fix(js): parse pnpm/npm publish JSON containing braces in file paths - #36241
Merged
Conversation
✅ Deploy Preview for nx-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for nx-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
View your CI Pipeline Execution ↗ for commit eb616c0
☁️ Nx Cloud last updated this comment at |
leosvelperez
force-pushed
the
gh-36236
branch
2 times, most recently
from
July 6, 2026 13:41
a2b25b3 to
adce214
Compare
nx release publish marked a successful publish as failed when a published
file path contained curly braces (e.g. templates/{{name}}/file.txt). The
publish summary was located with a fixed-depth brace-counting regex that
treated braces inside JSON string values as structure, so the top-level
summary object never matched and extraction returned null, surfacing "The
pnpm publish output data could not be extracted" after the package had
already been published to the registry.
Replace the regex with a scanner that pairs each '{' with its matching '}'
while treating JSON string content as opaque, so braces and quotes inside a
string value no longer affect the pairing. Publish output is plain JSON mixed
with arbitrary lifecycle-script text, so the scanner does not treat '//' or
'/*' as comments and ends a string at a raw newline (which a valid JSON string
never contains); stray quotes, globs, and comment-like text in that output no
longer hide the summary. Balanced objects are scanned left to right and the
summary is unwrapped (flat, or nested one level under the package name).
jaysoo
approved these changes
Jul 13, 2026
FrozenPandaz
pushed a commit
that referenced
this pull request
Jul 20, 2026
…36241) ## Current Behavior `nx release publish` can mark a publish as failed even after `pnpm publish` (or `npm publish`) has already succeeded and pushed the package to the registry. When a published file path contains curly braces, for example a template directory like `templates/{{name}}/file.txt`, the executor fails with: > The pnpm publish output data could not be extracted. Please report this issue on https://github.com/nrwl/nx The publish summary was located in stdout with a fixed-depth brace-counting regex. That regex is not JSON-aware: it treats `{` / `}` inside a JSON string value (such as a `files[].path`) as structural braces, so the top-level summary object no longer matches and extraction returns `null`. The package is published, but the command reports failure. ## Expected Behavior When the package manager exits successfully and emits a valid JSON publish summary, `nx release publish` parses it and reports success, regardless of whether any `files[].path` contains curly braces. ## Related Issue(s) Fixes #36236 ## Implementation Details `extractNpmPublishJsonData` no longer uses a regex. It pairs every `{` with its matching `}` in one string-aware pass, ignoring braces and quotes that appear inside JSON string literals, then scans the balanced objects left to right and unwraps the summary (flat, or nested one level under the package name for newer npm and for pnpm run from the workspace root). This removes the fixed-depth limitation: string values may contain any number of braces and the object may nest arbitrarily deep. The summary is interleaved with arbitrary lifecycle-script output, so the scanner treats that surrounding text as opaque: it does not interpret `//` or `/*` as comments (a script may legitimately print a glob such as `dist/*.js`), and it ends a string at a raw newline (which valid JSON never contains) so a stray quote in log text cannot hide the summary. Stray unbalanced braces in that output are also left unpaired. Added tests cover a `files[].path` with curly braces, a Windows-style backslash-escaped path, a summary nested under the package name with a brace-carrying path, unbalanced braces and a stray unpaired quote in surrounding lifecycle output, and comment-like text or globs before the summary. <!-- polygraph-session-start --> --- [View session information ↗](https://app.trypolygraph.com/orgs/6a061dcb561c062131116eca/sessions/gh-36236-bce72e6b) <!-- polygraph-session-end --> (cherry picked from commit 2f2e229)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
nx release publishcan mark a publish as failed even afterpnpm publish(ornpm publish) has already succeeded and pushed the package to the registry. When a published file path contains curly braces, for example a template directory liketemplates/{{name}}/file.txt, the executor fails with:The publish summary was located in stdout with a fixed-depth brace-counting regex. That regex is not JSON-aware: it treats
{/}inside a JSON string value (such as afiles[].path) as structural braces, so the top-level summary object no longer matches and extraction returnsnull. The package is published, but the command reports failure.Expected Behavior
When the package manager exits successfully and emits a valid JSON publish summary,
nx release publishparses it and reports success, regardless of whether anyfiles[].pathcontains curly braces.Related Issue(s)
Fixes #36236
Implementation Details
extractNpmPublishJsonDatano longer uses a regex. It pairs every{with its matching}in one string-aware pass, ignoring braces and quotes that appear inside JSON string literals, then scans the balanced objects left to right and unwraps the summary (flat, or nested one level under the package name for newer npm and for pnpm run from the workspace root).This removes the fixed-depth limitation: string values may contain any number of braces and the object may nest arbitrarily deep. The summary is interleaved with arbitrary lifecycle-script output, so the scanner treats that surrounding text as opaque: it does not interpret
//or/*as comments (a script may legitimately print a glob such asdist/*.js), and it ends a string at a raw newline (which valid JSON never contains) so a stray quote in log text cannot hide the summary. Stray unbalanced braces in that output are also left unpaired.Added tests cover a
files[].pathwith curly braces, a Windows-style backslash-escaped path, a summary nested under the package name with a brace-carrying path, unbalanced braces and a stray unpaired quote in surrounding lifecycle output, and comment-like text or globs before the summary.View session information ↗