fix(misc): multi-version compliance for @nx/express, @nx/node, and @nx/nest (nrwl#35807)

## Current Behavior

**`@nx/express`**
- Peer dep declares `express: ^4.21.2` only; Express v5 has been ACTIVE
since 2025-03-31 and v4 is in MAINT, so the plugin's advertised window
doesn't match the upstream support window.
- Generators install a single literal `express ^4.21.2` regardless of
what's installed; no per-major routing for `express` or
`@types/express`.
- `keepExistingVersions` schema default is `false`, so re-running the
generator silently overwrites a user's pinned `express` version.
- No floor enforcement: a workspace on an unsupported (sub-floor)
`express` version sees no error.

**`@nx/node`**
- No `peerDependencies` for `express`, `koa`, or `fastify`.
Init/application generators write framework deps unconditionally,
ignoring what's installed.
- `keepExistingVersions` defaults to `false`; framework installs
override user pins.
- `migrations.json` `22.0.2` bumps `koa` from v2 to v3 with no
`requires` block — every workspace on koa v2 gets pushed to v3
unconditionally.
- `migrations.json` `20.4.0` mixes a cross-major fastify v4→v5 bump with
same-major express bumps under one entry, with no `requires`
(AND-semantics would gate same-major bumps incorrectly if added
naively).
- No floor enforcement for any framework.

**`@nx/nest`**
- `peerDependencies` block is missing from `package.json` entirely;
workspaces have no advertised compatible range for any `@nestjs/*`
package.
- Versions module has flat constants; the plugin ships v11-only even
though NestJS v10.4.x still receives upstream patches (N & N-1 baseline
calls for v10 + v11).
- `migrations.json` `21.2.0-beta.2` uses a bare key `nest` which is not
a real npm package — the entry is effectively a no-op. The real
cross-major v10→v11 bump for `@nestjs/common`, `@nestjs/core`,
`@nestjs/platform-express`, `@nestjs/testing` is missing, as is a
`requires` source-major gate.
- No floor enforcement for any NestJS version.

## Expected Behavior

**`@nx/express` (NXC-4390)**
- Per-major `versionMap` keyed on `express` major covering both
`express` and `@types/express` for v4 and v5; fresh installs default to
v5.1.0.
- `assertSupportedExpressVersion(tree)` (calls shared
`assertSupportedPackageVersion`) is the first statement of
`initGenerator` and `applicationGeneratorInternal`.
- Peer widened to `express: ">=4.0.0 <6.0.0"` (still optional).
- All `addDependenciesToPackageJson` call sites from generators pass
`keepExistingVersions ?? true`; schema defaults flipped to `true`. Init
now installs `@types/express` (previously a dead export).
- New `all-generators-enforce-floor.spec.ts` exercises every generator
entry at `subFloorVersion: '~3.21.0'`.
- Supported-versions docs page updated.

**`@nx/node` (NXC-4396)**
- Per-package `versionMap` + `versions(tree)` for `express` (v4+v5),
`koa` (v2+v3), `fastify` (v4+v5), and `@types/node` (v22+v24). Fresh
installs default to active LTS / latest stable.
- `assertSupportedFrameworkVersion(tree, schema.framework)` (dispatches
to one wrapper per framework) is the first statement of
`applicationGeneratorInternal`, only firing when `--framework` selects a
non-`none`/`nest` lane.
- Framework + `@types/node` installs route through `versions(tree)` and
pass `keepExistingVersions ?? true`. Init schema default flipped to
`true`.
- `migrations.json`: `22.0.2` koa v2→v3 gated with `requires: { koa:
">=2.0.0 <3.0.0" }`. `22.6.0` koa CVE patch gated bilaterally to v3
only. `20.4.0` split into the original same-major express bumps (no
gate) and a new `20.4.0-fastify` entry gated on `requires: { fastify:
">=4.0.0 <5.0.0" }`.
- Optional `peerDependencies` declared for `express`, `koa`, `fastify`.
Added `semver: "catalog:"` to deps (now imported by `versions.ts`).
`@nx/dependency-checks` allow-list updated.

**`@nx/nest` (NXC-4394)**
- Per-major `versionMap` covering NestJS v10 and v11 for the full
`@nestjs/*` family plus `rxjs` and `reflect-metadata`. Fresh installs
default to NestJS v11, with `reflect-metadata` bumped from `^0.1.13` to
`^0.2.0` to match v11's requirement.
- `assertSupportedNestJsVersion(tree)` is the first statement of the
`init`, `application`, and `library` generators.
- `ensureDependencies` and the init `addDependencies` helper route
through `versions(tree)` and pass `keepExistingVersions: true` (`??
true` on the init path); init schema default flipped to `true`.
- Optional `peerDependencies` declared for `@nestjs/core`,
`@nestjs/common`, `reflect-metadata`, `rxjs`. Added `semver: "catalog:"`
to deps and extended `@nx/dependency-checks` allow-list.
- `migrations.json` `21.2.0-beta.2` rewritten with real package keys
(the previous bare `nest` key was a typo / no-op) and gated on
`requires: { "@nestjs/core": ">=10.0.0 <11.0.0" }`. The entry now also
bumps `reflect-metadata` to `^0.2.0` for v11 compatibility.
- Supported-versions docs page updated.

## Related Issue(s)

Fixes NXC-4390
Fixes NXC-4396
Fixes NXC-4394

---------

Co-authored-by: Craigory Coppola <craigorycoppola@gmail.com>

Author: 2 people

astro-docs/src/content/docs/technologies/node/express/introduction.mdoc

@@ -16,7 +16,7 @@ The `@nx/express` plugin supports the following package versions.
 
 | Package   | Supported Versions |
 | --------- | ------------------ |
-| `express` | ^4.21.2            |
+| `express` | ^4.0.0, ^5.0.0     |
 
 [Nx generators](/docs/features/generate-code) install the latest supported versions automatically when scaffolding new projects.
 

astro-docs/src/content/docs/technologies/node/nest/introduction.mdoc

@@ -19,13 +19,19 @@ Many conventions and best practices used in Angular applications can be also be
 
 ## Requirements
 
-The `@nx/nest` plugin depends on `@nestjs/schematics` for code generation, which pins the supported NestJS major version.
+The `@nx/nest` plugin supports the following NestJS package versions.
 
-| Nx Version     | NestJS Version |
-| -------------- | -------------- |
-| 22.x (current) | ^11.0.0        |
-| 21.x           | ^11.0.0        |
-| 20.x           | ^10.0.0        |
+| Package        | Supported Versions |
+| -------------- | ------------------ |
+| `@nestjs/core` | ^10.0.0, ^11.0.0   |
+
+The plugin detects the installed `@nestjs/core` major and routes the rest of the `@nestjs/*` family (plus `rxjs` and `reflect-metadata`) to versions that pair with it. Fresh installs default to NestJS v11.
+
+| Nx Version     | Default NestJS Version |
+| -------------- | ---------------------- |
+| 22.x (current) | ^11.0.0                |
+| 21.x           | ^11.0.0                |
+| 20.x           | ^10.0.0                |
 
 [Nx generators](/docs/features/generate-code) install the latest supported versions automatically when scaffolding new projects.
 

packages/express/package.json

@@ -35,10 +35,11 @@
     "@nx/devkit": "workspace:*",
     "@nx/js": "workspace:*",
     "@nx/node": "workspace:*",
+    "semver": "catalog:",
     "tslib": "catalog:typescript"
   },
   "peerDependencies": {
-    "express": "^4.21.2"
+    "express": ">=4.0.0 <6.0.0"
   },
   "peerDependenciesMeta": {
     "express": {

packages/express/src/generators/application/application.spec.ts

@@ -195,7 +195,7 @@ describe('app', () => {
       expect(readJson(appTree, 'myapp/package.json')).toMatchInlineSnapshot(`
         {
           "dependencies": {
-            "express": "^4.21.2",
+            "express": "^5.1.0",
           },
           "name": "@proj/myapp",
           "nx": {

packages/express/src/generators/application/application.ts

@@ -15,6 +15,7 @@ import { isUsingTsSolutionSetup } from '@nx/js/internal';
 import { applicationGenerator as nodeApplicationGenerator } from '@nx/node';
 import { tslibVersion } from '@nx/node/src/utils/versions';
 import { join } from 'path';
+import { assertSupportedExpressVersion } from '../../utils/assert-supported-express-version';
 import { nxVersion } from '../../utils/versions';
 import { initGenerator } from '../init/init';
 import type { Schema } from './schema';
@@ -76,6 +77,8 @@ export async function applicationGenerator(tree: Tree, schema: Schema) {
 }
 
 export async function applicationGeneratorInternal(tree: Tree, schema: Schema) {
+  assertSupportedExpressVersion(tree);
+
   const options = await normalizeOptions(tree, schema);
 
   const tasks: GeneratorCallback[] = [];
@@ -92,7 +95,7 @@ export async function applicationGeneratorInternal(tree: Tree, schema: Schema) {
   addTypes(tree, options);
 
   if (!options.skipPackageJson) {
-    tasks.push(ensureDependencies(tree));
+    tasks.push(ensureDependencies(tree, options));
   }
 
   if (!options.skipFormat) {
@@ -132,10 +135,15 @@ async function normalizeOptions(
   };
 }
 
-function ensureDependencies(tree: Tree): GeneratorCallback {
+function ensureDependencies(
+  tree: Tree,
+  options: NormalizedSchema
+): GeneratorCallback {
   return addDependenciesToPackageJson(
     tree,
     { tslib: tslibVersion },
-    { '@nx/express': nxVersion }
+    { '@nx/express': nxVersion },
+    undefined,
+    options.keepExistingVersions ?? true
   );
 }

packages/express/src/generators/application/schema.d.ts

@@ -18,4 +18,5 @@ export interface Schema {
   setParserOptionsProject?: boolean;
   addPlugin?: boolean;
   useProjectJson?: boolean;
+  keepExistingVersions?: boolean;
 }

packages/express/src/generators/application/schema.json

@@ -77,6 +77,12 @@
     "useProjectJson": {
       "type": "boolean",
       "description": "Use a `project.json` configuration file instead of inlining the Nx configuration in the `package.json` file."
+    },
+    "keepExistingVersions": {
+      "type": "boolean",
+      "x-priority": "internal",
+      "description": "Keep existing dependencies versions",
+      "default": true
     }
   },
   "required": ["directory"]

packages/express/src/generators/init/init.ts

@@ -6,28 +6,35 @@ import {
   runTasksInSerial,
   Tree,
 } from '@nx/devkit';
-import { expressVersion, nxVersion } from '../../utils/versions';
+import { assertSupportedExpressVersion } from '../../utils/assert-supported-express-version';
+import { nxVersion, versions } from '../../utils/versions';
 import type { Schema } from './schema';
 
 function updateDependencies(tree: Tree, schema: Schema) {
   const tasks: GeneratorCallback[] = [];
 
   tasks.push(removeDependenciesFromPackageJson(tree, ['@nx/express'], []));
 
+  const pkgVersions = versions(tree);
   tasks.push(
     addDependenciesToPackageJson(
       tree,
-      { express: expressVersion },
-      { '@nx/express': nxVersion },
+      { express: pkgVersions.expressVersion },
+      {
+        '@nx/express': nxVersion,
+        '@types/express': pkgVersions.expressTypingsVersion,
+      },
       undefined,
-      schema.keepExistingVersions
+      schema.keepExistingVersions ?? true
     )
   );
 
   return runTasksInSerial(...tasks);
 }
 
 export async function initGenerator(tree: Tree, schema: Schema) {
+  assertSupportedExpressVersion(tree);
+
   let installTask: GeneratorCallback = () => {};
   if (!schema.skipPackageJson) {
     installTask = updateDependencies(tree, schema);

packages/express/src/generators/init/schema.json

@@ -20,7 +20,7 @@
       "type": "boolean",
       "x-priority": "internal",
       "description": "Keep existing dependencies versions",
-      "default": false
+      "default": true
     }
   },
   "required": []

packages/express/src/utils/all-generators-enforce-floor.spec.ts

@@ -0,0 +1,10 @@
+import { assertGeneratorsEnforceVersionFloor } from '@nx/devkit/internal-testing-utils';
+import { join } from 'node:path';
+
+describe('@nx/express generators enforce supported version floor', () => {
+  assertGeneratorsEnforceVersionFloor({
+    packageRoot: join(__dirname, '..', '..'),
+    packageName: 'express',
+    subFloorVersion: '~3.21.0',
+  });
+});