Support for pnpm (or general) minimumReleaseAge

[muuvmuuv]

Command

update

Description

As of recent mitm attacks it would be cool to have support for pnpm's minimumReleaseAge or something by Angular itself.

Describe the solution you'd like

• pnpm's minimumReleaseAge
• Angular option to set min release age on update command

Describe alternatives you've considered

Instead of modifying package.json call package manager update command:

pnpm update "@angular/core@~20.3.1" "@angular/cli@~20.3.1"

[angular-robot]

This feature request is now candidate for our backlog! In the next phase, the community has 60 days to upvote. If the request receives more than 20 upvotes, we'll move it to our consideration list.

You can find more details about the feature request process in our documentation.

[alan-agius4]

We recommend configuring the minimumReleaseAge within your pnpm-workspace, as this setting is applied to all dependencies, both direct and indirect. Implementing this feature via the CLI would limit its scope, affecting only direct dependencies non-transitively.

[muuvmuuv]

Hm, yeah that is what I do, but ng update updates the package.json file with the version it found to be compatible/latest and installs using a package manager. This last step then fails, if the version that ng found is not older than the value I have set via minimumReleaseAge.