[Aikido] Fix 2 security issues in nx, yargs

[aikido-autofix]

Upgrade nx and yargs to fix command injection (RCE) via unsanitized git parameters and prototype pollution vulnerabilities. This update includes breaking changes that require manual migration.

⚠️ Code affected by breaking changes.

⚠️ ## Breaking Changes That Affect This Codebase

1. Removed deprecated getJestProjects (nx 21.0.0)

Where your code is affected:

• jest.config.ts:1 - imports and uses getJestProjects from @nx/jest

Impact:

The getJestProjects() function has been removed in nx 21.0.0. The root Jest configuration file currently relies on this function to automatically discover and configure all Jest projects in the workspace.

Remediation:

Replace getJestProjects() with manual project configuration or use the new Nx Jest plugin configuration approach. You'll need to explicitly list project paths or use glob patterns to define which projects should be included in the Jest configuration.

All breaking changes by upgrading nx from version 20.8.4 to 22.7.8 (CHANGELOG)

Version	Description
21.0.0	Removed deprecated functionalities for Angular v21
21.0.0	Removed usage of cli property from migration definitions
21.0.0	Removed deprecated readWorkspaceConfig
21.0.0	Dropped support for create nodes v1 in favor of only calling create nodes v2
21.0.0	Removed legacy cache flag from nx.json
21.0.0	Dropped support for node versions prior to 20.19.0
21.0.0	Removed outputStyle=compact
21.0.0	Removed deprecated getJestProjects
21.0.0	Removed tsConfig option from the @nx/jest:jest executor
21.0.0	Removed tsConfig and copyFiles options from the @nx/cypress:cypress executor
21.0.0	useLegacyVersioning is false by default in release configuration
21.0.0	Support for GitLab releases added (breaking change indicated by warning symbol)
21.0.0	Removed deprecated static-serve target name from inferred targets in Remix
21.0.0	Only provide default value for object properties if object already has value
21.0.0	Respect packageManager field in package.json when detecting version
21.2.0	Support for Angular v17 was dropped
21.2.0	Removed deprecated Storybook generators
21.4.0	Stylus (.styl) files are no longer supported in bundling.
22.0.0	The NX_DISABLE_DB environment variable has been removed.
22.0.0	CreateNodes v1 types have been removed.
22.0.0	The experimental and deprecated inlining feature has been removed from the tsc and swc executors (the external and externalBuildTargets options are no longer available).
22.0.0	The deprecated decorate-cli script has been removed.
22.0.0	The nx format command and generators no longer default to sorting TypeScript path mappings (use --sort-root-tsconfig-paths flag or set NX_FORMAT_SORT_TSCONFIG_PATHS=true to keep previous behavior).
22.0.0	The deprecated deleteOutputPath and sassImplementation options have been removed from webpack executors.
22.0.0	The deprecated deleteOutputPath and sassImplementation options have been removed from rspack executors.
22.0.0	The rspack application generator has been removed in favor of framework-specific options.
22.0.0	The default value for useLegacyTypescriptPlugin has changed to false for bundling.
22.0.0	The deprecated simpleName option has been removed from library generators.
22.0.0	The --legacy-peer-deps behavior is no longer forced by default (configure your package manager if needed).
22.0.0	Deprecated legacy versioning has been removed from release functionality.
22.0.0	Default values changed for fixed release group tag pattern, preserveMatchingDependencyRanges (now true by default), and strictPreid in release configuration.
22.0.0	The updateDependents option now defaults to always instead of auto in release configuration.
22.0.0	Release configuration structure has changed: releaseTag* properties have been refactored to a nested releaseTag object.
22.0.0	The signature of init() on VersionActions has changed (no longer accepts a second argument; validation now occurs via separate validate() method).
22.0.0	More files are now used to determine relevant commits in release, matching nx affected behavior, which may result in more projects receiving version bumps.
22.0.0	The config.conventionalCommitsConfig for DefaultChangelogRenderer is no longer nullable.
22.0.0	Multiline breaking changes are now rendered differently by the changelog renderer.
22.0.0	Version plan file contents are now better respected for changelog entries, which may change changelog output.
22.0.0	Support for non-isolated webpack config has been removed from React's componentTestingPreset.
22.6.0	vitest: reportsDirectory is now resolved against workspace root instead of project root, which may change the output location for Vitest reports (#34720)

All breaking changes by upgrading yargs from version 17.7.2 to 18.1.0 (CHANGELOG)

Version	Description
18.0.0	Command names are not derived from modules passed to command.
18.0.0	Singleton usage of yargs yargs.foo, yargs().argv, has been removed.
18.0.0	Minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
18.0.0	yargs is now ESM first

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-373135	MEDIUM	[nx] The CLI builds unescaped git commands with untrusted revision and branch values from configuration files, environment variables, and flags, allowing shell metacharacters to execute arbitrary commands. This impacts developers and CI systems running commands like nx affected, nx graph, nx format, nx release, and nx import.
AIKIDO-2026-922647	LOW	[yargs] Prototype pollution vulnerability in recursive configuration merging allows attackers to pollute object prototypes through __proto__ keys, potentially enabling arbitrary property manipulation and code execution.

🤖 Remediation details

Fix security vulnerabilities in nx and yargs

Short summary

This PR remediates two security advisories affecting nx and yargs. nx is a direct devDependency in the root package.json and was bumped from 20.8.4 to 22.7.8; all sibling @nx/* packages were updated to the same version to preserve alignment. yargs is a transitive dependency pinned exactly by nx and range-constrained by jest-cli; because no parent-chain path allows yargs@18.x, a resolutions entry was added to the root package.json to force the resolved version to 18.1.0. Both the root package.json and yarn.lock were updated.

nx

nx is declared as a direct devDependency in the root package.json at the exact version 20.8.4, which falls within the vulnerable range. It was bumped to 22.7.8 (the minimum patched version in the 22.x line) by editing the manifest and refreshing the lockfile with yarn install --mode=update-lockfile. All seven @nx/* sibling packages (@nx/esbuild, @nx/eslint, @nx/eslint-plugin, @nx/jest, @nx/js, @nx/node, @nx/workspace) were updated to 22.7.8 at the same time because the project keeps them at matching versions and they are co-versioned with nx in the NX release cycle.

yargs

yargs is a transitive dependency pulled in by both nx (which pins it at the exact version 17.7.2) and jest-cli (which requests ^17.7.2). The patched version 18.1.0 is a semver-major bump that neither parent range admits: nx uses an exact pin and no published version of nx or jest-cli up to their respective latest releases widens that range to allow 18.x. With no viable parent-chain path available, a resolutions entry ("yargs": "18.1.0") was added to the root package.json as a last resort, and the lockfile was refreshed to resolve the single yargs instance to 18.1.0.

Version changes

Package	From	To	Why updated
nx	20.8.4	22.7.8	Direct CVE fix
@nx/esbuild	20.8.4	22.7.8	Sibling alignment with nx bump
@nx/eslint	20.8.4	22.7.8	Sibling alignment with nx bump
@nx/eslint-plugin	20.8.4	22.7.8	Sibling alignment with nx bump
@nx/jest	20.8.4	22.7.8	Sibling alignment with nx bump
@nx/js	20.8.4	22.7.8	Sibling alignment with nx bump
@nx/node	20.8.4	22.7.8	Sibling alignment with nx bump
@nx/workspace	20.8.4	22.7.8	Sibling alignment with nx bump
yargs	17.7.2	18.1.0	Transitive CVE fix via resolution (no parent allows 18.x)