Skip to content

fix(core): preserve comments in catalog YAML updates#35733

Open
polygraph-snapshot-app[bot] wants to merge 5 commits into
masterfrom
pnpm-workspace-comments
Open

fix(core): preserve comments in catalog YAML updates#35733
polygraph-snapshot-app[bot] wants to merge 5 commits into
masterfrom
pnpm-workspace-comments

Conversation

@polygraph-snapshot-app
Copy link
Copy Markdown
Contributor

Current Behavior

When nx migrate (or nx release version) bumps a package that's referenced via catalog: in pnpm-workspace.yaml or .yarnrc.yml, all comments, YAML anchors, and formatting in the file are wiped out. The catalog manager update path used @zkochan/js-yaml's load/dump, which parses YAML to plain JS objects and serializes back without preserving any non-data tokens.

Expected Behavior

User-authored comments, anchors, and formatting survive a catalog version bump. Only the targeted version entry changes; everything else in the file is byte-stable.

Implementation Details

updateCatalogVersions in both the nx and @nx/devkit catalog managers (pnpm + yarn variants) now uses the yaml package's Document API, which is designed for comment-preserving round-trips. The walk is alias-aware so configs using YAML anchors keep working, and null placeholders (catalog: with no value, optionally carrying comments) are seeded inline so empty skeletons can still be populated without dropping their comments.

yaml is added as a direct dependency of @nx/devkit (it was already a runtime dep of nx).


View session information ↗

@nx-cloud
Copy link
Copy Markdown
Contributor

nx-cloud Bot commented May 19, 2026

View your CI Pipeline Execution ↗ for commit 3c9d3a3

Command Status Duration Result
nx affected --targets=lint,test,build,e2e,e2e-c... ✅ Succeeded 16m 39s View ↗
nx run-many -t check-imports check-lock-files c... ✅ Succeeded 3s View ↗
nx-cloud record -- pnpm nx-cloud conformance:check ✅ Succeeded 9s View ↗
nx build workspace-plugin ✅ Succeeded <1s View ↗
nx-cloud record -- nx sync:check ✅ Succeeded 20s View ↗
nx-cloud record -- nx format:check ✅ Succeeded 7s View ↗

☁️ Nx Cloud last updated this comment at 2026-05-20 07:16:38 UTC

@netlify
Copy link
Copy Markdown

netlify Bot commented May 19, 2026

Deploy Preview for nx-dev ready!

Name Link
🔨 Latest commit b51fc5b
🔍 Latest deploy log https://app.netlify.com/projects/nx-dev/deploys/6a0d5abd2e930d00089a45ac
😎 Deploy Preview https://deploy-preview-35733--nx-dev.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify
Copy link
Copy Markdown

netlify Bot commented May 19, 2026

Deploy Preview for nx-docs ready!

Name Link
🔨 Latest commit b51fc5b
🔍 Latest deploy log https://app.netlify.com/projects/nx-docs/deploys/6a0d5abda551d400073bafa4
😎 Deploy Preview https://deploy-preview-35733--nx-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

nx-cloud[bot]

This comment was marked as outdated.

nx-cloud[bot]

This comment was marked as outdated.

nx-cloud[bot]

This comment was marked as outdated.

leosvelperez and others added 4 commits May 20, 2026 08:10
The catalog manager update path used @zkochan/js-yaml's load/dump, which
parses YAML to plain JS objects and serializes back without comments,
anchors, or formatting. As a result, `nx migrate` and `nx release version`
wiped user-authored content from pnpm-workspace.yaml and .yarnrc.yml
whenever a catalog-referenced package was bumped.

Switch updateCatalogVersions in both nx and devkit catalog managers (pnpm
and yarn variants) to the eemeli/yaml Document API. Walk paths alias-aware
so configs using YAML anchors keep working, and seed null placeholders
inline so empty `catalog:` skeletons (sometimes carrying only comments)
can still be populated without dropping their comments.
Both pnpm-manager and yarn-manager in each of `nx` and `@nx/devkit`
contained the same alias-aware YAML helpers, the same read helpers, and a
near-identical `updateCatalogVersions` body that differed only by the
config filename. Move them into a per-package `manager-utils.ts` and let
each manager's methods delegate. Each manager file drops ~180 lines.

The duplication between nx and devkit remains, intentionally: the
@nx/devkit peerDep range covers nx versions that don't expose these
helpers via devkit-internals. The devkit copy can be replaced with a
re-export from nx once the lowest supported version ships the helpers.
The new yaml-based catalog updater emits unquoted scalars
(`react: 18.2.0`) where the previous `@zkochan/js-yaml` `dump` path
emitted forced double-quoted scalars (`react: "18.2.0"`). Both are
semantically identical YAML, but the e2e assertions in misc.test.ts
were hard-coded against the quoted form. Drop the quotes from the
expected substrings.
@leosvelperez leosvelperez force-pushed the pnpm-workspace-comments branch from 6e54e78 to 3c9d3a3 Compare May 20, 2026 06:14
Copy link
Copy Markdown
Contributor

@nx-cloud nx-cloud Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nx Cloud has identified a flaky task in your failed CI:

🔂 Since the failure was identified as flaky, we triggered a CI rerun by adding an empty commit to this branch.

Nx Cloud View detailed reasoning in Nx Cloud ↗


🎓 Learn more about Self-Healing CI on nx.dev

@socket-security
Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: pnpm-lock.yamlnpm/entities@4.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: pnpm-lock.yamlnpm/entities@6.0.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@leosvelperez leosvelperez marked this pull request as ready for review May 20, 2026 07:18
@leosvelperez leosvelperez requested a review from a team as a code owner May 20, 2026 07:18
@leosvelperez leosvelperez self-requested a review May 20, 2026 07:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant