ng update failes to latest version 9.1.0: unable to get local issuer certificate

🐞 Bug report

Command (mark with an x)

• new
• build
• serve
• test
• e2e
• generate
• add
• [x ] update
• lint
• xi18n
• run
• config
• help
• version
• doc

Is this a regression?

Yes, the previous version in which this bug was not present was: 9.0.7

Description

Error fetching metadata for ‘@angular/cli’: request to https://proget.mydomain.de/npm/FEED/@angular%2Fcli failed, reason: unable to get local issuer certificate

🔬 Minimal Reproduction

• Install and configure a local npm repository, e.g. ProGet
• npm set strict-ssl false
• npm set cafile C:\YourCARoot.cer
• npm set registry https://my-registry.internal-proget.de/npm/FEED
• ng update @angular/cli @angular/core

🌍 Your Environment

Attention: This is the projects local version

C:\lvs\git\ng-viewer [master ↑1]> ng --version                                                                                                                                                        Your global Angular CLI version (9.1.0) is greater than your local
version (8.3.25). The local Angular CLI version is used.

To disable this warning use "ng config -g cli.warnings.versionMismatch false".

     _                      _                 ____ _     ___
    / \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|
   / △ \ | '_ \ / _` | | | | |/ _` | '__|   | |   | |    | |
  / ___ \| | | | (_| | |_| | | (_| | |      | |___| |___ | |
 /_/   \_\_| |_|\__, |\__,_|_|\__,_|_|       \____|_____|___|
                |___/


Angular CLI: 8.3.25
Node: 12.16.1
OS: win32 x64
Angular: 8.2.14
... animations, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router

Package                           Version
-----------------------------------------------------------
@angular-devkit/architect         0.803.25
@angular-devkit/build-angular     0.803.25
@angular-devkit/build-optimizer   0.803.25
@angular-devkit/build-webpack     0.803.25
@angular-devkit/core              7.3.9
@angular-devkit/schematics        7.3.9
@angular/cdk                      8.2.3
@angular/cli                      8.3.25
@ngtools/webpack                  8.3.25
@schematics/angular               8.3.25
@schematics/update                0.803.25
rxjs                              6.5.4
typescript                        3.5.3
webpack                           4.39.2

Anything else relevant?

Well i’am very disappointed to have this error over and over again, since Angular 5 on any version this appears again and again. Why this cannot be fixed forever!!!

Possible Fixes

• Researched from @bridzius

A quick fix from the cli perspective would be the downgrade of pacote back to @<10.

• The CLI could convert the strict-ssl setting to strictSSL

[bridzius]

The newest version of @angular/cli has an updated version of pacote@11.1.4, which, in turn has an updated version of npm-registry-fetch - ^4.0.0 to ^8.0.0.

The external API of npm-registry-fetch has changed between @6 and @7.0.0, where instead of strict-ssl (the .npmrc value as defined in npm documentation) it now expects strictSSL.

Since ng update just passes the contents of your .npmrc file into pacote, which strips the strict-ssl param from the config - npm-registry-fetch get this parameter straight from your .npmrc by itself sends it to npm-registry-fetch, but it doesn’t understand it - since it is strict-ssl, not strictSSL. EDIT: (pacote actually passes the param through to npm-registry-fetch).

This is a fix that should happen in npm-registry-fetch ideally (the library should treat strict-ssl and strictSSL similarly)

A very quick fix you can do yourself, is addingstrictSSL=false into your .npmrc file. A quick fix from the cli perspective would be the downgrade of pacote back to @<10.

EDIT: Quick note: Previously, if you hadn’t set strict-ssl=true explicitly, npm-registry-fetch would treat it as strict-ssl=false. The default was lately changed from false to true, since npm-registry-fetch moved away from the figgy-pudding lib for cascading configs.

[angular-automatic-lock-bot[bot]]

This issue has been automatically locked due to inactivity. Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}