`ng update` installs @angular packages in too high versions

[fge-aeb]

Command

update

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

We have the following @angular packages installed in our apps:

  "dependencies": {
    "@angular/animations": "^18.2.0",
    "@angular/cdk": "^18.2.14",
    "@angular/common": "^18.2.13",
    "@angular/compiler": "^18.2.13",
    "@angular/core": "^18.2.13",
    "@angular/forms": "^18.2.13",
    "@angular/material": "^18.2.14",
    "@angular/platform-browser": "^18.2.13",
    "@angular/platform-browser-dynamic": "^18.2.13",
    "@angular/router": "^18.2.13",
    "@ngx-translate/core": "~15.0.0",
    ...
    "rxjs": "~7.8.1",
    "tslib": "^2.8.1",
    "zone.js": "~0.14.10"
  },
  "devDependencies": {
    "@angular-devkit/build-angular": "^18.2.12",
    "@angular/cli": "^18.2.12",
    "@angular/compiler-cli": "^18.2.13",
    ...
    "ts-node": "^10.9.2",
    "typescript": "~5.5.4"
  },

When running

npx @angular/cli@19 update @angular/core@19 @angular/cli@19 @angular/material@19 @angular/cdk@19

the packages passed explicitly as arguments to the ng update command are correctly updated to v19. But all packages not explicitly passed are updated to v20.

    Updating package.json with dependency @angular-devkit/build-angular @ "19.2.21" (was "18.2.14")...
    Updating package.json with dependency @angular/cli @ "19.2.21" (was "18.2.21")...
    Updating package.json with dependency @angular/compiler-cli @ "20.3.16" (was "18.2.14")...
    Updating package.json with dependency @angular/animations @ "20.3.16" (was "18.2.14")...
    Updating package.json with dependency @angular/cdk @ "19.2.19" (was "18.2.14")...
    Updating package.json with dependency @angular/common @ "20.3.16" (was "18.2.14")...
    Updating package.json with dependency @angular/compiler @ "20.3.16" (was "18.2.14")...
    Updating package.json with dependency @angular/core @ "19.2.18" (was "18.2.14")...
    Updating package.json with dependency @angular/forms @ "20.3.16" (was "18.2.14")...
    Updating package.json with dependency @angular/material @ "19.2.19" (was "18.2.14")...
    Updating package.json with dependency @angular/platform-browser @ "20.3.16" (was "18.2.14")...
    Updating package.json with dependency @angular/platform-browser-dynamic @ "20.3.16" (was "18.2.14")...
    Updating package.json with dependency @angular/router @ "20.3.16" (was "18.2.14")...

We observed the same behavior for @angular/cli v18 to v20 updating to Angular 18, 19 or 20.

Is this intended? Or are we doing something wrong?

Minimal Reproduction

See above

Exception or Error

Your Environment

_                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/
    

Angular CLI: 18.2.21
Node: 24.13.1 (Unsupported)
Package Manager: npm 11.8.0
OS: linux arm64

Angular: 18.2.13
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1901.6
@angular-devkit/build-angular   18.2.14
@angular-devkit/core            19.1.6
@angular-devkit/schematics      19.1.6
@angular/cdk                    18.2.14
@angular/cli                    18.2.21
@angular/material               18.2.14
@schematics/angular             18.2.21
rxjs                            7.8.1
typescript                      5.5.4
zone.js                         0.14.10

(Prior to running the command from the issue details)

Anything else relevant?

No response

[alan-agius4]

This is intended behavior: if no version is specified, ng update defaults to the next available major version

[kroeder]

@alan-agius4 it's maybe the intended behavior but from a DX perspective, is it really correct?

Targeting a core-package, e.g. @angular/core@19, which implicitly updates all the packages in packageGroup of that package, but possibly to a higher version than the actual target.

The only solution to this is to manually checking all of the installed packages and list them in the update command but doesn't this defeat the purpose of packageGroup?

[alan-agius4]

Targeting a core-package, e.g. @angular/core@19, which implicitly updates all the packages in packageGroup of that package, but possibly to a higher version than the actual target.

The only solution to this is to manually checking all of the installed packages and list them in the update command but doesn't this defeat the purpose of packageGroup?

This shouldn't be the case, as the version specifier will be used for all packages within the packageGroup.

[kroeder]

@alan-agius4 we found the issue but don't know where it belongs or who's fault this is

I created a repro https://github.com/kroeder/angular-update-to-wrong-version-bug

If you do this without @angular/cdk, it works

npx @angular/cli@20 update @angular/cli@20 @angular/core@20

Fetching dependency metadata from registry...
    Updating package.json with dependency @angular-devkit/build-angular @ "20.3.17" (was "19.2.21")...
    Updating package.json with dependency @angular/cli @ "20.3.17" (was "19.2.21")...
    Updating package.json with dependency @angular/compiler-cli @ "20.3.16" (was "19.2.18")...
    Updating package.json with dependency typescript @ "5.9.3" (was "5.7.3")...
    Updating package.json with dependency @angular/common @ "20.3.16" (was "19.2.18")...
    Updating package.json with dependency @angular/compiler @ "20.3.16" (was "19.2.18")...
    Updating package.json with dependency @angular/core @ "20.3.16" (was "19.2.18")...
    Updating package.json with dependency @angular/forms @ "20.3.16" (was "19.2.18")...
    Updating package.json with dependency @angular/platform-browser @ "20.3.16" (was "19.2.18")...
    Updating package.json with dependency @angular/platform-browser-dynamic @ "20.3.16" (was "19.2.18")...
    Updating package.json with dependency @angular/router @ "20.3.16" (was "19.2.18")...

if you do this with @angular/cdk you get the following error

npx @angular/cli@20 update @angular/cli@20 @angular/core@20 @angular/cdk@20

Fetching dependency metadata from registry...
    Package "@angular-devkit/build-angular" has an incompatible peer dependency to "@angular/compiler-cli" (requires "^20.0.0", would install "21.1.5")
    Package "@angular-devkit/build-angular" has an incompatible peer dependency to "@angular/platform-browser" (requires "^20.0.0", would install "21.1.5")
    Package "@angular/common" has an incompatible peer dependency to "@angular/core" (requires "21.1.5", would install "20.3.16")
    Package "@angular/core" has an incompatible peer dependency to "@angular/compiler" (requires "20.3.16", would install "21.1.5")
    Package "@angular/common" has an incompatible peer dependency to "@angular/core" (requires "21.1.5" (extended), would install "20.3.16").
    Package "@angular/forms" has an incompatible peer dependency to "@angular/core" (requires "21.1.5", would install "20.3.16")
    Package "@angular/platform-browser" has an incompatible peer dependency to "@angular/core" (requires "21.1.5", would install "20.3.16")
    Package "@angular/platform-browser-dynamic" has an incompatible peer dependency to "@angular/core" (requires "21.1.5", would install "20.3.16")
    Package "@angular/router" has an incompatible peer dependency to "@angular/core" (requires "21.1.5", would install "20.3.16")

[alan-agius4]

This seems like a bug which is caused by @angular/cdk having a wider peer dependency range where the version 20 works also with version 21.

Since the source package.json specifies version 19.x.x, ng update will resolve to the highest compatible version within that range to satisfy peer dependency requirements.

As a workaround you can update @angular/cdk by itself.

$ ng update @angular/cli@20
$ ng update @angular/cdk@20