fix(core): allow nx build scripts in generated pnpm-workspace.yaml

[cogwirrel]

Current Behavior

When creating a new workspace with create-nx-workspace using the preset flow and pnpm 11, the workspace creation fails at the nx new step with:

ERR_PNPM_IGNORED_BUILDS  Ignored build scripts: nx@22.7.0

Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.

 NX   Command failed: pnpm install --no-frozen-lockfile

pnpm 11 defaults strictDepBuilds to true, which turns the warning for ignored build scripts into a hard error. addPnpmSettings writes a minimal pnpm-workspace.yaml containing only autoInstallPeers: true — it does not include allowBuilds, so when installPackagesTask runs pnpm install --no-frozen-lockfile, pnpm sees that nx has a postinstall script and errors out because it is not in the allowlist.

Expected Behavior

Workspace creation should succeed under pnpm 11 without requiring the user to manually configure allowBuilds or downgrade pnpm. The generated pnpm-workspace.yaml should include the correct build allowlist key for the detected pnpm version.

This PR uses getPackageManagerVersion (already available in generateWorkspaceFiles) to emit only the correct key:

• pnpm 11+: allowBuilds: { nx: true } — the new pnpm 11 setting
• pnpm 10.6.0–10.x: onlyBuiltDependencies: [nx] — the pnpm 10 setting

pnpm 11 removed onlyBuiltDependencies entirely in favor of allowBuilds, so we version-gate rather than emitting both.

Related Issue(s)

Fixes #35563

[netlify]

👷 Deploy request for nx-dev pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	585b4a0

[netlify]

👷 Deploy request for nx-docs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	585b4a0

[AgentEnder]

Hey, thanks for the PR - I left a comment that I think we can get this past the line after solving

[AgentEnder]

Ah, github has issues - the comment was meant to be:

We should have access to getPackageMangerVersion so we can only generate the correct key

[nx-cloud]

View your CI Pipeline Execution ↗ for commit c7cbfa8

Command	Status	Duration	Result
nx affected --targets=lint,test,build,e2e,e2e-c...	⛔ Cancelled	47s	View ↗
nx run-many -t check-imports check-lock-files c...	✅ Succeeded	3s	View ↗
nx-cloud record -- pnpm nx-cloud conformance:check	✅ Succeeded	17s	View ↗
nx build workspace-plugin	✅ Succeeded	<1s	View ↗
nx-cloud record -- nx sync:check	✅ Succeeded	24s	View ↗
nx-cloud record -- nx format:check	✅ Succeeded	5s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-05-06 18:48:23 UTC

[cogwirrel]

Thanks for the feedback! Updated to use getPackageManagerVersion (already available in generateWorkspaceFiles) to conditionally emit only the correct key:

• pnpm >= 11.0.0: allowBuilds: { nx: true }
• pnpm 10.6.0–10.x: onlyBuiltDependencies: [nx]

Will push shortly.

[cogwirrel]

Hey, thanks for the PR - I left a comment that I think we can get this past the line after solving

Thanks @AgentEnder! Good call, have updated the PR to switch on pnpm >=11 :)