dependency on unsupported AWS SDK v2

[jwilson-anonyome]

How did you install the Amplify CLI?

yarn

If applicable, what version of Node.js are you using?

20

Amplify CLI Version

14.0.0

What operating system are you using?

Mac

Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No manual changes made

Describe the bug

Various amplify-cli packages have a dependency on AWS SDK v2. This is end-of-life and will be unsupported on September 8th 2025.

https://aws.amazon.com/blogs/developer/announcing-end-of-support-for-aws-sdk-for-javascript-v2/

The packages are:

packages/amplify-appsync-simulator/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-category-auth/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-category-function/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-category-geo/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-category-hosting/package.json:    "aws-sdk": "^2.1692.0",
packages/amplify-category-notifications/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-category-predictions/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-category-storage/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-cli/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-console-hosting/package.json:    "aws-sdk": "^2.1692.0",
packages/amplify-console-integration-tests/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-dynamodb-simulator/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-e2e-core/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-e2e-tests/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-environment-parameters/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-opensearch-simulator/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-provider-awscloudformation/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-storage-simulator/package.json:    "aws-sdk": "^2.1464.0"
packages/amplify-util-import/package.json:    "aws-sdk": "^2.1464.0"
packages/amplify-util-mock/package.json:    "aws-sdk": "^2.1464.0",
packages/amplify-util-uibuilder/package.json:    "aws-sdk": "^2.1464.0",

Expected behavior

The packages should be updated to use packages from AWS SDK v3, i.e. packages like @aws-sdk/client-*

Reproduction steps

1. Checkout code
2. Search for aws-sdk in package.json files

Project Identifier

No response

Log output

Details

# Put your logs below this line

Additional information

No response

Before submitting, please confirm:

• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
• I have removed any sensitive information from my code snippets and submission.

[ShadowCat567]

Hello! We are currently in the process of migrating to SDK V3, see these PRs:
#14199
#14221
#14238

[jwilson-anonyome]

aws-sdk v2 is no longer a direct dependency. Thanks for the work on this!

It does seem to be an indirect dependency:

amplify-cli> $ yarn why aws-sdk
├─ @aws-amplify/amplify-category-api@npm:5.15.1
│  └─ aws-sdk@npm:2.1464.0 (via npm:^2.1464.0)
│
├─ @aws-amplify/amplify-category-api@npm:5.15.1 [3e40d]
│  └─ aws-sdk@npm:2.1464.0 (via npm:^2.1464.0)
│
├─ @aws-amplify/amplify-category-api@npm:5.15.1 [626ad]
│  └─ aws-sdk@npm:2.1464.0 (via npm:^2.1464.0)
│
└─ @aws-amplify/amplify-category-api@npm:5.15.1 [dc84c]
   └─ aws-sdk@npm:2.1464.0 (via npm:^2.1464.0)

Looking at the code from https://github.com/aws-amplify/amplify-category-api we have:

amplify-category-api> $ yarn why aws-sdk
├─ @aws-amplify/amplify-appsync-simulator@npm:2.16.7
│  └─ aws-sdk@npm:2.1692.0 (via npm:^2.1141.0)
│
├─ @aws-amplify/core@npm:2.3.0
│  └─ aws-sdk@npm:2.1692.0 (via npm:^2.1141.0)
│
└─ @aws-amplify/core@npm:2.3.0 [2b9ea]
   └─ aws-sdk@npm:2.1692.0 (via npm:^2.1141.0)

Is this dependency circular? I get confused by all the packages and projects here!

Perhaps we can now remove this section from this project's package.json:

  "resolutions": {
    "aws-sdk": "^2.1464.0",
 ...

[ShadowCat567]

amplify-category-api has finished their aws-sdk V2->V3 migrations as well and the code has been released and consumed by amplify-cli, so when you run

yarn why aws-sdk

there should not longer be any packages listed that have aws-sdk as a dependency.

As for aws-sdk remaining in package.json resolutions. Yep, that should be removed, I must have missed it during the migration.