
vx skips the save when an input moves
An input written while its task runs no longer reaches the cache, on CI too. The sandbox names the grant that fixes a denial, more refusals carry stable codes, and the reference works offline.
cache.inputStability picks which writes to an input during a run count, and whether one warns or fails the run. vx is tested in Git 3 repositories, and the benchmark pages show plain figures.

vx 0.0.636 shipped on 2026-10-13. It turns the check on inputs that change during a run into one setting with two choices: which writes count, and what happens when one does.
In this release
cache.inputStability replaces cache.rewrittenInputs. strategy says
which writes to an input during the command count: 'immutable' (the
default, on CI too) counts any write, 'mutable' lets a rewrite to the
same bytes through, and 'unchecked' skips the check. severity says
what a write that counts does: 'warn' (the default) keeps the result
and skips the save, 'error' fails the task. Set it on a task, in
vx.workspace.ts, or for one run with VX_INPUT_STABILITY and
VX_INPUT_STABILITY_SEVERITY; the environment wins, then the task, then
the workspace.
import { defineProject } from '@vzn/vx/config'
export default defineProject({ tasks: { build: { exec: { command: 'tsdown' }, cache: { inputs: { files: ['src/**', 'package.json'] }, outputs: { files: ['dist/**'] }, inputStability: { strategy: 'mutable' }, }, }, },})$ VX_INPUT_STABILITY_SEVERITY=error vx run build --all...[vx] @demo/ui#build: `package.json` changed after its key was taken — the result is not saved, and inputStability.severity is 'error', so the task failsEvery task that ran over a withheld task’s outputs withholds its own save too, and so does a task in any project that reads the moved file.
PR #3438. Deep dive: When an input moves mid-run
Git 3 makes reftable refs and sha256 objects the default. vx now runs
its cache tests in such a repository: keys from 64-character object ids,
hits, a staged edit, --affected and the store id all behave as in a
sha1 repository. No code change was needed.
$ git init --object-format=sha256 --ref-format=reftable$ vx run build --allPR #3443.
The benchmark tables on the site, the README and the compare pages now
show each tool’s time alone. Every runner was measured again on one
host, with Nx’s .env loading off, and the compare page for Nx says so.
$ bun packages/vx-bench/update-site.ts --checksite matches results.jsonPRs #3437, #3439, #3440. Numbers: Benchmarks
cache.rewrittenInputs and VX_REWRITTEN_INPUTS are gone. Use
cache.inputStability: { strategy, severity } ('withhold' is
'immutable', 'compare' is 'mutable'), VX_INPUT_STABILITY and
VX_INPUT_STABILITY_SEVERITY
(#3438). See
Upgrading.npm install -D @vzn/vx@latestA standalone binary updates itself with vx upgrade.