[dependabot]

Bumps nx from 22.5.1 to 23.3.0.

Release notes

Sourced from nx's releases.

23.3.0 (2026-10-07)

🚀 Features

• angular: support ngrx v22 (#36950)
• angular-rspack: scaffold and run SSR apps on the @​angular/ssr application engine (#36298)
• core: emit a runbook and per-step instructions for orchestrated migrate runs (#36766)
• core: report the cache location alongside usage (#36959)
• core: share one workspace walk across processes through the files archive (#36980)
• core: hash a continuous dependency's inputs into the task it serves (#37017)
• core: guarantee terminal output files and add an agent-friendly summary output style (#36703)
• core: add includeIgnored filesets and let the workspace context own the daemon's watch (#37025)
• core: cache plugin capabilities so reading them costs at most one load (#36999)
• core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#36918)
• core: add sandbox target configuration for observed-IO opt-out (#36853)
• core: hash tasks from Nx Cloud I/O snapshots (#37036)
• core: replace the sandbox target property with ultracache (#37165)
• core: opt in to selecting affected tasks instead of projects (#36825)
• core: record unresolved migrations and cap retries in orchestrated migrate runs (#36986)
• core: report an active orchestrated migrate run instead of resuming it (#36988)
• core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#36989)
• core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#37242)
• core: explain why each task is affected with --explain (#36885)
• core: run a final agent validation pass at the end of an orchestrated migrate run (#37069)
• js: cache TypeScript reference expansion during createNodes (#37003, #37002)
• linter: add a batched @​nx/oxlint:lint executor (#36827)
• nx-cloud: add nx cloud demo link to cloud prompts (#36956)
• nx-cloud: remove the never option from the nx cloud prompt (#37079)
• repo: add a .NET example for @​nx/dotnet (#36701)
• testing: support cypress v16 (#36953)
• vitest: support vitest 5 (#37142)

🩹 Fixes

• angular: correct declaration maps and exports of buildable libraries (#36373, #36357)
• angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#36972, #36970)
• angular-rspack: keep class field closures per instance in minified builds (#37066, #37050)
• angular-rspack: update piscina to address critical vulnerability (#37252)
• bundling: write the esbuild bundle to an overridden outputPath (#37101, #37091)
• bundling: clear typescript update timer when a rollup build closes its watch program (#37196)
• core: separate daemon runtime env from graph identity (#36565, #36564)
• core: validate the migrations path before extracting package migrations (#36887)
• core: release per-run process listeners and task history results (#36866)
• core: read the pnpm 12 min-release-age policy instead of deferring to an install (#36915, #36914)
• core: carry minimumReleaseAge into pruned pnpm deploy output (#36900, #36899)
• core: report how a plugin worker was lost instead of always calling it an exit (#36894)
• core: keep the cache in the workspace on CI (#36922)
• core: restore the wasm walker imports dropped by a stray cfg attribute (#36924)
• core: avoid mutating target options when resolving configurations (#36934)
• core: carry pnpm's package-manager document into the pruned lockfile (#36947)

... (truncated)

Commits

• 2b305ee fix(core): accept --final-validation with a migrate CLI pinned below 23.2.0 (...
• d133deb fix(core): size the default cache bound from its own filesystem (#37269)
• cd1ea02 fix(core): reuse the stored ultracache configurations without an age limit (#...
• e09f772 fix(core): stop merging declared negations into ultracache file groups (#37304)
• a0dc568 chore(core): update smol-toml to 1.9.0 for GHSA-r4xh-jqrq-34v2 (#37293)
• a26644b fix(core): answer daemon output tracking from the workspace context (#37217)
• 3ec060f fix(core): keep ultracache exclusions with the globs they trim (#37285)
• af0b4fb feat(core): run a final agent validation pass at the end of an orchestrated m...
• ead0427 fix(core): skip batch cache lookups for deferred tasks until their deps run (...
• da9d339 feat(core): explain why each task is affected with --explain (#36885)
• Additional commits viewable in compare view

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

[strix-security]

Strix Security Review

Warning

This pull request has 9 commits after the last Strix review (97592c3). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

No security issues found.

Review summary

This PR is a Dependabot dev-dependency bump that upgrades the nx build/orchestration tool from 22.5.1 to 23.3.0, touching only package.json and package-lock.json (plus a root license metadata change from MIT to Apache-2.0). No application source code, routes, auth logic, input handling, or runtime dependencies are modified. nx is a dev tool and the bump is in the upward (safe) direction; its transitive changes resolve known vulnerabilities (e.g., smol-toml GHSA-r4xh-jqrq-34v2 and a piscina fix) rather than introducing new ones. No security vulnerabilities were identified in the changed code.

_{Updated for 97592c3.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[dependabot]

Looks like nx is no longer being updated by Dependabot, so this is no longer needed.