{{ message }}
Repository navigation
fix(aws-cdk-lib): cannot be used as a bundledDependency - #37726
Merged
Merged
Conversation
NPM has a bug where if a package is used as a bundled dependency at
multiple levels in a dependency tree, the containing package cannot
be itself used as a bundled dependency.
For us, this manifests because
```
aws-cdk-lib -[bundles]-> jsonschema
-[bundles]-> semver
-[bundles]-> @aws-cdk/cloud-assembly-api -[bundles]-> jsonschema
-[bundles]-> semver
```
If then `aws-cdk-lib` is itself declared as a bundled depencency,
NPM errors out during `npm install`.
Testing shows that this only happens if the same dependency is bundled
multiple times; if the bundled dependencies are different it seems to
work out.
We fix this by making sure that dependencies that are bundled by
`aws-cdk-lib` itself are not bundled by any of its dependencies.
We `rm -rf` them from the nested dependency tree.
github-actions
Bot
added
bug
Contributor
aws-cdk-automation
previously requested changes
Apr 29, 2026
rix0rrr
added
pr-linter/exempt-test
aws-cdk-automation
dismissed
their stale review
April 29, 2026 10:11
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
aws-cdk-automation
added
the
pr/needs-maintainer-review
aws-cdk-automation
temporarily deployed
to
automation
April 29, 2026 10:56 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
aws-cdk-automation
temporarily deployed
to
automation
April 29, 2026 10:56 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
aemada-aws
approved these changes
Apr 29, 2026
Contributor
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Contributor
Merge Queue Status
This pull request spent 42 minutes 5 seconds in the queue, including 41 minutes 47 seconds running CI. Required conditions to merge
|
Contributor
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Contributor
aws-cdk-automation
removed
the
pr/needs-maintainer-review
aws-cdk-automation
temporarily deployed
to
automation
April 29, 2026 15:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
mrgrain
pushed a commit
to go-to-k/aws-cdk-cli
that referenced
this pull request
Jun 22, 2026
…11 (aws#1529) ## P0 Fix: npm ci fails on npm 11 with aws-cdk-lib@2.254.0 Fixes aws/aws-cdk#37870 ### Problem `npm ci` fails on npm 11 with `Missing: jsonschema@1.4.1 from lock file` when using aws-cdk-lib@2.254.0. The root cause is that `@aws-cdk/cloud-assembly-api` declares `jsonschema: "~1.4.1"` in its dependencies, but aws-cdk-lib bundles `jsonschema@1.5.0` at the top level. The tilde range `~1.4.1` excludes 1.5.0, so npm 11's stricter lock file validation rejects the mismatch. ### Fix Widen the range from `~1.4.1` to `^1.5.0`. The original tilde pin was introduced in PR aws#61 to work around `jsonschema@1.5.0` being incompatible with Node < 18.17. Since CDK has dropped Node 18 support entirely, this constraint no longer applies. ### Context - Rico noted in aws/aws-cdk#37717 that unbundling `cloud-assembly-api` is not viable because it's not a jsii module. PR #37721 (community attempt at unbundling) confirmed this with build failures. - This was identified as the other viable fix option: widen the range at the source in this repo. - Original pin reason (PR aws#61): `jsonschema@1.5.0` uses URL APIs incompatible with Node < 18.17. No longer relevant. ### Related - P0 issue: aws/aws-cdk#37870 - Rico's bundled-dep strip fix: aws/aws-cdk#37726 - Momo's cloud-assembly-api bump (introduced the conflict): aws/aws-cdk#37774 - Original Node compat pin: aws#61 --- By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license --------- Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NPM has a bug where if a package is used as a bundled dependency at multiple levels in a dependency tree, the containing package cannot be itself used as a bundled dependency.
For us, this manifests because
If then
aws-cdk-libis itself declared as a bundled depencency, NPM errors out duringnpm install.Testing shows that this only happens if the same dependency is bundled multiple times; if the bundled dependencies are different it seems to work out.
We fix this by making sure that dependencies that are bundled by
aws-cdk-libitself are not bundled by any of its dependencies. Werm -rfthem from the nested dependency tree.Fixes #37717.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license