Start using fixed versions of 3rd party packages (or at least same minor version) in LTS versions

[dozer75]

Bug Report or Feature Request (mark with an x)

- [ ] bug report -> please search issues before submitting
- [X] feature request

Desired functionality

As seen in issue #12866 the usage of non fixed versions causes lots of problems when a dependent package breaks Angular, this is not the first time and probably not the last time. So I suggest that an LTS version uses fixed versions of external packages to avoid issues like this.

Waiting (like in this example 8 hours) for a fix may be costly for some users of the Angular platform. Luckily enough this fix was simple by adding webpack to your own package.json file, but it is quite costly to analyze and search for a solution when these things happens.

[alan-agius4]

Hi, we are already using fixed versions for direct dependencies in version 7.

I do agree that maybe we should add this for the LTS versions as well.

[alexeagle]

Generally, users should use a lock file to prevent breakages. Even if we pin our direct dependencies, our transitive dependencies can still push updates which are broken and which match whatever semver range the intermediate dependency requires.

Pinning direct dependencies is only a partial fix.
We could back-port the pinning to LTS, how much work do you think that is @alan-agius4 ? If it's just a couple hours I think we should do it.

[alan-agius4]

@alexeagle, yeah it's just a couple of hours. I'll be on it tomorrow.

[alan-agius4]

Fixed via #13007

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}