Install size of node_modules increased in v3.565.0

trivikr commented 2 months ago

Describe the feature

Use Case

At the time of running the test, the latest version of the SDK is v3.568.0

Versions

$ node -v
v20.12.2

$ npm -v
10.5.0

v3.564.0

$ npm init -y && npm install @aws-sdk/client-dynamodb@3.564.0 --save-exact

$ du -sh node_modules 
 17M    node_modules

v3.565.0

$ npm init -y && npm install @aws-sdk/client-dynamodb@3.565.0 --save-exact

$ du -sh node_modules                                                     
 23M    node_modules

v3.568.0

$ npm init -y && npm install @aws-sdk/client-dynamodb@3.568.0 --save-exact

$ du -sh node_modules                                                     
 17M    node_modules

Proposed Solution

The install size increases in v3.565.0, since npm installs peerDependencies by default and it installs the latest version at the time of running the install in absence of lockfile. In v3.565.0, we switched to using caret for all peerDependencies in https://github.com/aws/aws-sdk-js-v3/pull/6031 which caused this issue.

To unblock users on package managers which do not install peerDepdendencies by default, like yarn, we added direct dependency of exact client version in https://github.com/aws/aws-sdk-js-v3/pull/6055. We can similar use exact version of client as a peerDependency in credential providers.

Other Information

No response

Acknowledgements

[X] I may be able to implement this feature request
[ ] This feature might incur a breaking change

SDK version used

v3.564.0

Environment details (OS name and version, etc.)

Node.js

trivikr commented 1 month ago

Re-opening, since https://github.com/aws/aws-sdk-js-v3/releases/tag/v3.570.0 didn't release new versions of the following packages:

credential-provider-ini
credential-provider-web-identity
token-providers

This is likely due to some issue in internal publish script, and needs investigation.

trivikr commented 1 month ago

An update to @aws-sdk/credential-provider-ini was released in https://github.com/aws/aws-sdk-js-v3/releases/tag/v3.572.0, and I verified that it depends on fix version of the client

$ npm install @aws-sdk/credential-provider-ini@3.572.0 --save-exact

$ grep -A 2 peerDependencies node_modules/@aws-sdk/credential-provider-ini/package.json
  "peerDependencies": {
    "@aws-sdk/client-sts": "3.572.0"
  },

trivikr commented 1 month ago

Pinning client peerDependencies makes npm to force installation step, like described in https://github.com/aws/aws-sdk-js-v3/issues/6098, or in internal ticket JS-5195.

We're reverting to using latest version of client peerDependenices in https://github.com/aws/aws-sdk-js-v3/pull/6099. It'll be published with https://github.com/aws/aws-sdk-js-v3/releases/tag/v3.577.0 around 12:30 PM Pacific today.

If you're sensitive to install size in your applications, you can do one of the following:

Install the latest version (recommended) and use a lockfile. This will pin your dependencies to the latest version at the time lockfile was created or updated.
Install a pinned version where all clients were published, i.e. v.3.572.0. This is little difficult, since you need to go either through list of updated packages on GitHub release or use npm view versions for the clients you're using.

trivikr commented 1 month ago

This problem should not exist since https://github.com/aws/aws-sdk-js-v3/releases/tag/v3.569.0 as we add clients used in credential providers as direct dependency in https://github.com/aws/aws-sdk-js-v3/pull/6055

At the time of running the test, the latest version of the SDK is v3.576.0

v3.569.0

$ npm init -y && npm install @aws-sdk/client-dynamodb@3.569.0 --save-exact

$ du -sh node_modules 
 17M    node_modules

$ npm ls @aws-sdk/client-sts
test-npm@1.0.0 /Users/trivikr/workspace/test-npm
└─┬ @aws-sdk/client-dynamodb@3.569.0
  ├─┬ @aws-sdk/client-sso-oidc@3.569.0
  │ └── @aws-sdk/client-sts@3.569.0 deduped
  ├── @aws-sdk/client-sts@3.569.0
  └─┬ @aws-sdk/credential-provider-node@3.569.0
    ├─┬ @aws-sdk/credential-provider-ini@3.568.0
    │ └── @aws-sdk/client-sts@3.569.0 deduped
    └─┬ @aws-sdk/credential-provider-web-identity@3.568.0
      └── @aws-sdk/client-sts@3.569.0 deduped

$ grep peerDependencies -A 2 node_modules/@aws-sdk/credential-provider-ini/package.json 
  "peerDependencies": {
    "@aws-sdk/client-sts": "^3.568.0"
  },

 $ npm view @aws-sdk/client-sts versions | tail -n3
  '3.569.0',        '3.572.0',        '3.574.0',        '3.575.0',
  '3.576.0'
]

Although credential-provider-ini requests the latest version of client-sts, it's resolved to v3.569.0 because of direct dependency from client-dynamodb.

github-actions[bot] commented 1 month ago

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.

aws / aws-sdk-js-v3