Stop using ^ in your dependencies, it makes everyone sad

[Charles Harvey]

Every so often a build of mine fails because it can't download the latest version of one of the new @aws-sdk V3 libraries. I check my package.json and see that I am not even using the new sdk yet. So I have to track down which library is using it. Its this one!

Here is my error:

npm ERR! code ETARGET
npm ERR! notarget No matching version found for @aws-sdk/client-cognito-identity@3.338.0.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.

Never heard of that library.

So I run npm ls --depth=3 > deps.txt. Then search for @aws and I find this library.

So I look at your dependencies:

    "@aws-sdk/client-acm": "^3.329.0",
    "@aws-sdk/client-api-gateway": "^3.329.0",
    "@aws-sdk/client-apigatewayv2": "^3.329.0",
    "@aws-sdk/client-cloudformation": "^3.329.0",
    "@aws-sdk/client-route-53": "^3.329.0",
    "@aws-sdk/client-s3": "^3.329.0",
    "@aws-sdk/config-resolver": "^3.329.0",
    "@aws-sdk/credential-providers": "^3.329.0",
    "@aws-sdk/node-config-provider": "^3.329.0",
    "@aws-sdk/smithy-client": "^3.329.0"

That cognito lib isn't even there. But because you used the ^ it is pulling in the latest.

AWS publishes all their libs at once. But there are a lot of node libs and they take at least an hour to all get published. So I now have to sit on my hands for a half hour waiting for the AWS build/publish process to complete.

Please stop using the ^ in your dependencies. It breaks builds. Like, a few times a week. And it always causes a lot of confusion every time it happens.

Thanks!

[Dima Revutskyi]

Hi @charlie-harvey

Thank you for the request!
We will not do such often dependency updates.

But the best solution in your case will be to lock serverless-domain-manager version in your package list and don't use the latest.
It should prevent such cases.

Closing it as there are no actions from our side.

[Charles Harvey]

This is still destroying my builds. Keeps happening a few times a week.

This is what my package.json looks like:

  "devDependencies": {
    "serverless": "3.32.2",
    "serverless-domain-manager": "7.0.4",
    "serverless-plugin-warmup": "8.2.1",
    "serverless-prune-plugin": "2.0.2",
    "serverless-webpack": "5.11.0"
  }

This is the error I keep getting when running npm install:

npm WARN deprecated string-at@1.1.0: The original `String.prototype.at` proposal has been replaced by a new one; please use v1 or later of `string.prototype.at` instead
npm ERR! code ETARGET
npm ERR! notarget No matching version found for @aws-sdk/client-sts@3.382.0.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.
npm ERR! notarget
npm ERR! notarget It was specified as a dependency of '@aws-sdk/client-acm'
npm ERR! notarget

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/charlesharvey/.npm/_logs/2023-08-01T20_09_20_785Z-debug.log

I locked in all my versions. But ALL of the versions of serverless-domain-manager keep trying to pull the latest from @aws-sdk.

I even tried this in my package.json:

  "overrides": {
    "@aws-sdk/client-acm": "3.326.0",
    "@aws-sdk/client-lambda": "3.326.0",
    "@aws-sdk/client-sts": "3.326.0"
  },

Same error.

Every single time that AWS rolls out a new release, which is multiple times a week, my builds fail because of this library.

See in the attached image that the 3.382.0 version of the library has zero downloads. That's because it doesn't actually exist yet and cannot be downloaded.