ng update --all says 'Repository is not clean' even though git commit
You should use --allow-dirty if you want to bypass that warning.
This works on @angular/cli v8.0.1+.
ng update --all --allow-dirty
The issue was, that I commited all files (including the package-lock.json) it did mark it as modified. (I don't know why). Therefore the tree was not possible.
Because commiting was not possible (even though the error message suggests it), I had to stash it. Then it worked, but I had to stash after every command.