npm reported bugs in outdated dependency (strnum/fast-xml-parser)

[vyconm]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

the dependency fast-xml-parser needs to be updated in order to fix one of its dependencies (strnum).

Warning The following packages are deprecated:
┖─ npm:strnum@1.1.0 (This version introduces bugs)

project@0.1.0 /Users/redacted/VSCode/project/front
├─┬ @aws-sdk/client-cognito-identity-provider@3.760.0 -> ./node_modules/.deno/@aws-sdk+client-cognito-identity-provider@3.760.0/node_modules/@aws-sdk/client-cognito-identity-provider
│ └─┬ @aws-sdk/core@3.758.0 -> ./node_modules/.deno/@aws-sdk+core@3.758.0/node_modules/@aws-sdk/core
│   └─┬ fast-xml-parser@4.4.1 -> ./node_modules/.deno/fast-xml-parser@4.4.1/node_modules/fast-xml-parser
│     └── strnum@1.1.0 deduped -> ./node_modules/.deno/strnum@1.1.0/node_modules/strnum
├─┬ cognito-srp-helper@2.3.3 -> ./node_modules/.deno/cognito-srp-helper@2.3.3/node_modules/cognito-srp-helper
│ └─┬ @aws-sdk/client-cognito-identity-provider@3.750.0 -> ./node_modules/.deno/@aws-sdk+client-cognito-identity-provider@3.750.0/node_modules/@aws-sdk/client-cognito-identity-provider
│   └─┬ @aws-sdk/core@3.750.0 -> ./node_modules/.deno/@aws-sdk+core@3.750.0/node_modules/@aws-sdk/core
│     └─┬ fast-xml-parser@4.4.1 -> ./node_modules/.deno/fast-xml-parser@4.4.1/node_modules/fast-xml-parser
│       └── strnum@1.1.0 deduped -> ./node_modules/.deno/strnum@1.1.0/node_modules/strnum
└─┬ typescript@5.8.2 invalid: "~5.2.2" from node_modules/.deno/@aws-sdk+client-cognito-identity-provider@3.760.0/node_modules/@aws-sdk/client-cognito-identity-provider, "~4.2.4" from node_modules/.deno/@unovis+svelte@1.5.1/node_modules/@unovis/svelte, "5.6.3" from node_modules/.deno/ai@4.1.54/node_modules/ai, "^4.8.4" from node_modules/.deno/cognito-srp-helper@2.3.3/node_modules/cognito-srp-helper, "^2.8.3" from node_modules/.deno/dayjs@1.11.13/node_modules/dayjs, "5.1.3" from node_modules/.deno/prettier-plugin-svelte@3.3.3/node_modules/prettier-plugin-svelte, "^4.8 <4.9" from node_modules/.deno/svelte-moveable@0.45.0/node_modules/svelte-moveable, "5.6.3" from node_modules/.deno/tailwind-variants@0.3.1/node_modules/tailwind-variants -> ./node_modules/.deno/typescript@5.8.2/node_modules/typescript
  └─┬ fast-xml-parser@4.4.1 invalid: "^4.5.1" from node_modules/.deno/typescript@5.8.2/node_modules/typescript, "^4.5.1" from node_modules/.deno/typescript@5.8.2/node_modules/typescript, "^4.5.1" from node_modules/.deno/typescript@5.8.2/node_modules/typescript, "^4.5.1" from node_modules/.deno/typescript@5.8.2/node_modules/typescript, "^4.5.1" from node_modules/.deno/typescript@5.8.2/node_modules/typescript -> ./node_modules/.deno/fast-xml-parser@4.4.1/node_modules/fast-xml-parser
    └── strnum@1.1.0 -> ./node_modules/.deno/strnum@1.1.0/node_modules/strnum

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/package-name@version, ...

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

deno 2.2.3 / node v23.9.0

Reproduction Steps

install @aws-sdk/client-cognito-identity-provider@3.750.0 and its dependencies using any package manager.

Observed Behavior

Warning The following packages are deprecated:
┖─ npm:strnum@1.1.0 (This version introduces bugs)

This is also reported on npm.

https://www.npmjs.com/package/strnum/v/1.1.0

Expected Behavior

No warnings. ;)

Possible Solution

Update fast-xml-parser dependency.

Additional Information/Context

No response

[timtucker-dte]

Looks like the new 5.x series is backward compatible but adds ESM support and 5.0.8 updates the strnum dependency:
https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md

[aBurmeseDev]

Hi @vyconm - thanks for reporting this.
I wasn't able to reproduce this error by installing client with npm, yarn, and pnpm. Before further investigation, could you confirm if you're seeing this specifically in Deno?
strnum@1.1.0 -> ./node_modules/.deno/strnum@1.1.0/node_modules/strnum

[vyconm]

@aBurmeseDev we are indeed using deno, which maybe more strictly follows dependency versioning than yarn or npm.

The issue is flagged on npm though, and even more bugs have been fixed in recent versions of strnum.

https://www.npmjs.com/package/strnum/v/1.1.0