fix(deps): update dependency zx to v8.8.5 [security] #552

renovate · 2025-11-21T20:29:56Z

This PR contains the following updates:

Package	Change	Age	Confidence
zx (source)	`8.7.1` -> `8.8.5`

GitHub Vulnerability Alerts

CVE-2025-13437

When zx is invoked with --prefer-local=, the CLI creates a symlink named ./node_modules pointing to /node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external /node_modules outside the current working directory.

Release Notes

google/zx (zx)

`v8.8.5`: — Temporary Reservoir

Compare Source

This release fixes the issue, when zx flushes external node_modules on linking #1348 #1349 #1355

Also [email protected] arrives here.

`v8.8.4`: — Flange Coupling

Compare Source

It's time. This release updates zx internals to make the ps API and related methods ProcessPromise.kill(), kill() work on Windows systems without wmic.
#1344 webpod/ps#15

WMIC will be missing in Windows 11 25H2 (kernel >= 26000)

The windows-latest label in GitHub Actions will migrate from Windows Server 2022 to Windows Server 2025 beginning September 2, 2025 and finishing by September 30, 2025.

https://github.blog/changelog/2025-07-31-github-actions-new-apis-and-windows-latest-migration-notice/#windows-latest-image-label-migration

`v8.8.3`: — Sealing Gasket

Compare Source

Continues #1339 to prevent injections via Proxy input or custom toString() manipulations.

`v8.8.2`: — Leaking Valve

Compare Source

Fixes potential cmd injection via kill() method for Windows platform. #1337 #1339. Affects the versions range 8.7.1...8.8.1.

`v8.8.1`: — Turbo Flush

Compare Source

We keep improving the projects internal infra to bring more stability, safety and performance for artifacts.

Featfixes

Applied flags filtration for CLI-driven deps install #1308
Added kill() event logging #1312
Set SIGTERM as kill() fallback signal #1313
Allowed stdio() arg be an array #1311

const p = $({halt: true})`cmd`
p.stdio([stream, 'ignore', 'pipe'])

Enhancements

Added check for zx@lite pkg contents #1317 #1316
Simplified ProcessPromise[asyncIterator] inners #1307
Updated deps: chalk 5.6.0, fs-extra 11.3.1, yaml 2.8.1 #1309 #1323 #1326
Added TS@next to the test matrix #1310
Optimized internal shell setters #1314
Refactored build-publish pipelines and scripts #1319 #1320 #1321 #1322 #1324 #1325 #1327

`v8.8.0`: — Pressure Tested

Compare Source

This release enhances the coherence between the ProcessPromise and the Streams API, eliminating the need for certain script-level workarounds.

✨ New Features

`unpipe()` — Selectively stop piping

You can now call .unpipe() to stop data transfer from a source to a destination without closing any of the pair. #1302

const p1 = $`echo foo && sleep 0.1 && echo bar && sleep 0.1 && echo baz && sleep 0.1 && echo qux`
const p2 = $`echo 1 && sleep 0.15 && echo 2 && sleep 0.1 && echo 3`
const p3 = $`cat`

p1.pipe(p3)
p2.pipe(p3)

setTimeout(() => p1.unpipe(p3), 150)

const { stdout } = await p3
// 'foo\n1\nbar\n2\n3\n'

Many-to-one piping

Multiple sources can now stream into a single destination. All sources complete before the destination closes. #1300

const $h = $({ halt: true })
const p1 = $`echo foo`
const p2 = $h`echo a && sleep 0.1 && echo c && sleep 0.2 && echo e`
const p3 = $h`sleep 0.05 && echo b && sleep 0.1 && echo d`
const p4 = $`sleep 0.4 && echo bar`
const p5 = $h`cat`

await p1
p1.pipe(p5)
p2.pipe(p5)
p3.pipe(p5)
p4.pipe(p5)

const { stdout } = await p5.run()
// 'foo\na\nb\nc\nd\ne\nbar\n'

Piping from rejected processes

Processes that exit with errors can now still pipe their output. The internal recorder retains their stream, status, and exit code. #1296

const p1 = $({ nothrow: true })`echo foo && exit 1`
await p1

const p2 = p1.pipe($({ nothrow: true })`cat`)
await p2

p1.output.toString() // 'foo\n'
p1.output.ok         // false
p1.output.exitCode   // 1

p2.output.toString() // 'foo\n'
p2.output.ok         // false
p2.output.exitCode   // 1

Components versions

Since zx bundles third-party libraries without their package.jsons, their versions weren’t previously visible. You can now access them via the versions static map — including zx itself. #1298 #1295

import { versions } from 'zx'

versions.zx     // 8.7.2
versions.chalk  // 5.4.1

`v8.7.2`: — Copper Crafter

Compare Source

Stability and customizability improvements

Handle nothrow option on ProcessPromise init stage #1288

const o = await $({ nothrow: true })`\033`
o.ok      // false
o.cause   // Error

Handle _snapshot.killSignal value on kill() #1287

const p = $({killSignal: 'SIGKILL'})`sleep 10`
await p.kill()
p.signal  // 'SIGKILL'

Introduced Fail class #1285

import { Fail } from 'zx'

Fail.EXIT_CODES['2'] = 'Custom error message'
Fail.formatErrorMessage = (err: Error, from: string): string =>
  `${err.message} (${from})`

Expose $ as type #1283

import type { $, Options } from 'zx'

const custom$: $ = (pieces: TemplateStringsArray | Partial<Options>, ...args: any[]) => {
  // ... custom implementation
}

Internal tweak ups #1276 #1277 #1278 #1279 #1280 #1281 #1282 #1286 #1289
Described the zx architecture basics. This section helps to better understand the zx concepts and internal logic, and will be useful for those who want to become a project contributor, make tools based on it, or create something similar from scratch. #1290 #1291 #1292

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2025-11-21T20:30:00Z

Skipped: This PR was opened by one of your excluded authors: (renovate[bot])

netlify · 2025-11-21T20:30:02Z

✅ Deploy Preview for cedarjs canceled.

Name	Link
🔨 Latest commit	`cba4996`
🔍 Latest deploy log	https://app.netlify.com/projects/cedarjs/deploys/6922173ed6d70f00084b2d87

renovate · 2025-11-22T20:12:59Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

fix(deps): update dependency zx to v8.8.5 [security]

55b5207

renovate bot added changesets-ok Override the changesets check release:dependency This PR only updates dependencies labels Nov 21, 2025

renovate bot added this to the next-release milestone Nov 21, 2025

renovate bot enabled auto-merge (squash) November 21, 2025 20:29

Merge branch 'main' into renovate/npm-zx-vulnerability

cba4996

renovate bot merged commit a8c5eac into main Nov 22, 2025
38 checks passed

renovate bot deleted the renovate/npm-zx-vulnerability branch November 22, 2025 20:25

Tobbe modified the milestones: next-release, v1.1.0 Nov 25, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency zx to v8.8.5 [security] #552

fix(deps): update dependency zx to v8.8.5 [security] #552

Uh oh!

renovate bot commented Nov 21, 2025

Uh oh!

greptile-apps bot commented Nov 21, 2025

Uh oh!

netlify bot commented Nov 21, 2025 •

edited

Loading

Uh oh!

renovate bot commented Nov 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fix(deps): update dependency zx to v8.8.5 [security] #552

fix(deps): update dependency zx to v8.8.5 [security] #552

Uh oh!

Conversation

renovate bot commented Nov 21, 2025

GitHub Vulnerability Alerts

CVE-2025-13437

Release Notes

v8.8.5: — Temporary Reservoir

v8.8.4: — Flange Coupling

v8.8.3: — Sealing Gasket

v8.8.2: — Leaking Valve

v8.8.1: — Turbo Flush

Featfixes

Enhancements

v8.8.0: — Pressure Tested

✨ New Features

unpipe() — Selectively stop piping

Many-to-one piping

Piping from rejected processes

Components versions

v8.7.2: — Copper Crafter

Configuration

Uh oh!

greptile-apps bot commented Nov 21, 2025

Uh oh!

netlify bot commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cedarjs canceled.

Uh oh!

renovate bot commented Nov 22, 2025

Edited/Blocked Notification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`v8.8.5`: — Temporary Reservoir

`v8.8.4`: — Flange Coupling

`v8.8.3`: — Sealing Gasket

`v8.8.2`: — Leaking Valve

`v8.8.1`: — Turbo Flush

`v8.8.0`: — Pressure Tested

`unpipe()` — Selectively stop piping

`v8.7.2`: — Copper Crafter

netlify bot commented Nov 21, 2025 •

edited

Loading