ng update not reporting new patch or minor versions since v22.0.1 with locked dependency versions in package.json #33712

Command

update

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

22.0.0

Description

I'm experiencing the same as what is reported in #33500 and #33508, with the extra caveat that I always removed the carets and tildes in package.json.

Within the company that I work for, we have this policy of only updating dependencies when necessary. This means installing patches only when it actually fixes an issue we run into, or a vulnerability has been found. In the past, we also had dependencies not fully adhering to semver, thus introducing breaking changes in a minor or even patch versions. It also made sure that all developers within the team were using the exact same version of the dependencies.

In the past, the ng update command was the way I updated my Angular dependencies. So I am absolutely 100% certain that ng update listed new versions (major, minor and patch) even though my package.json had no carets or tildes. Right now I'm trying to update to version 22.1.0 and this is the output:

Using package manager: npm
Collecting installed dependencies...
Found 83 dependencies.
We analyzed your package.json and everything seems to be in order. Good work!

I have been doing my Angular updates like this for years now, so I'm really really really sure there would have been an entry for updating Angular cli and core to 22.1.0 in the past.

Minimal Reproduction

Run ng update on an Angular project that is using Angular CLI 22.0.1 or greater, but not the latest version.

Exception or Error

Your Environment

Angular CLI       : 22.0.1
Angular           : 22.0.1
Node.js           : 24.16.0
Package Manager   : npm 11.13.0
Operating System  : win32 x64

┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package                           │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular/animations               │ 22.0.1            │ 22.0.1            │
│ @angular/build                    │ 22.0.1            │ 22.0.1            │
│ @angular/cdk                      │ 22.0.1            │ 22.0.1            │
│ @angular/cli                      │ 22.0.1            │ 22.0.1            │
│ @angular/common                   │ 22.0.1            │ 22.0.1            │
│ @angular/compiler                 │ 22.0.1            │ 22.0.1            │
│ @angular/compiler-cli             │ 22.0.1            │ 22.0.1            │
│ @angular/core                     │ 22.0.1            │ 22.0.1            │
│ @angular/flex-layout              │ 15.0.0-beta.42    │ 15.0.0-beta.42    │
│ @angular/forms                    │ 22.0.1            │ 22.0.1            │
│ @angular/language-service         │ 22.0.1            │ 22.0.1            │
│ @angular/material                 │ 22.0.1            │ 22.0.1            │
│ @angular/material-luxon-adapter   │ 22.0.1            │ 22.0.1            │
│ @angular/material-moment-adapter  │ 22.0.1            │ 22.0.1            │
│ @angular/platform-browser         │ 22.0.1            │ 22.0.1            │
│ @angular/platform-browser-dynamic │ 22.0.1            │ 22.0.1            │
│ @angular/router                   │ 22.0.1            │ 22.0.1            │
│ rxjs                              │ 7.8.2             │ 7.8.2             │
│ typescript                        │ 6.0.3             │ 6.0.3             │
│ vitest                            │ 4.0.18            │ 4.0.18            │
└───────────────────────────────────┴───────────────────┴───────────────────┘

Anything else relevant?

I let Codex run for a while and it confirmed that there's a different output for tags 22.0.0 and 22.0.1 and was able to fix it:

Result

Exact source: v22.0.1
Reproduced bare ng update incorrectly reporting:

We analyzed your package.json and everything seems to be in order.

npm outdated simultaneously reported:

@angular/core 22.0.0 → 22.1.0

Named ng update @angular/core correctly discovered 22.1.0 and updated package.json.
After the fix, bare ng update --verbose lists:

@angular/core 22.0.0 -> 22.1.0 — ng update @angular/core

Cause

The comparison with v22.0.0 confirms 4510dae introduced the faulty control flow:

1. Bare listing leaves packages.size === 0.
2. Registry metadata is fetched into npmPackageJsonMap.
3. While building packageInfoMap, installed dependencies have isUpdating === false and a local manifest.
4. They therefore take _buildLocalPackageInfo(), which sets npmPackageJson to {}.
5. _usageMessage() has no dist-tags or versions, falls back to the installed version, gets no target, and filters the dependency out.

v22.0.0 always built package information from the fetched registry metadata.

Changes

packages/angular/cli/src/commands/update/schematic/index.ts

• Captures isListingUpdates as packages.size === 0
• Updates if (isUpdating || !localPkgJson) { to if (isListingUpdates || isUpdating || !localPkgJson) {
• Uses cached registry metadata during listing.
• Preserves local-only resolution for unrelated dependencies in targeted updates.
• Preserves the existing local fallback when metadata fetching fails.

I don't agree with the fix Codex suggests, because why would we still need the if-else then, but it does highlight there's a difference between 22.0.0 and 22.0.1.