Skip to content

Conversation

@clydin
Copy link
Member

@clydin clydin commented Oct 21, 2025

This commit fully refactors the ng add command to use the new, centralized package manager abstraction.

All package installation and metadata fetching logic now goes through the new API. This includes:

  • Using createPackageManager to detect the project's package manager.
  • Replacing fetchPackageMetadata with packageManager.getRegistryMetadata.
  • Replacing fetchPackageManifest with packageManager.getPackageManifest.
  • Replacing the install and installTemp methods with the packageManager.add and packageManager.acquireTempPackage methods.

This change improves security by eliminating shell: true execution as well as enhances reliability with better error handling and caching.

@clydin clydin added the target: major This PR is targeted for the next major release label Oct 21, 2025
@angular-robot angular-robot bot added area: performance Issues related to performance area: @angular/cli labels Oct 21, 2025
…ifest

The `getPackageManifest` method in the package manager abstraction was previously limited to fetching manifests from an NPM registry.

This commit refactors the method to accept a generic `packageSpecifier` string. This allows the abstraction to leverage the underlying package manager's native ability to read manifests from various sources, including local tarballs (`.tgz`), local directories (`file:`), and git URLs, in addition to registry specifiers.

This makes the `PackageManager` class more robust and capable of handling all package sources supported by commands like `ng add`.
…action

This commit fully refactors the `ng add` command to use the new, centralized package manager abstraction.

All package installation and metadata fetching logic now goes through the new API. This includes:

- Using `createPackageManager` to detect the project's package manager.
- Replacing `fetchPackageMetadata` with `packageManager.getRegistryMetadata`.
- Replacing `fetchPackageManifest` with `packageManager.getPackageManifest`.
- Replacing the `install` and `installTemp` methods with the `packageManager.add` and `packageManager.acquireTempPackage` methods.

This change improves security by eliminating `shell: true` execution as well as enhances reliability with better error handling and caching.
The `ng add` command's version discovery mechanism could be slow when the `latest` tag of a package was incompatible, as it would fall back to exhaustively fetching the manifest for every available version.

This commit introduces a performance optimization that uses a heuristic-based search. The new logic first identifies the latest release within each major version line and checks only those for compatibility. This dramatically reduces the number of network requests in the common case where peer dependency conflicts align with major versions.

The exhaustive, version-by-version search is retained as a fallback to ensure correctness in edge cases.
@alan-agius4 alan-agius4 removed the target: major This PR is targeted for the next major release label Oct 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: @angular/cli area: performance Issues related to performance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants