Run details

NxWorkspace

CI Pipeline Executions
- Current executionSucceeded
  master
- Runs and Agents
- TimelineBeta
- Configuration
- Self-Healing CI
- Project Graph
- Circular DependenciesEnterprise
- Resource Usage
- Analysis
- ConformanceEnterprise
Runs

Insights

Compare tasks
Analytics

Sign in

fix(misc): record pnpm 11 build script decisions in generators (#36814) ## Current Behavior pnpm 11 fails an install when a dependency runs a build script that the workspace has neither allowed nor denied. Nx generators end by running that install: ``` $ pnpm install --no-frozen-lockfile [ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: unrs-resolver@1.12.2 Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts. ``` Some generators already write a decision for the packages they add. Many still do not, so those generators fail and leave the workspace half set up. The two Angular 23.1.0 migrations that add `@angular/build`, `@nx/webpack` or `@nx/rspack` have the same gap. `nx new` writes a decision for `nx` and nothing else. No generator can cover for it, because it installs the preset packages before the preset generator runs. ## Expected Behavior Every generator that adds a package with a build script writes a decision for it, and the two Angular 23.1.0 migrations do the same. `nx new` covers the packages a built-in preset installs. pnpm 11 then installs without stopping. Nearly all scripts are skipped. Detox runs its own, which builds the cache it needs to work, and the Angular Rspack compiler runs its own, which patches `@angular/build`. A decision the user already made is left alone. With a third-party preset, `nx new` denies that preset's own script. Scripts that the preset's dependencies bring in can still stop the install, and pnpm asks the user to decide on those. ## Related Issue(s) NXC-4778 ## Implementation Notes - Nx decides only for the packages its own plugins install. Their scripts ship prebuilt binaries as optional dependencies, fall back to a no-op, or print a funding message, so skipping them is safe. - A third-party preset's own script is denied even though the user named that package. That matches pnpm 10, where `nx new` has never listed the preset in `onlyBuiltDependencies`. - The Angular generators and the `@angular/build` migration share one helper. They install the same build toolchain, so one list keeps them from drifting apart. - `nx new` derives its decisions from the packages the chosen preset declares. Nx has not vetted a third-party preset's own dependencies, so it decides nothing for them and pnpm 11 asks the user instead. - The generated `pnpm-workspace.yaml` uses `allowBuilds` on pnpm 11 and the older allow-list below it, where an undecided script does not stop the install.  --- <p><a href="https://app.trypolygraph.com/orgs/6a061dcb561c062131116eca/sessions/nxc-4778-5acf4e11">View Polygraph session ↗</a></p>

nx run-many -t check-imports check-lock-files check-codeowners --parallel=1 --no-dte

Succeeded

4 CPU cores

read-write access token used

e90cfdf6master

Get faster results

Learn how to enable distribution.

Atomizer enabled

1 group of tasks optimized.

© 2026 - Nx Cloud

Terms of Service Privacy Policy Changelog Status Docs Contact Nx Cloud Pricing Company @NxDevTools

NxWorkspace