Skip to content

fix: do not override the package manager minimum package age - #25173

Draft
Artur- wants to merge 5 commits into
mainfrom
minage
Draft

fix: do not override the package manager minimum package age#25173
Artur- wants to merge 5 commits into
mainfrom
minage

Conversation

@Artur-

@Artur- Artur- commented Aug 11, 2026

Copy link
Copy Markdown
Member

The minimumFrontendPackageAgeDays parameter defaulted to 1 and was always passed as a command line argument, which takes precedence over every configuration source of npm, pnpm and bun. A project that configures min-release-age in .npmrc got the Vaadin default instead, so mvn vaadin:build-frontend and a manually run npm install disagreed on which package versions are allowed.

The parameter is now unset by default. When nothing is configured on the Vaadin side, the package manager is asked what it resolves for its own minimum release age setting (config get for npm and pnpm, bunfig.toml for bun) and no argument is passed when it already has one. The one day default applies only when neither is configured.

The minimumFrontendPackageAgeDays parameter defaulted to 1 and was always
passed as a command line argument, which takes precedence over every
configuration source of npm, pnpm and bun. A project that configures
min-release-age in .npmrc got the Vaadin default instead, so
`mvn vaadin:build-frontend` and a manually run `npm install` disagreed on
which package versions are allowed.

The parameter is now unset by default. When nothing is configured on the
Vaadin side, the package manager is asked what it resolves for its own
minimum release age setting (`config get` for npm and pnpm, bunfig.toml
for bun) and no argument is passed when it already has one. The one day
default applies only when neither is configured.
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Test Results

 1 450 files  ±0   1 451 suites  ±0   1h 28m 15s ⏱️ + 1m 57s
10 398 tests +1  10 331 ✅ +1  67 💤 ±0  0 ❌ ±0 
10 834 runs  +1  10 766 ✅ +1  68 💤 ±0  0 ❌ ±0 

Results for commit 8acc81b. ± Comparison against base commit cad481f.

♻️ This comment has been updated with latest results.

Artur- added 4 commits August 11, 2026 15:32
The parameter type changed from int to Integer, which the javadoc build
flags as a reference that cannot be resolved.
Reading the minimum release age used `config get <key>` while the
registry lookup already ran `config ls --json`, which resolves the same
configuration and contains every key. Both now share
getResolvedConfiguration, so there is a single way to ask npm or pnpm
what it resolves for a directory, and no string parsing of the tool
output is needed to tell a configured value from an unset one.
resolveMinimumFrontendPackageAgeDays returned 0 both for a check that is
explicitly disabled and for one the package manager already handles
itself, and the caller repeated the same check to know whether to ask npm
for its version at all. Resolution now returns the install argument to
add, or nothing, and the remaining day count method only formats a
positive number of days for the package manager in use.
Detecting a minimum release age configured for bun meant parsing
bunfig.toml by hand, as bun has no command for printing its resolved
configuration (oven-sh/bun#7140). That parser only recognized a subset of
what the TOML format allows, so it could just as well miss a configured
value as pick up something that is not one.

Only npm and pnpm, which can both report their resolved configuration,
are now asked. For bun the Vaadin default applies as before, and the
documentation says so.
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant