Support for pnpm (or general) minimumReleaseAge

[muuvmuuv]

Command

update

Description

As of recent mitm attacks it would be cool to have support for pnpm's minimumReleaseAge or something by Angular itself.

Describe the solution you'd like

• pnpm's minimumReleaseAge
• Angular option to set min release age on update command

Describe alternatives you've considered

Instead of modifying package.json call package manager update command:

pnpm update "@angular/core@~20.3.1" "@angular/cli@~20.3.1"

[angular-robot]

This feature request is now candidate for our backlog! In the next phase, the community has 60 days to upvote. If the request receives more than 20 upvotes, we'll move it to our consideration list.

You can find more details about the feature request process in our documentation.

[alan-agius4]

We recommend configuring the minimumReleaseAge within your pnpm-workspace, as this setting is applied to all dependencies, both direct and indirect. Implementing this feature via the CLI would limit its scope, affecting only direct dependencies non-transitively.

[muuvmuuv]

Hm, yeah that is what I do, but ng update updates the package.json file with the version it found to be compatible/latest and installs using a package manager. This last step then fails, if the version that ng found is not older than the value I have set via minimumReleaseAge.

[angular-robot]

Just a heads up that we kicked off a community voting process for your feature request. There are 20 days until the voting process ends.

Find more details about Angular's feature request process in our documentation.

[muuvmuuv]

Is any more information needed?

[angular-robot]

Thank you for submitting your feature request! Looks like during the polling process it didn't collect a sufficient number of votes to move to the next stage.

We want to keep Angular rich and ergonomic and at the same time be mindful about its scope and learning journey. If you think your request could live outside Angular's scope, we'd encourage you to collaborate with the community on publishing it as an open source package.

You can find more details about the feature request process in our documentation.

[mattharr]

Just ran into this same problem with the min-release-age setting in npm. Is there a way to work through this? As mentioned, just using the output from ng update seems a bit hit and miss as to how old the versions are (and so what is allowed). So is there a simple way to see older combinations of compatible versions?

[muuvmuuv]

Yeah, just look what Angular tries to install, revert it, install with pnpm and let it fail :/ Angular could just use the pm's update command and avoid manually adjusting the package.json, which would solve it