ng update --all updates other packages

[tomgruszowski]

🐞 Bug report

Command (mark with an x)

• new
• build
• serve
• test
• e2e
• generate
• add
• update
• lint
• xi18n
• run
• config
• help
• version
• doc

Is this a regression?

No

Description

The expected behavior of ng update --all doesn't match documentation. I use ng update all when updating angular core and material (4 ng 'packages' typically) but this command updates all my other libraries and ignores semvar rules. It's been the default behavior for as long as I can remember. I would like to use ng update to just update all my angular/schematic packages and ignore other npm packages, or to at least respect semvar restrictions when updating other packages. The docs imply this might be the case "--all=true|false - Whether to update all packages in package.json. Default: false"

🔬 Minimal Reproduction

Take any angular project that isn't on the latest minor version (i.e. ng 10.0.8 vs 10.0.9), ensure there is at least 1 other package that has npm rules set to not update major (i.e. karma-jasmine: ~3.3.1)

ng update --all will update karma-jasmine package to 4.0.0, using --all=false doesn't seem to have any effect either.

🌍 Your Environment

Angular CLI: 10.0.5
Node: 14.7.0
OS: win32 x64

Angular: 10.0.9
... animations, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router, service-worker
Ivy Workspace: Yes

Package                           Version
-----------------------------------------------------------
@angular-devkit/architect         0.1000.5
@angular-devkit/build-angular     0.1000.5
@angular-devkit/build-optimizer   0.1000.5
@angular-devkit/build-webpack     0.1000.5
@angular-devkit/core              10.0.5
@angular-devkit/schematics        10.0.5
@angular/cdk                      10.1.3
@angular/cli                      10.0.5
@angular/material                 10.1.3
@ngtools/webpack                  10.0.5
@schematics/angular               10.0.5
@schematics/update                0.1000.5
rxjs                              6.6.2
typescript                        3.9.7
webpack                           4.43.0

[alan-agius4]

H @tomastrajan,

• ng update --all has the same behaviour of npm outdated with the addition of installing the package and running the schematics if present.
• ng update/ng update --no-all/ng update --all=false will show the outdated packages that have ng-update schematics.

If you want to update multiple packages at once you can use ng update <pkg1> <pkg2> <pkg3>.

With regards to the below statement:

The expected behavior of ng update --all doesn't match documentation

Can you please explain which part of the documentation are you referring too? In https://angular.io/cli/update it's stated that --al will update all packages in package.json.

[tomgruszowski]

@alan-agius4 my main issue is that other packages get updated which violate node package constraints; do you agree that a package with "~3.3.1" shouldn't get updated to "~4.0.0"? In my specific example, it doesn't look like karma-jasmine is a package that a schematic would update (based on some dependency - like upgrading major package version from ng 9>10 causes other packages to get upgraded based on major version) so it's a plain old npm package, ng new (using ng v10) still defaults to version 3.x.

As for syntax for updating multiple schematics packages, I understand that part thanks, the reason I like using --all is so I don't have to type 4 package names (ng and material).

As for confusing docs, I just tried "ng new ...", then "ng update" as well as "ng update --all=false", exact same output, it just lets me know what I can schematic based packages without actually updating anything, why is this same behavior? The docs for "all=false" say "Whether to update all packages in package.json.", I interpreted this as "update all schematic packages but don't touch non-schematic packages".

I hope this answers your questions, it's possible that I'm just misinterpreting docs but the major version update of other packages seems like a bug.

[alan-agius4]

do you agree that a package with "~3.3.1" shouldn't get updated to "~4.0.0"

This is working as expected because ng update acts similar to ncu where packages are updated to the latest version irrespective if they match the semantic versioning policies or not. Maybe in future we can revisit this but currently this is working as expected. In case, you want to maintain the semantic version policy, one should probably "refresh" the package manager lock file.

As for syntax for updating multiple schematics packages, I understand that part thanks, the reason I like using --all is so I don't have to type 4 package names (ng and material)

The docs clearly state that using --all will update all packages in package.json. https://angular.io/cli/update

"ng update" as well as "ng update --all=false", exact same output

These two commands are identical and will not auto update any package. Instead they the command will print out which packages needs to be updated.

The docs for "all=false" say "Whether to update all packages in package.json."

When you set this to false, ng update will not update all package, ng update will print out the commands to run to update individual packages.

[tomgruszowski]

Ok, I didn't realize this was all by design; if you do revisit this default, perhaps consider a flag to only update all angular packages, i.e. ng update --ng/allNg/ngOnly.

I will likely just stick to "npm update" for all "patch" updates of Angular, and only use ng update with manual package listing for the major updates.

Maybe a bit more context to this issues, there are times I specifically lock down a package for whatever reason, and updating angular using "the angular way", in my opinion, shouldn't break that.

Feel free to close this issue for now.

[alan-agius4]

I will likely just stick to "npm update" for all "patch" updates of Angular, and only use ng update with manual package listing for the major updates.

Note that during minor versions packages might include migrations that will need to be executed, therefore I do recommend using ng update for non-major versions.

[tomgruszowski]

As a recent example @alan-agius4 , ng update --all would bump TypeScript to v4 would it not? that seems like a major change worth review, one that I would not want to happen when updating a patch version of angular (using the all switch).

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}