Missing dependencies on pages that need a Netlify function

embarrassment-setup · June 7, 2021, 9:17pm

Ok this is a surprising outcome:

github.com/aws/aws-sdk-js-v3

Use of vulnerable, deprecated, and unmaintained packages in @aws-sdk-middleware-retry

opened 08:02PM - 16 Dec 20 UTC

closed 04:55PM - 09 Apr 21 UTC

ebickle

dependencies

**Describe the bug** The `@aws-sdk-middleware-retry` library has multiple sig…nificant dependency issues, all related to the package `react-native-get-random-values@1.5.0`: - `react-native-get-random-values@1.5.0` depends on 9 other packages that are marked as deprecated in NPM. - `react-native-get-random-values` depends on `react-native`. Having `react` and `react-native` as a core dependency of `@aws-sdk` is inappropriate - `react` is a client-side component and `react-native` is focused around native app development. In our case, we're using `@aws-sdk` entirely on the server side. - `react-native-get-random-values` and `react-native` have extremely deep dependency trees, creating significant risk to applications that need to call AWS services. Installing `@aws-sdk` version 3.0.0 resulted in 753 new packages that weren't present in version 2.X. - `react-native-get-random-values` depends on a library that contains a security vulnerability. In my case I installed `@aws-sdk/client-kms` and ended up with 10 security vulnerabilities. Deprecated packages via `react-native-get-random-values` in `@aws-sdk-middleware-retry@3.0.0`: - `urix@0.1.0` - `resolve-url@0.2.1` - `fsevents@1.2.13` - `@hapi/topo@3.1.6` - `@hapi/bourne@1.3.2` - `@hapi/address@2.1.4` - `@hapi/hoek@8.5.1` - `@hapi/joi@15.1.1` - `core-js@2.6.12` Vulnerable packages via `react-native-get-random-values` in `@aws-sdk-middleware-retry@3.0.0`: - `node-fetch@2.6.1` **SDK version number** > 3.0.0 **Is the issue in the browser/Node.js/ReactNative?** N/A. Issue is during package installation via NPM. **Details of the browser/Node.js/ReactNative version** > node -v > v14.15.1 **To Reproduce (observed behavior)** 1. `npm install @aws-sdk/client-kms` **Expected behavior** 1. @aws-sdk should not install packages with known security vulnerabilities. 2. @aws-sdk should not depend on any deprecated packages. 3. @aws-sdk should not depend on react, react-native, or other UI-specific third-party packages. **Console Log** > npm install @aws-sdk/client-kms > npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated > npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated > npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2. > npm WARN deprecated @hapi/topo@3.1.6: This version has been deprecated and is no longer supported or maintained > npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained > npm WARN deprecated @hapi/address@2.1.4: Moved to 'npm install @sideway/address' > npm WARN deprecated @hapi/hoek@8.5.1: This version has been deprecated and is no longer supported or maintained > npm WARN deprecated @hapi/joi@15.1.1: Switch to 'npm install joi' > npm WARN deprecated core-js@2.6.12: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3. > > added 753 packages, changed 3 packages, and audited 1064 packages in 1m > > 10 low severity vulnerabilities

which I found from: Request must be smaller than 69905067 bytes for the CreateFunction

❯ yarn why react-native-get-random-values
yarn why v1.22.10
[1/4] 🤔  Why do we have the module "react-native-get-random-values"...?
[2/4] 🚚  Initialising dependency graph...
[3/4] 🔍  Finding dependency...
[4/4] 🚡  Calculating file sizes...
=> Found "react-native-get-random-values@1.7.0"
info Reasons this module exists
   - "_project_#@resistbot#site#@netlify#plugin-nextjs#@sls-next#lambda-at-edge#@aws-sdk#client-s3#@aws-sdk#middleware-retry" depends on it
   - Hoisted from "_project_#@resistbot#site#@netlify#plugin-nextjs#@sls-next#lambda-at-edge#@aws-sdk#client-s3#@aws-sdk#middleware-retry#react-native-get-random-values"
info Disk size without dependencies: "104KB"
info Disk size with unique dependencies: "120KB"
info Disk size with transitive dependencies: "120KB"
info Number of shared dependencies: 1
✨  Done in 1.06s.

Super unfortunate that this dependency is likely out of reach for you too. But perhaps you can nudge the AWS folks to reconsider this dependency, I’m a bit surprised how widespread it’s chaos is.

I just removed these (the netlify plugins) from my own package.json and the problem still exists (but at least I don’t have react-native-get-random-values in dependencies anymore). Failing now on react-native:

❯ yarn why react-native
yarn why v1.22.10
[1/4] 🤔  Why do we have the module "react-native"...?
[2/4] 🚚  Initialising dependency graph...
[3/4] 🔍  Finding dependency...
error We couldn't find a match!
✨  Done in 0.94s.

4:10:43 PM:   Error message
4:10:43 PM:   A Netlify Function failed to require one of its dependencies.
4:10:43 PM:   Please make sure it is present in the site's top-level "package.json".

4:10:43 PM:   In file "/opt/build/repo/packages/site/netlify/functions/next_index/next_index.js"
4:10:43 PM:   Cannot find module 'react-native'

Topic		Replies	Views
"Dependencies installation error" on Netlify but successful build locally Support deployment , nextjs	1	1489	May 7, 2021
I just updated to gatsby-plugin image and made some necessary package upgrades with gatsbyjs and have no issues locally but Netlify is having issues deploying my site in staging Support deployment , gatsby	4	652	May 28, 2022
Gatsby deploy failing as it requires a later version of Node.js Support building , deployment , gatsby	1	542	February 2, 2022
Dependencies installation error	1	3260	March 8, 2022
Dependencies installation error @netlify/plugin-nextjs@4.3.1 Support deployment , nextjs	1	567	March 30, 2022

Missing dependencies on pages that need a Netlify function

Related topics