ng update reinstalls with lifecycle scripts skipped and no notice (since 22.3.0-next.5) #34688

Command

update

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

22.2.6 (every stable release; also 22.3.0-next.4)

Description

Since 22.3.0-next.5, the final "Installing packages" step of ng update passes the package
manager's ignore-scripts flag (npm install --ignore-scripts; --mode=skip-build for modern yarn).
For npm, the update first deletes node_modules ("Cleaning node modules directory"), so after the
reinstall every dependency's preinstall/install/postinstall script — including the
project's own root postinstall — has been skipped. Nothing re-runs them, nothing is printed, and
there is no flag to opt out. For pnpm/yarn/bun there is no wipe, but scripts of the packages changed
by the update are skipped the same way.

Projects that rely on lifecycle scripts break in ways that are hard to connect back to the update:

• patch-package via root postinstall: patches are silently not applied, and the migrations that
  run right after the install operate on the unpatched tree;
• puppeteer, cypress, and similar packages whose postinstall downloads a platform binary.

This comes from a69fe51 ("default ignoreScripts to true when install options are provided"). In
all released versions the final install runs scripts normally: v21.0 still used the legacy
installAll() (no flag), and from 21.1 through 22.2 the = { ignoreScripts: true } parameter
default on install() was replaced entirely by the options object the update command passes
({ ignorePeerDependencies }), so the flag was never added. a69fe51 makes the default apply
per property, which looks right for the temporary tooling installs — but it also silently turns on
script skipping for the final, persistent install of the user's project.

If skipping scripts here is intended, could the command print a notice (e.g. "Lifecycle scripts were
skipped during installation; run your package manager's install/rebuild command to execute them")
and/or offer an opt-out? Otherwise, the final install could pass ignoreScripts: false to restore
the stable-release behavior.

Minimal Reproduction

1. npx @angular/cli@22.2 new repro --defaults && cd repro
2. Add a visible root lifecycle script to package.json:
   "postinstall": "node -e \"require('node:fs').writeFileSync('postinstall-ran.txt','yes')\""
3. npm install → postinstall-ran.txt is created. Delete it: rm postinstall-ran.txt
4. npm install --save-dev --save-exact @angular/cli@22.3.0-next.5
5. npx ng update @angular/core --next
6. After "Cleaning node modules directory" and "Installing packages" finish, postinstall-ran.txt
   does not exist — no install script ran, with no notice. Repeating steps 4–5 with
   @angular/cli@22.3.0-next.4 in step 4 recreates the file.

Exception or Error

(none — the scripts are skipped without any notice, which is the issue)

Your Environment

_                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/
    

Angular CLI       : 22.3.0-next.5
Node.js           : 24.15.0
Package Manager   : yarn 1.22.22
Operating System  : darwin arm64

Anything else relevant?

Code on main:

• packages/angular/cli/src/commands/update/cli.ts:568-602 — the npm-only "Cleaning node modules
  directory" task followed by packageManager.install({ ignorePeerDependencies }), with no
  ignoreScripts override;
• packages/angular/cli/src/package-managers/package-manager.ts:397 —
  const { force, ignoreScripts = true, ignorePeerDependencies } = options; in install().

Defaulting to ignore-scripts for the temporary package acquisitions (ng add/ng update tooling
installs) is good hardening and not what this issue is about — only the final project install.
Reproduces with every package manager; npm is affected most because of the preceding node_modules
wipe. Not OS- or browser-specific.