Skip to content

fix: do not override the package manager minimum package age - #25173

Draft
Artur- wants to merge 4 commits into
mainfrom
minage
Draft

fix: do not override the package manager minimum package age#25173
Artur- wants to merge 4 commits into
mainfrom
minage

Conversation

@Artur-

@Artur- Artur- commented Aug 11, 2026

Copy link
Copy Markdown
Member

The minimumFrontendPackageAgeDays parameter defaulted to 1 and was always passed as a command line argument, which takes precedence over every configuration source of npm, pnpm and bun. A project that configures min-release-age in .npmrc got the Vaadin default instead, so mvn vaadin:build-frontend and a manually run npm install disagreed on which package versions are allowed.

The parameter is now unset by default. When nothing is configured on the Vaadin side, the package manager is asked what it resolves for its own minimum release age setting (config get for npm and pnpm, bunfig.toml for bun) and no argument is passed when it already has one. The one day default applies only when neither is configured.

The minimumFrontendPackageAgeDays parameter defaulted to 1 and was always
passed as a command line argument, which takes precedence over every
configuration source of npm, pnpm and bun. A project that configures
min-release-age in .npmrc got the Vaadin default instead, so
`mvn vaadin:build-frontend` and a manually run `npm install` disagreed on
which package versions are allowed.

The parameter is now unset by default. When nothing is configured on the
Vaadin side, the package manager is asked what it resolves for its own
minimum release age setting (`config get` for npm and pnpm, bunfig.toml
for bun) and no argument is passed when it already has one. The one day
default applies only when neither is configured.
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Test Results

 1 450 files  ±0   1 451 suites  ±0   1h 29m 44s ⏱️ + 3m 26s
10 398 tests +1  10 331 ✅ +1  67 💤 ±0  0 ❌ ±0 
10 834 runs  +1  10 766 ✅ +1  68 💤 ±0  0 ❌ ±0 

Results for commit 2a1e53c. ± Comparison against base commit cad481f.

♻️ This comment has been updated with latest results.

Artur- added 3 commits August 11, 2026 15:32
The parameter type changed from int to Integer, which the javadoc build
flags as a reference that cannot be resolved.
Reading the minimum release age used `config get <key>` while the
registry lookup already ran `config ls --json`, which resolves the same
configuration and contains every key. Both now share
getResolvedConfiguration, so there is a single way to ask npm or pnpm
what it resolves for a directory, and no string parsing of the tool
output is needed to tell a configured value from an unset one.
resolveMinimumFrontendPackageAgeDays returned 0 both for a check that is
explicitly disabled and for one the package manager already handles
itself, and the caller repeated the same check to know whether to ask npm
for its version at all. Resolution now returns the install argument to
add, or nothing, and the remaining day count method only formats a
positive number of days for the package manager in use.
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant