(aws-cdk): Using aws-cdk in another package breaks the dependencies

[adriantaut]

Describe the bug

Hello,

Some time ago we developed an in-house Node module that automatically synthesized/deployed some CDK stacks based on a single string input naming the product developers want to deploy.

This module basically makes use of aws-cdk CLI to synth/deploy programatically.

the package.json looks something like:

  "dependencies": {
    ........
    "aws-cdk": "^1.153.0",
    .........
  }

This is the list of devDependencies/dependencies for the aws-cdk package, however for some reason the npm install moves all dependencies in the devDependencies according to node_modules/aws-cdk-package.json:

{
  "name": "aws-cdk",
  "description": "CDK Toolkit, the command line tool for CDK apps",
  "version": "1.154.0",
  "main": "lib/index.js",
  "types": "lib/index.d.ts",
  "bin": {
    "cdk": "bin/cdk"
  },
  "scripts": {
    "build": "cdk-build",
    "watch": "cdk-watch",
    "lint": "cdk-lint",
    "pkglint": "pkglint -f",
    "test": "cdk-test",
    "integ": "jest --testMatch '**/?(*.)+(integ-test).js'",
    "package": "cdk-package",
    "build+test+package": "yarn build+test && yarn package",
    "build+test": "yarn build && yarn test",
    "integ-cli": "npm run integ-cli-regression && npm run integ-cli-no-regression",
    "integ-cli-regression": "npm run integ-cli-regression-latest-release && npm run integ-cli-regression-latest-code",
    "integ-cli-regression-latest-release": "test/integ/run-against-dist test/integ/test-cli-regression-against-latest-release.sh",
    "integ-cli-regression-latest-code": "test/integ/run-against-dist test/integ/test-cli-regression-against-current-code.sh",
    "integ-cli-no-regression": "test/integ/run-against-repo test/integ/cli/test.sh",
    "integ-init": "test/integ/run-against-dist test/integ/init/test-all.sh",
    "gen": "./generate.sh",
    "build+extract": "yarn build",
    "build+test+extract": "yarn build+test"
  },
  "cdk-package": {
    "bundle": {
      "externals": {
        "optionalDependencies": [
          "fsevents"
        ]
      },
      "resources": {
        "../../node_modules/vm2/lib/bridge.js": "lib/bridge.js",
        "../../node_modules/vm2/lib/setup-sandbox.js": "lib/setup-sandbox.js"
      },
      "allowedLicenses": [
        "Apache-2.0",
        "MIT",
        "BSD-3-Clause",
        "ISC",
        "BSD-2-Clause",
        "0BSD"
      ],
      "dontAttribute": "^@aws-cdk/|^cdk-assets$|^cdk-cli-wrapper$",
      "test": "bin/cdk --version"
    }
  },
  "author": {
    "name": "Amazon Web Services",
    "url": "https://aws.amazon.com",
    "organization": true
  },
  "license": "Apache-2.0",
  "devDependencies": {
    "@aws-cdk/core": "1.154.0",
    "@octokit/rest": "^18.12.0",
    "@types/archiver": "^5.3.1",
    "@types/fs-extra": "^8.1.2",
    "@types/glob": "^7.2.0",
    "@types/jest": "^27.4.1",
    "@types/minimatch": "^3.0.5",
    "@types/mockery": "^1.4.30",
    "@types/node": "^10.17.60",
    "@types/promptly": "^3.0.2",
    "@types/semver": "^7.3.9",
    "@types/sinon": "^9.0.11",
    "@types/table": "^6.0.0",
    "@types/uuid": "^8.3.4",
    "@types/wrap-ansi": "^3.0.0",
    "@types/yargs": "^15.0.14",
    "aws-sdk-mock": "5.6.0",
    "@aws-cdk/cdk-build-tools": "1.154.0",
    "constructs": "^3.3.69",
    "jest": "^27.5.1",
    "madge": "^5.0.1",
    "make-runnable": "^1.3.10",
    "mockery": "^2.1.0",
    "nock": "^13.2.4",
    "@aws-cdk/pkglint": "1.154.0",
    "sinon": "^9.2.4",
    "ts-jest": "^27.1.4",
    "ts-mock-imports": "^1.3.8",
    "xml-js": "^1.6.11",
    "axios": "^0.26.1",
    "@aws-cdk/cloud-assembly-schema": "1.154.0",
    "@aws-cdk/cloudformation-diff": "1.154.0",
    "@aws-cdk/cx-api": "1.154.0",
    "@aws-cdk/region-info": "1.154.0",
    "@jsii/check-node": "1.56.0",
    "archiver": "^5.3.0",
    "aws-sdk": "^2.1093.0",
    "camelcase": "^6.3.0",
    "cdk-assets": "1.154.0",
    "chokidar": "^3.5.3",
    "chalk": "^4",
    "decamelize": "^5.0.1",
    "fs-extra": "^9.1.0",
    "glob": "^7.2.0",
    "json-diff": "^0.7.3",
    "minimatch": ">=3.1",
    "promptly": "^3.2.0",
    "proxy-agent": "^5.0.0",
    "semver": "^7.3.6",
    "source-map-support": "^0.5.21",
    "strip-ansi": "^6.0.1",
    "table": "^6.8.0",
    "uuid": "^8.3.2",
    "wrap-ansi": "^7.0.0",
    "yaml": "1.10.2",
    "yargs": "^16.2.0"
  },
  "dependencies": {},
  "repository": {
    "url": "https://github.com/aws/aws-cdk.git",
    "type": "git",
    "directory": "packages/aws-cdk"
  },
  "keywords": [
    "aws",
    "cdk"
  ],
  "homepage": "https://github.com/aws/aws-cdk",
  "engines": {
    "node": ">= 10.13.0 <13 || >=13.7.0"
  },
  "nozem": {
    "ostools": [
      "git",
      "date",
      "cat",
      "dotnet",
      "mvn",
      "npm"
    ],
    "env": {
      "CODEBUILD_RESOLVED_SOURCE_VERSION": "|nzm-build"
    }
  },
  "stability": "stable",
  "maturity": "stable",
  "publishConfig": {
    "tag": "latest-1"
  },
  "optionalDependencies": {
    "fsevents": "2.3.2"
  }
}

Further one, when the in-house Node module is installed on another machine, it does not fetch any of the initial dependencies, thus gracefully complains about not finding the modules

$ cdk-deployer-tool-ppb --version
Error: Cannot find module 'semver'

Any idea why this is happening with the recent versions of aws-cdk and how to mitigate this?

Expected Behavior

Installing the aws-cdk as a dependency in another module should keep the difference between dependencies / devDependencies, and not merging all of them together.

Current Behavior

Reproduction Steps

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

1.154.0

Framework Version

No response

Node.js Version

v17.6.0

OS

macOS

Language

Typescript

Language Version

No response

Other information

No response

[tomas-mazak]

+1, it would be great to keep an option to use CDK programmatically

[rix0rrr]

You can use the CDK programmatically by shelling out to the CLI. We don't currently support using the CLI package directly from Node.js.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.