Summary
npx @strapi/upgrade always upgrades to the latest version (regardless of which version of @strapi/upgrade one chooses to execute!). There is a hidden to parameter in the CLI that allows for specifying a version.
Why is it needed?
With all the supply-chain attacks happening in the NPM ecosystem, a common piece of advice is to add a min-release-age: 7 #days to .npmrc (or likewise in pnpm). npx @strapi/upgrade does not work with this setting, as it tries to upgrade to the latest release, regardless of release date.
Suggested solution(s)
A great solution would be to respect the min-release-age setting, but I'm not sure how the interplay with NPM works here; maybe this is out of @strapi/upgrades control.
In any case, the to parameter exists (see line 100 here) and works just fine despite not being advertised. My suggestion is to document this parameter and officially support it. It seems actively hidden and I wonder what the reason for that is?
Related issue(s)/PR(s)
No response
Summary
npx @strapi/upgradealways upgrades to the latest version (regardless of which version of @strapi/upgrade one chooses to execute!). There is a hiddentoparameter in the CLI that allows for specifying a version.Why is it needed?
With all the supply-chain attacks happening in the NPM ecosystem, a common piece of advice is to add a
min-release-age: 7 #daysto.npmrc(or likewise inpnpm).npx @strapi/upgradedoes not work with this setting, as it tries to upgrade to the latest release, regardless of release date.Suggested solution(s)
A great solution would be to respect the
min-release-agesetting, but I'm not sure how the interplay with NPM works here; maybe this is out of@strapi/upgrades control.In any case, the
toparameter exists (see line 100 here) and works just fine despite not being advertised. My suggestion is to document this parameter and officially support it. It seems actively hidden and I wonder what the reason for that is?Related issue(s)/PR(s)
No response