[Aikido] Fix 3 security issues in nx, axios, yargs

[aikido-autofix]

Upgrade nx, axios, and yargs to fix command injection in nx CLI git operations and prototype pollution vulnerabilities in axios and yargs config merging. This update includes breaking changes that require manual migration.

⚠️ Code affected by breaking changes.

⚠️ The nx upgrade contains a breaking change that affects this codebase:

NX Breaking Change - Removed getJestProjects

• Where your code is affected: jest.config.ts:1 - The file imports and uses getJestProjects() from @nx/jest

• Impact: The getJestProjects function was removed in nx v21.0.0. The Jest configuration will fail when trying to import this deprecated function, breaking the test setup.

• Remediation: Replace getJestProjects() with the new approach for configuring Jest projects in nx v21+, which typically involves using the projects property directly or migrating to the new Jest configuration pattern recommended by nx.

All breaking changes by upgrading nx from version 20.8.4 to 22.7.8 (CHANGELOG)

Version	Description
21.0.0	Removed deprecated functionalities for Angular v21
21.0.0	Removed usage of cli property from migration definitions
21.0.0	Removed deprecated readWorkspaceConfig
21.0.0	Dropped support for create nodes v1 in favor of only calling create nodes v2
21.0.0	Removed legacy cache flag from nx.json
21.0.0	Dropped support for node versions prior to 20.19.0
21.0.0	Removed outputStyle=compact
21.0.0	Removed deprecated getJestProjects
21.0.0	Removed tsConfig option from the @nx/jest:jest executor
21.0.0	Removed tsConfig and copyFiles options from the @nx/cypress:cypress executor
21.0.0	useLegacyVersioning is false by default in release configuration
21.0.0	Support for GitLab releases added (breaking change indicated by warning symbol)
21.0.0	Removed deprecated static-serve target name from inferred targets in Remix
21.0.0	Only provide default value for object properties if object already has value
21.0.0	Respect packageManager field in package.json when detecting version
21.2.0	Support for Angular v17 was dropped
21.2.0	Removed deprecated Storybook generators
21.4.0	Stylus (.styl) files are no longer supported in bundling.
22.0.0	The NX_DISABLE_DB environment variable has been removed.
22.0.0	CreateNodes v1 types have been removed.
22.0.0	The experimental and deprecated inlining feature has been removed from the tsc and swc executors (the external and externalBuildTargets options are no longer available).
22.0.0	The deprecated decorate-cli script has been removed.
22.0.0	The nx format command and generators no longer default to sorting TypeScript path mappings (use --sort-root-tsconfig-paths flag or set NX_FORMAT_SORT_TSCONFIG_PATHS=true to keep previous behavior).
22.0.0	The deprecated deleteOutputPath and sassImplementation options have been removed from webpack executors.
22.0.0	The deprecated deleteOutputPath and sassImplementation options have been removed from rspack executors.
22.0.0	The rspack application generator has been removed in favor of framework-specific options.
22.0.0	The default value for useLegacyTypescriptPlugin has changed to false for bundling.
22.0.0	The deprecated simpleName option has been removed from library generators.
22.0.0	The --legacy-peer-deps behavior is no longer forced by default (configure your package manager if needed).
22.0.0	Deprecated legacy versioning has been removed from release functionality.
22.0.0	Default values changed for fixed release group tag pattern, preserveMatchingDependencyRanges (now true by default), and strictPreid in release configuration.
22.0.0	The updateDependents option now defaults to always instead of auto in release configuration.
22.0.0	Release configuration structure has changed: releaseTag* properties have been refactored to a nested releaseTag object.
22.0.0	The signature of init() on VersionActions has changed (no longer accepts a second argument; validation now occurs via separate validate() method).
22.0.0	More files are now used to determine relevant commits in release, matching nx affected behavior, which may result in more projects receiving version bumps.
22.0.0	The config.conventionalCommitsConfig for DefaultChangelogRenderer is no longer nullable.
22.0.0	Multiline breaking changes are now rendered differently by the changelog renderer.
22.0.0	Version plan file contents are now better respected for changelog entries, which may change changelog output.
22.0.0	Support for non-isolated webpack config has been removed from React's componentTestingPreset.
22.6.0	vitest: reportsDirectory is now resolved against workspace root instead of project root, which may change the output location for Vitest reports (#34720)

All breaking changes by upgrading axios from version 1.18.1 to 1.20.0 (CHANGELOG)

Version	Description
1.20.0	Added ContentTooLarge (413) and UnprocessableContent (422) HTTP status codes, while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases.
1.20.0	Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects, with documented compatibility effects on Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection.
1.20.0	Navigation-canceled XHR requests now reject with ECONNABORTED instead of resolving with status 0.
1.20.0	Invalid DNS lookup and httpVersion failures are now standardized as AxiosError.ERR_BAD_OPTION_VALUE.

All breaking changes by upgrading yargs from version 17.7.2 to 18.1.0 (CHANGELOG)

Version	Description
18.0.0	Command names are not derived from modules passed to command.
18.0.0	Singleton usage of yargs yargs.foo, yargs().argv, has been removed.
18.0.0	Minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
18.0.0	yargs is now ESM first

✅ 3 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-373135	MEDIUM	[nx] The CLI constructs git commands with unescaped user-controlled revision and branch values, allowing shell metacharacters to execute arbitrary commands when running affected, graph, format, release, or import commands. This vulnerability enables remote code execution on developer and CI machines through malicious values in configuration files, environment variables, or git refs.
AIKIDO-2026-872099	LOW	[axios] Request interceptors can replace the merged config with a plain object, allowing prototype pollution attacks to hijack transport or rewrite responses through inherited fields like adapter, proxy, or transformResponse.
AIKIDO-2026-922647	LOW	[yargs] A prototype pollution vulnerability exists in the deep merge functionality where __proto__ keys are not filtered, allowing attackers to pollute object prototypes and manipulate property lookups through malicious configuration objects.

🤖 Remediation details

Fix security vulnerabilities in nx, axios, and yargs

Short summary

This PR remediates security vulnerabilities in three packages — nx, axios, and yargs — by updating declared versions in the root package.json and refreshing yarn.lock. The nx bump is a direct devDependency change; axios and yargs required resolutions entries because their immediate parents hard-pin versions that no published release will relax.

nx

nx is declared directly in the root package.json as an exact-pinned devDependency. The version was bumped from 20.8.4 to 22.7.8 (the minimum patched release). Because all sibling @nx/* packages (@nx/esbuild, @nx/eslint, @nx/eslint-plugin, @nx/jest, @nx/js, @nx/node, @nx/workspace) were pinned at the same exact version 20.8.4 as a coordinated group, they were moved to 22.7.8 in the same edit to keep the nx ecosystem consistent.

axios

axios is a transitive dependency pulled in by workspace packages (@aligent/cdk-header-change-detection, @aligent/cdk-prerender-proxy) via ^1.18.0, and also by nx itself via an exact pin of 1.18.1. Even after bumping nx to 22.7.8, that release (and every published nx release through 23.3.0-beta.0) still hard-pins axios at exactly 1.18.1, so no parent bump can deliver 1.20.0. A resolutions entry "axios": "1.20.0" was added to the root package.json as the only viable path to the patched version.

yargs

yargs is a transitive dependency consumed by jest-cli (via ^17.3.1) and nx (via ^17.6.2). The patched version 18.1.0 is a semver-major bump that neither parent will ever satisfy: jest-cli up to its latest release 30.5.1 still declares ^17.7.2, and nx through 23.3.0-beta.0 still pins 17.7.2. With no viable parent-bump path, a resolutions entry "yargs": "18.1.0" was added to the root package.json as a last resort.

Version changes

Package	From	To	Why updated
nx	20.8.4	22.7.8	Direct CVE fix (AIKIDO-2026-373135)
@nx/esbuild	20.8.4	22.7.8	Group alignment with nx bump
@nx/eslint	20.8.4	22.7.8	Group alignment with nx bump
@nx/eslint-plugin	20.8.4	22.7.8	Group alignment with nx bump
@nx/jest	20.8.4	22.7.8	Group alignment with nx bump
@nx/js	20.8.4	22.7.8	Group alignment with nx bump
@nx/node	20.8.4	22.7.8	Group alignment with nx bump
@nx/workspace	20.8.4	22.7.8	Group alignment with nx bump
axios	1.18.1	1.20.0	Override (resolution) — parent nx hard-pins 1.18.1 through latest release
yargs	17.7.2	18.1.0	Override (resolution) — no parent (jest-cli, nx) will ever allow ^18