[Aikido] Fix 4 security issues in nx, yargs

[aikido-autofix]

Upgrade Nx and Yargs to fix critical path traversal RCE in tarball extraction, command injection in git operations, CORS bypass exposing workspace metadata, and prototype pollution in config merging. This update includes breaking changes that require manual migration.

⚠️ Code affected by breaking changes.

⚠️ The nx upgrade from 20.8.4 to 22.7.8 contains one breaking change that affects this codebase:

1. Removed deprecated getJestProjects function (21.0.0)

• Where your code is affected: jest.config.ts:1 - The root Jest configuration imports and uses getJestProjects() from @nx/jest

• Impact: The getJestProjects() function has been removed in nx 21.0.0. This will cause the Jest configuration to fail when trying to import this function, breaking all test execution across the workspace.

• Remediation: Replace getJestProjects() with the new approach. In nx 21+, Jest projects are automatically discovered through the nx plugins configuration in nx.json, so you can remove the getJestProjects() call and use a simpler configuration or rely on the plugin-based discovery.

Note on Node.js version compatibility:

While both nx 21.0.0 and yargs 18.0.0 require Node.js >= 20.19.0, this codebase is already using Node.js v24.15.0 (as specified in .nvmrc), so the Node.js version requirement is already satisfied and poses no risk.

Note on yargs:

Although yargs is pinned to version 18.1.0 in the resolutions, it's not directly imported or used in the codebase - it's only a transitive dependency through nx/jest. The yargs upgrade breaking changes (ESM-first, singleton removal, command name derivation) do not affect this codebase since there's no direct usage of yargs.

All breaking changes by upgrading nx from version 20.8.4 to 22.7.8 (CHANGELOG)

Version	Description
21.0.0	Removed deprecated functionalities for Angular v21
21.0.0	Removed usage of cli property from migration definitions
21.0.0	Removed deprecated readWorkspaceConfig
21.0.0	Dropped support for create nodes v1 in favor of only calling create nodes v2
21.0.0	Removed legacy cache flag from nx.json
21.0.0	Dropped support for node versions prior to 20.19.0
21.0.0	Removed outputStyle=compact
21.0.0	Removed deprecated getJestProjects
21.0.0	Removed tsConfig option from the @nx/jest:jest executor
21.0.0	Removed tsConfig and copyFiles options from the @nx/cypress:cypress executor
21.0.0	useLegacyVersioning is false by default in release configuration
21.0.0	Support for GitLab releases added (breaking change indicated by warning symbol)
21.0.0	Removed deprecated static-serve target name from inferred targets in Remix
21.0.0	Only provide default value for object properties if object already has value
21.0.0	Respect packageManager field in package.json when detecting version
21.2.0	Support for Angular v17 was dropped
21.2.0	Removed deprecated Storybook generators
21.4.0	Stylus (.styl) files are no longer supported in bundling.
22.0.0	The NX_DISABLE_DB environment variable has been removed.
22.0.0	CreateNodes v1 types have been removed.
22.0.0	The experimental and deprecated inlining feature has been removed from the tsc and swc executors (the external and externalBuildTargets options are no longer available).
22.0.0	The deprecated decorate-cli script has been removed.
22.0.0	The nx format command and generators no longer default to sorting TypeScript path mappings (use --sort-root-tsconfig-paths flag or set NX_FORMAT_SORT_TSCONFIG_PATHS=true to keep previous behavior).
22.0.0	The deprecated deleteOutputPath and sassImplementation options have been removed from webpack executors.
22.0.0	The deprecated deleteOutputPath and sassImplementation options have been removed from rspack executors.
22.0.0	The rspack application generator has been removed in favor of framework-specific options.
22.0.0	The default value for useLegacyTypescriptPlugin has changed to false for bundling.
22.0.0	The deprecated simpleName option has been removed from library generators.
22.0.0	The --legacy-peer-deps behavior is no longer forced by default (configure your package manager if needed).
22.0.0	Deprecated legacy versioning has been removed from release functionality.
22.0.0	Default values changed for fixed release group tag pattern, preserveMatchingDependencyRanges (now true by default), and strictPreid in release configuration.
22.0.0	The updateDependents option now defaults to always instead of auto in release configuration.
22.0.0	Release configuration structure has changed: releaseTag* properties have been refactored to a nested releaseTag object.
22.0.0	The signature of init() on VersionActions has changed (no longer accepts a second argument; validation now occurs via separate validate() method).
22.0.0	More files are now used to determine relevant commits in release, matching nx affected behavior, which may result in more projects receiving version bumps.
22.0.0	The config.conventionalCommitsConfig for DefaultChangelogRenderer is no longer nullable.
22.0.0	Multiline breaking changes are now rendered differently by the changelog renderer.
22.0.0	Version plan file contents are now better respected for changelog entries, which may change changelog output.
22.0.0	Support for non-isolated webpack config has been removed from React's componentTestingPreset.
22.6.0	vitest: reportsDirectory is now resolved against workspace root instead of project root, which may change the output location for Vitest reports (#34720)

All breaking changes by upgrading yargs from version 17.7.2 to 18.1.0 (CHANGELOG)

Version	Description
18.0.0	Command names are not derived from modules passed to command.
18.0.0	Singleton usage of yargs yargs.foo, yargs().argv, has been removed.
18.0.0	Minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
18.0.0	yargs is now ESM first

✅ 4 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-477013	HIGH	[nx] Unsafe tarball extraction in self-hosted remote cache allows path traversal attacks, enabling attackers to write arbitrary files to the filesystem and achieve remote code execution through compromised cache artifacts.
AIKIDO-2026-11005	MEDIUM	[nx] The nx graph HTTP server used a wildcard CORS header allowing malicious webpages to read sensitive workspace data including project structure and dependencies. Additionally, the Nx daemon auto-installed packages without verifying npm provenance, risking execution of tampered packages.
AIKIDO-2026-373135	MEDIUM	[nx] The CLI builds unescaped git commands with untrusted revision and branch values from configuration files, environment variables, and flags, allowing shell metacharacters to execute arbitrary commands. This impacts developers and CI systems running commands like nx affected, nx graph, nx format, nx release, and nx import.
AIKIDO-2026-922647	LOW	[yargs] Prototype pollution vulnerability in recursive configuration merging allows attackers to pollute object prototypes through __proto__ keys, potentially enabling arbitrary property manipulation and code execution.

🤖 Remediation details

Fix security vulnerabilities in nx and yargs

Short summary

This PR remediates security vulnerabilities in two packages: nx and yargs. nx was updated as a direct devDependency in the root package.json, along with all co-versioned @nx/* sibling packages. yargs is a transitive dependency with no viable parent-bump path to a patched version, so a resolutions entry was added to the root package.json to force the safe version. The yarn.lock lockfile was refreshed to reflect all changes.

nx

nx was declared as an exact-version direct devDependency (20.8.4) in the root package.json, placing it squarely in the vulnerable ranges for three advisories. It was bumped to 22.7.8 — the minimum version satisfying all three patched-version specs — by editing the manifest directly. All seven co-versioned @nx/* packages (@nx/esbuild, @nx/eslint, @nx/eslint-plugin, @nx/jest, @nx/js, @nx/node, @nx/workspace) were updated to 22.7.8 in the same pass to preserve the aligned versioning the project already maintained across the NX plugin family.

yargs

yargs is a transitive dependency pulled in via two paths: nx → yargs and jest → jest-cli → yargs. Analysis confirmed that no published version of jest-cli (through the latest 30.4.2) or jest resolves yargs to 18.x — every release continues to declare yargs@^17.x. Because no parent-bump path exists to reach the patched version (18.1.0), a resolutions entry ("yargs": "18.1.0") was added to the root package.json as a last resort, which is the only mechanism available to force the safe version across all transitive consumers.

Version changes

Package	From	To	Why updated
nx	20.8.4	22.7.8	Direct CVE fix
@nx/esbuild	20.8.4	22.7.8	Sibling alignment with nx parent bump
@nx/eslint	20.8.4	22.7.8	Sibling alignment with nx parent bump
@nx/eslint-plugin	20.8.4	22.7.8	Sibling alignment with nx parent bump
@nx/jest	20.8.4	22.7.8	Sibling alignment with nx parent bump
@nx/js	20.8.4	22.7.8	Sibling alignment with nx parent bump
@nx/node	20.8.4	22.7.8	Sibling alignment with nx parent bump
@nx/workspace	20.8.4	22.7.8	Sibling alignment with nx parent bump
yargs	17.7.2	18.1.0	Direct CVE fix via resolution override (no parent path available)