chore(maven): bump maven plugin version to 0.0.14 (nrwl#34505)

## Current Behavior

The Maven plugin is on version `0.0.13`.

## Expected Behavior

The Maven plugin is bumped to version `0.0.14`, with a migration
generated for Nx `22.6.0-beta.1`.

feat(devkit): add NX_SKIP_FORMAT environment variable to skip Prettie…

…r formatting (nrwl#34336)

## Current Behavior

When running generators or migrations, Nx automatically skips Prettier
formatting if no root Prettier config is detected (added in nrwl#30426).
However, there's no way to explicitly skip Prettier formatting when a
config IS present but the user wants to bypass it for specific
operations.

This can be needed when:
- When running something like Oxfmt that may treat prettier slightly
differently, even with the same config (this is the main thing I ran
into)
- Running migrations where Prettier reformatting causes unintended side
effects (e.g., breaking `eslint-disable` comments)
- Temporarily disabling formatting for debugging purposes
- Using a formatter that coexists with Prettier in the workspace but
should take precedence for certain files

## Expected Behavior

Users can set `NX_SKIP_FORMAT=true` to explicitly skip Prettier
formatting in generators and migrations, regardless of whether Prettier
is configured. TSConfig path sorting (controlled by
`sortRootTsconfigPaths` or `NX_FORMAT_SORT_TSCONFIG_PATHS`) continues to
work independently.

```bash
NX_SKIP_FORMAT=true nx migrate --run-migrations
NX_SKIP_FORMAT=true nx g @nx/react:app my-app
```

## Related Issue(s)

Related to nrwl#30403 and nrwl#30426. This enhancement adds explicit user
control for cases where auto-detection of Prettier configuration isn't
sufficient.

fix(repo): revert sudo for global npm install in publish workflow (nr…

…wl#34451)

## Current Behavior

The publish workflow uses `sudo npm install -g npm@11.5.2` which was
added in nrwl#34409. This causes issues with OIDC token permissions in the
release pipeline since `sudo` runs as a different user context.

## Expected Behavior

The publish workflow should use `npm install -g npm@11.5.2` without
`sudo`, matching the standard approach used elsewhere and avoiding
permission context issues during release.

## Related Issue(s)

Reverts nrwl#34409

fix(repo): use GITHUB_ACTIONS env var for CI detection in nx-release

docs(nx-cloud): update info about GH permissions (nrwl#34380)

https://deploy-preview-34380--nx-docs.netlify.app/docs/enterprise/single-tenant/custom-github-app#configure-permissions-for-the-github-app

---------

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>
Co-authored-by: barbados-clemens <barbados-clemens@users.noreply.github.com>

fix(core): add missing FileType import for Windows watcher build (nrw…

…l#34369)

## Current Behavior

The Windows build (`aarch64-pc-windows-msvc`) fails to compile with:

```
error[E0433]: failed to resolve: use of undeclared type `FileType`
  --> packages\nx\src\native\watch\types.rs:128:55
```

The `FileType` type is used inside a `#[cfg(target_os = "windows")]`
block but was not imported.

## Expected Behavior

The Windows build compiles successfully. The `FileType` import is scoped
inside the `#[cfg(target_os = "windows")]` block (matching the existing
pattern in the macOS block) so there are no unused imports on any
platform.

## Related Issue(s)

N/A — build breakage discovered during CI publish workflow.

feat(maven): bump maven plugin version to 0.0.13 (nrwl#34318)

## Current Behavior

The Maven plugin version is `0.0.12` across all pom.xml files and the
versions.ts constant. The `bump-maven-version` generator does not update
the `batch-runner-adapters` pom files, causing version mismatches.

## Expected Behavior

The Maven plugin version is bumped to `0.0.13` in **all** pom.xml files
(including batch-runner-adapters), with a migration created for users
upgrading to Nx `22.5.0-beta.4`. The bump generator now includes the
batch-runner-adapters pom files so future bumps won't miss them.

### Changes
- Updated version from `0.0.12` to `0.0.13` in all pom.xml files (root,
maven, maven-plugin, shared, batch-runner, batch-runner-adapters,
maven3-adapter, maven4-adapter)
- Updated `mavenPluginVersion` constant in
`packages/maven/src/utils/versions.ts`
- Added `update-0-0-13` migration entry in
`packages/maven/migrations.json` targeting Nx `22.5.0-beta.4`
- Created migration file
`packages/maven/src/migrations/0-0-13/update-pom-xml-version.ts`
- Fixed `bump-maven-version` generator to include
`batch-runner-adapters` pom files

fix(core): prevent command injection in getNpmPackageVersion (nrwl#34309

)

## Current Behavior

The `getNpmPackageVersion` function in
`packages/workspace/src/generators/utils/get-npm-package-version.ts`
uses `execSync` with direct string interpolation of the `packageName`
parameter. When a user runs `create-nx-workspace` with a custom
`--preset` value that doesn't match a known preset, the value flows
unsanitized into a shell command:

```js
execSync(`npm view ${packageName}... version --json`)
```

This allows arbitrary command execution via shell metacharacters (e.g.,
`--preset='pkg$(malicious command)'`).

## Expected Behavior

User-supplied package names are validated against a strict npm package
name regex before being passed to any shell command. The function now
uses `execFileSync` with an args array instead of `execSync` with string
interpolation, providing defense in depth:

1. **Input validation** — rejects anything that isn't a valid npm
package name
2. **Safe execution** — arguments are passed as an array so Node.js
handles escaping, rather than concatenating into a raw shell string

(cherry picked from commit 79d878f)

fix(nx-dev): fix double-counting and exclude assets from page tracking (

nrwl#34286)

## Current Behavior

1. **track-asset-requests** runs twice per request due to redundant path
patterns:
   ```typescript
   path: ["/*.txt", "/**/*.txt", "/*.md", "/**/*.md"]
   ```
The `/**/*` pattern already matches root level files, so `/*` is
redundant.

2. **track-page-requests** runs on many asset requests even though it
only tracks HTML page views:
   - Font files: `/docs/fonts/*.woff2`, `/docs/*.woff`
   - Images: `/docs/*.svg`, `/docs/*.png`, `/docs/og/*`
   - Pagefind search index: `/docs/pagefind/*`

## Expected Behavior

1. Asset tracking should fire only once per request
2. Page tracking should exclude all non-HTML assets at Netlify level
(zero compute)

## Changes

### track-asset-requests.ts
Simplified path patterns:
```typescript
path: ["/**/*.txt", "/**/*.md"]
```

### track-page-requests.ts
Added comprehensive exclusions:

| Category | Exclusions |
|----------|------------|
| Images | `.svg`, `.png`, `.jpg`, `.jpeg`, `.gif`, `.webp`, `.ico`,
`/images/*`, `/og/*` |
| Fonts | `/fonts/*`, `.woff`, `.woff2` |
| Search | `/pagefind/*` |

## Related Issue(s)

Fixes DOC-395

docs(misc): update the docs to use more direct language (nrwl#34264)

<!-- Please make sure you have read the submission guidelines before
posting an PR -->
<!--
https://github.com/nrwl/nx/blob/master/CONTRIBUTING.md#-submitting-a-pr
-->

<!-- Please make sure that your commit message follows our format -->
<!-- Example: `fix(nx): must begin with lowercase` -->

<!-- If this is a particularly complex change or feature addition, you
can request a dedicated Nx release for this pull request branch. Mention
someone from the Nx team or the `@nrwl/nx-pipelines-reviewers` and they
will confirm if the PR warrants its own release for testing purposes,
and generate it for you if appropriate. -->

## Current Behavior
<!-- This is the behavior we have today -->

## Expected Behavior
<!-- This is the behavior we should expect with the changes in this PR
-->

## Related Issue(s)
<!-- Please link the issue being fixed so it gets closed when this is
merged. -->

Fixes #