build(deps-dev): bump nx from 22.7.5 to 22.7.8

[dependabot]

Bumps nx from 22.7.5 to 22.7.8.

Release notes

Sourced from nx's releases.

22.7.8 (2026-07-30)

🩹 Fixes

• angular-rspack: dispose stylesheet bundler so one-shot builds exit (#35869)
• core: use workspace package manager when fetching migrations via install (#35866)
• core: omit peer dependencies when installing packages to a temp dir (#36295)
• core: prevent shell injection in nx import (#36348)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• core: acknowledge @​swc/core build script in generated pnpm-workspace.yaml (#35608)
• core: keep real dependencies when omitting peers from npm temp installs (#36518, #36295)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• detox: resolve jest versions locally instead of importing @​nx/jest internals (3ce3f6ab6e)
• docker: run release pipeline docker commands without a shell (#36505)
• js: exclude typescript 7 from supported versions on 22.7.x (dc804964e9)
• js: resolve the verdaccio bin through its package.json (#36479)
• misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
• repo: use default inputs instead of the '...' token in nx-dev on 22.7.x (#35530)
• repo: trust wix/brew tap so macOS detox CI can install applesimutils (#36146)
• testing: seed typescript before plugins in e2e workspaces to avoid TS7 stub (7f5ffbfcbc)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Jonathan Garvey @​jdgarvey
• Miroslav Jonaš @​meeroslav

22.7.7 (2026-07-10)

🩹 Fixes

• core: prevent path traversal / zip-slip in self-hosted remote cache (#36116)
• core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#36132, #36116)
• dotnet: declare obj as a publish output to fix sandbox violation (#35858)
• dotnet: declare directory build props input for analyzer dotnet tasks (df7540195a)
• dotnet: declare directory build props on the separate release build target (6545ee2222)
• dotnet: declare directory build props on the analyzer tests dotnet targets (e72ee0dd79)

❤️ Thank You

• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz

22.7.6 (2026-06-23)

🩹 Fixes

... (truncated)

Commits

• f7afd77 fix(core): bump pinned axios and brace-expansion past vulnerable versions (#3...
• 983413b fix(core): keep real dependencies when omitting peers from npm temp installs ...
• 4159295 fix(core): stop passing git revisions through a shell in affected commands (#...
• cf99649 fix(core): prevent shell injection in nx import (#36348)
• 74311e7 fix(core): omit peer dependencies when installing packages to a temp dir (#36...
• 84beebc fix(core): use workspace package manager when fetching migrations via install...
• a328bf1 fix(core): warn when the self-hosted remote cache disables TLS verification (...
• a828076 fix(core): prevent path traversal / zip-slip in self-hosted remote cache (#36...
• See full diff in compare view

[xrplf-ai-reviewer]

Automated dependency bump of nx (22.7.5 → 22.7.8) in package-lock.json only. This is a routine devDependency upgrade with no application code changes; the lockfile diff is internally consistent (nx and its optional platform binaries, plus transitive deps like axios/form-data/hasown, are bumped together with matching versions/integrity hashes).

[xrplf-ai-reviewer]

This MR is a routine dependabot dependency bump of nx (22.7.5 → 22.7.8) and its transitive dependencies in package-lock.json only. The diff is a lockfile update with no source code changes, matching the stated purpose. No files in this diff import or use nx directly in application logic, but this is a dev/build tool dependency bump which is the entire stated purpose of the MR, so it's in scope. No security or correctness issues found in the lockfile changes themselves — the version bumps include legitimate upstream fixes (shell injection prevention, zip-slip fix, axios/brace-expansion CVE bumps).

[xrplf-ai-reviewer]

This is a routine dependabot dev-dependency bump of nx (22.7.5 → 22.7.8) affecting only package-lock.json. The accompanying changes to axios, form-data, hasown, brace-expansion, https-proxy-agent, agent-base, tmp, ms, and debug are transitive dependencies pulled in by nx's own updated package.json (visible in the diff under node_modules/nx's dependencies block), so they are directly related to this bump rather than an unrelated dependency change riding along. The removal of the packages/xrpl/node_modules/@noble/curves/@noble/hashes nested entries and the new extraneous: true flag on ripple-keypairs look like normal npm lockfile resolution churn from reinstalling with the new nx tree, not a functional change. No source code in the diff depends on or is affected by these changes, and nothing here warrants a blocking comment.

[xrplf-ai-reviewer]

This is a routine automated devDependency bump of nx from 22.7.5 to 22.7.8 (via Dependabot), confined entirely to package-lock.json. The changes are transitive lockfile updates matching the new nx release (including its axios, form-data, hasown, brace-expansion, tmp sub-dependency bumps), which per the release notes fix legitimate security issues (shell injection, path traversal/zip-slip, vulnerable axios/brace-expansion). No source files are touched, so there's nothing substantive to review beyond confirming the lockfile is internally consistent.