build(deps): bump nx 21.2.0 → 21.6.11 to fix fesm2022 source-map regression (ACE-7218)

[davidIce]

Reason

nx@21.2.0's @nx/angular:package executor emits fesm2022 source maps whose sources point at the ng-packagr tmp-esm2022/*.js intermediate instead of chaining back to the original .ts / external .html template.

For components with an external template (datepicker), Angular's Ivy linker (@angular/compiler-cli linker/babel tryExternalTemplate) then can't locate the template source and throws Cannot read properties of undefined (reading 'contents'). In a consumer building with the partial-compilation linker (fms Angular 20), the shared linker state leaks and this cascades into ~232 errors.

Change

• Bump nx + all @nx/* devDeps 21.2.0 → 21.6.11 (nx fixed the source-map handling). ng-packagr unchanged at 20.0.0.
• No nx.json / workspace migration required.

Verification

• Rebuilt all 25 library entry points → every fesm2022 map now chains back to .ts + the external .html (zero tmp-esm2022 residue).
• Link-tested all 25 fesm bundles against an unpatched Angular 20.3.26 Ivy linker → 25 OK / 0 crash.
• Isolated the fix: reverting ng-packagr to 20.0.0 keeps the .ts maps, so the fix is exactly the nx bump.

Refs: ACE-7218

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 991b4315-2cd7-4771-bb00-5e45d4871c1a

📥 Commits

Reviewing files that changed from the base of the PR and between a3ab722 and 157a238.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The package metadata removes @nx/angular and @nx/node from dependencies. It updates nine Nx packages in devDependencies from version 21.2.0 to 21.6.11. It also updates the root nx package to version 21.6.11.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mattwang44]

🤖 GoBuilders classification: L2 / R1 — pattern-clear build-toolchain dependency bump (nx 21.2.0 → 21.6.11), no application code and no product-behavior judgment; failure modes surface at build/link time and are reversible via revert, so no risk override fires.

[mattwang44]

🤖 Suggested verdict: REQUEST_CHANGES

I reviewed this as a dependency-only PR. The nx 21.6.11 bump itself is a mature in-major release (published 2026-04-17), CI is fully green across build, lint, unit and e2e, and lockfile provenance checks out: every entry resolves to registry.npmjs.org with an integrity hash, and the only new install-script packages are unrs-resolver and nested fsevents, both expected. The blocker is scope: the committed package-lock.json was regenerated wholesale, changing 539 top-level entries where a minimal update needs 113, see the inline comment. Redoing the lockfile as a targeted update should be quick, and I'd expect to approve right after.

[mattwang44]

🤖 Suggested verdict: APPROVE

I re-verified both of my earlier findings against 1d3b63f empirically, not just from the replies. The lockfile is now exactly the minimal update: 113 changed top-level entries, matching my own npm install --package-lock-only replay of base lockfile + new package.json, with jest, webpack, sass-embedded, @types/node and friends unchanged at base versions; provenance is still clean (all registry.npmjs.org with integrity, no new install scripts beyond unrs-resolver and nested fsevents). The deps/devDeps move is undone and ts-node@10.9.1 is disclosed with a clear why in the commit body. Unit tests and e2e smoke were still running at review time; everything that has finished is green, and this head is a strict reduction of the previously all-green diff.

Superseded by my updated review (suggested verdict: APPROVE).