833)) - **core:** deregister pseudo-terminal exit handlers when tasks finish ([#36115](https://redirect.github.com/nrwl/nx/pull/36115)) - **core:** prevent path traversal / zip-slip in self-hosted remote cache ([#36116](https://redirect.github.com/nrwl/nx/pull/36116)) - **core:** respect explicit --nxCloud=skip for AI agents in create-nx-workspace ([#36131](https://redirect.github.com/nrwl/nx/pull/36131)) - **core:** warn when the self-hosted remote cache disables TLS verification (NXC-4593) ([#36132](https://redirect.github.com/nrwl/nx/pull/36132), [#36116](https://redirect.github.com/nrwl/nx/issues/36116)) - **core:** throw actionable error when pnpm .modules.yaml is missing ([#35666](https://redirect.github.com/nrwl/nx/pull/35666), [#35635](https://redirect.github.com/nrwl/nx/issues/35635)) - **core:** support `${configDir}` in tsconfig path alias resolution ([#36037](https://redirect.github.com/nrwl/nx/pull/36037), [#35804](https://redirect.github.com/nrwl/nx/issues/35804)) - **core:** prevent non-npm devEngines pin from breaking npm registry lookups ([#36020](https://redirect.github.com/nrwl/nx/pull/36020), [#35815](https://redirect.github.com/nrwl/nx/issues/35815)) - **core:** clarify nx sync remediation messaging and surface spinner output in non-tty ([#35747](https://redirect.github.com/nrwl/nx/pull/35747)) - **core:** exclude direct-dependency overrides from generated package.json ([#36040](https://redirect.github.com/nrwl/nx/pull/36040), [#35675](https://redirect.github.com/nrwl/nx/issues/35675)) - **core:** apply target defaults when project.json overrides an inferred run-commands target with different commands ([#36142](https://redirect.github.com/nrwl/nx/pull/36142), [#36067](https://redirect.github.com/nrwl/nx/issues/36067)) - **core:** run the nx.bat wrapper for dot-nx setup on windows ([#36048](https://redirect.github.com/nrwl/nx/pull/36048)) - **core:** speed up bun lockfile parsing ([#36198](https://redirect.github.com/nrwl/nx/pull/36198)) - **core:** set NX\_CLI\_SET in batch worker processes ([#36214](https://redirect.github.com/nrwl/nx/pull/36214), [#36210](https://redirect.github.com/nrwl/nx/issues/36210)) - **core:** preserve comments in catalog YAML updates ([#35733](https://redirect.github.com/nrwl/nx/pull/35733)) - **core:** box JsonFileSet payload to keep HashInstruction small ([#36247](https://redirect.github.com/nrwl/nx/pull/36247), [#35248](https://redirect.github.com/nrwl/nx/issues/35248), [#36244](https://redirect.github.com/nrwl/nx/issues/36244), [#36152](https://redirect.github.com/nrwl/nx/issues/36152)) - **core:** share workspace fileset hash results instead of deep-cloning per task ([#36244](https://redirect.github.com/nrwl/nx/pull/36244), [#34971](https://redirect.github.com/nrwl/nx/issues/34971), [#34942](https://redirect.github.com/nrwl/nx/issues/34942)) - **core:** replace per-input visited clones with undo-log scoping in hash planner ([#36248](https://redirect.github.com/nrwl/nx/pull/36248), [#35071](https://redirect.github.com/nrwl/nx/issues/35071), [#36152](https://redirect.github.com/nrwl/nx/issues/36152), [#34971](https://redirect.github.com/nrwl/nx/issues/34971), [#36244](https://redirect.github.com/nrwl/nx/issues/36244), [#35248](https://redirect.github.com/nrwl/nx/issues/35248), [#36247](https://redirect.github.com/nrwl/nx/issues/36247)) - **core:** intern hash instructions in a pool and plan with id lists ([#36249](https://redirect.github.com/nrwl/nx/pull/36249), [#35071](https://redirect.github.com/nrwl/nx/issues/35071), [#36152](https://redirect.github.com/nrwl/nx/issues/36152), [#36248](https://redirect.github.com/nrwl/nx/issues/36248)) - **core:** detect Codex sandbox on Linux to disable daemon and plugin isolation ([#36273](https://redirect.github.com/nrwl/nx/pull/36273)) - **devkit:** restore prettier v2 support in formatFiles ([#36193](https://redirect.github.com/nrwl/nx/pull/36193)) - **graph:** prevent project details web view top from being clipped ([#36154](https://redirect.github.com/nrwl/nx/pull/36154)) - **js:** prevent doubled output paths in buildable library path mappings ([#36138](https://redirect.github.com/nrwl/nx/pull/36138), [#36079](https://redirect.github.com/nrwl/nx/issues/36079)) - **js:** scope incremental type-check .tsbuildinfo per project ([#36137](https://redirect.github.com/nrwl/nx/pull/36137), [#36113](https://redirect.github.com/nrwl/nx/issues/36113)) - **js:** preserve npm allowScripts allowlist in pruned package.json ([#36016](https://redirect.github.com/nrwl/nx/pull/36016), [#35931](https://redirect.github.com/nrwl/nx/issues/35931)) - **js:** resolve catalog references in pruned package.json output ([#35805](https://redirect.github.com/nrwl/nx/pull/35805), [#35419](https://redirect.github.com/nrwl/nx/issues/35419)) - **js:** avoid import locator unicode position panic ([#36133](https://redirect.github.com/nrwl/nx/pull/36133), [#36128](https://redirect.github.com/nrwl/nx/issues/36128)) - **js:** prevent Windows TS6059 rootDir errors in tsc builds ([#36184](https://redirect.github.com/nrwl/nx/pull/36184), [#35696](https://redirect.github.com/nrwl/nx/issues/35696)) - **js:** wait for process tree exit when stopping node executor tasks ([#36230](https://redirect.github.com/nrwl/nx/pull/36230)) - **linter:** update terminal cli regex for local-dist build ([#36201](https://redirect.github.com/nrwl/nx/pull/36201), [#36199](https://redirect.github.com/nrwl/nx/issues/36199)) - **maven:** de-flake maven e2e by dropping -X debug forks and widening timeout ([#36091](https://redirect.github.com/nrwl/nx/pull/36091)) - **misc:** bump axios to 1.16.1 ([#36120](https://redirect.github.com/nrwl/nx/pull/36120)) - **misc:** use default import for chalk in [@nx/workspace](https://redirect.github.com/nx/workspace) output.ts ([#35523](https://redirect.github.com/nrwl/nx/pull/35523), [#35521](https://redirect.github.com/nrwl/nx/issues/35521), [#34111](https://redirect.github.com/nrwl/nx/issues/34111), [#21201](https://redirect.github.com/nrwl/nx/issues/21201), [#26667](https://redirect.github.com/nrwl/nx/issues/26667)) - **misc:** remove duplicate nx init cloud-prompt telemetry event ([#36145](https://redirect.github.com/nrwl/nx/pull/36145)) - **nx-cloud:** use standard utm params on cloud prompt links ([#36227](https://redirect.github.com/nrwl/nx/pull/36227), [#36226](https://redirect.github.com/nrwl/nx/issues/36226)) - **nx-dev:** remove empty SaaS and Mobile template filters ([#36085](https://redirect.github.com/nrwl/nx/pull/36085)) - **react:** reserve ports in rspack e2e test to avoid default port collisions ([#36090](https://redirect.github.com/nrwl/nx/pull/36090)) - **react:** stop pinning eslint-plugin-react in generated projects ([#36168](https://redirect.github.com/nrwl/nx/pull/36168), [#36161](https://redirect.github.com/nrwl/nx/issues/36161)) - **release:** widen release e2e timeouts to absorb pre-version dlx install ([#36092](https://redirect.github.com/nrwl/nx/pull/36092)) - **repo:** trust wix/brew tap so macOS detox CI can install applesimutils ([#36146](https://redirect.github.com/nrwl/nx/pull/36146)) - **rspack:** use contenthash for chunkFilename to prevent stale chunks ([#36136](https://redirect.github.com/nrwl/nx/pull/36136), [#2292](https://redirect.github.com/nrwl/nx/issues/2292), [#36014](https://redirect.github.com/nrwl/nx/issues/36014)) - **rspack:** stop mocking non-existent is-serve-mode util in apply-base-config test ([fea2cabbcc](https://redirect.github.com/nrwl/nx/commit/fea2cabbcc)) - **vite:** widen vite ts-solution e2e build timeouts for cold multi-lib build ([#36093](https://redirect.github.com/nrwl/nx/pull/36093)) - **vite:** detect [@vitejs/plugin-vue2](https://redirect.github.com/vitejs/plugin-vue2) (vite:vue2) for vue-tsc typecheck ([#36125](https://redirect.github.com/nrwl/nx/pull/36125), [#36094](https://redirect.github.com/nrwl/nx/issues/36094)) - **vite:** update deprecation docs link ([#36070](https://redirect.github.com/nrwl/nx/pull/36070), [#36053](https://redirect.github.com/nrwl/nx/issues/36053)) - **vitest:** support passing mode through to vitest ([#35069](https://redirect.github.com/nrwl/nx/pull/35069)) - **web:** run executor/plugin/generator commands with the workspace package manager ([#36021](https://redirect.github.com/nrwl/nx/pull/36021), [#35950](https://redirect.github.com/nrwl/nx/issues/35950)) - **webpack:** prevent TS6059 when a tsc build bundles a workspace lib ([#36188](https://redirect.github.com/nrwl/nx/pull/36188), [#35017](https://redirect.github.com/nrwl/nx/issues/35017)) ##### ❤️ Thank You - AgentEnder [@AgentEnder](https://redirect.github.com/AgentEnder) - Aidan Temple [@aidant](https://redirect.github.com/aidant) - Craigory Coppola [@AgentEnder](https://redirect.github.com/AgentEnder) - cyphercodes [@cyphercodes](https://redirect.github.com/cyphercodes) - FrozenPandaz [@FrozenPandaz](https://redirect.github.com/FrozenPandaz) - Jack Hsu [@jaysoo](https://redirect.github.com/jaysoo) - Jason Jean [@FrozenPandaz](https://redirect.github.com/FrozenPandaz) - Jonathan Garvey [@jdgarvey](https://redirect.github.com/jdgarvey) - Leosvel Pérez Espinosa [@leosvelperez](https://redirect.github.com/leosvelperez) - Miroslav Jonaš [@meeroslav](https://redirect.github.com/meeroslav) - Rayan Salhab - Richard Roozenboom [@Roozenboom](https://redirect.github.com/Roozenboom) - Sai Asish Y [@SAY-5](https://redirect.github.com/SAY-5) - Steven Nance - titanniya542-spec [@titanniya542-spec](https://redirect.github.com/titanniya542-spec) - Wilson Pinto </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera).  --------- (backported from commit 42e09f5) Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>

github-actions · 2026-08-07T03:50:47Z

The cherry-pick conflicted and was committed with conflict markers. Resolve the conflicts on this branch, then mark this PR ready for review.

Conflicting files:

frontend/package.json
frontend/yarn.lock

The cherry-pick of #7378 conflicted only on context: main's devDependency block has drifted ahead of release/v1.2. Keep the release/v1.2 versions for the surrounding entries and take only the intended change, `nx` and `@nx/angular` 23.0.0 -> 23.0.2. yarn.lock is regenerated from the release/v1.2 base with yarn 4.14.1; every nx-family entry it produces is byte-identical to the one on main.

github-actions · 2026-08-07T05:44:08Z

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

No candidates found from git blame history.

Copilot

Pull request overview

This PR is an automated backport to release/v1.2 that updates the frontend’s Nx toolchain to nx@23.0.2 (and @nx/angular@23.0.2) to pick up upstream security fixes referenced in #7378 (CVE-2026-71476, CVE-2025-36852 context).

Changes:

Bump nx from 23.0.0 to 23.0.2 in the frontend dev toolchain.
Bump @nx/angular from 23.0.0 to 23.0.2.
Refresh frontend/yarn.lock to reflect the updated Nx/Nx-plugin graph and transitive changes.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
frontend/package.json	Updates direct devDependencies to `nx@23.0.2` and `@nx/angular@23.0.2`.
frontend/yarn.lock	Updates the lockfile entries for Nx packages and associated transitive dependency resolutions/checksums.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions Bot requested a review from xuang7 August 7, 2026 03:50

github-actions Bot mentioned this pull request Aug 7, 2026

fix(deps, frontend): update dependency nx to v23.0.2 #7378

Merged

1 task

github-actions Bot added dependencies Pull requests that update a dependency file frontend Changes related to the frontend GUI labels Aug 7, 2026

aglinxinyuan marked this pull request as ready for review August 7, 2026 05:45

Copilot AI lite review requested due to automatic review settings August 7, 2026 05:45

Copilot started reviewing on behalf of aglinxinyuan August 7, 2026 05:45 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

xuang7 approved these changes Aug 7, 2026

View reviewed changes

Yicong-Huang enabled auto-merge August 7, 2026 21:11

aglinxinyuan disabled auto-merge August 8, 2026 07:53

aglinxinyuan enabled auto-merge August 8, 2026 07:53

Navigation Menu

Uh oh!

fix(deps, frontend, v1.2): update dependency nx to v23.0.2 - #7379

fix(deps, frontend, v1.2): update dependency nx to v23.0.2#7379
github-actions[bot] wants to merge 2 commits into
release/v1.2from
backport/7378-update-dependency-nx-to-v23-0-2-v1.2

github-actions Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

github-actions Bot commented Aug 7, 2026

What changes were proposed in this PR?

Any related issues, documentation, discussions?

How was this PR tested?

Was this PR authored or co-authored using generative AI tooling?

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Automated Reviewer Suggestions

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants