Intermittent ETARGET Errors When Resolving Dependencies for @aws-sdk Packages

[ryanwarsaw]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

I’ve encountered intermittent ETARGET errors when resolving dependencies for @aws-sdk packages. It appears to be caused by a mismatch in package publishing and dependency resolution. Specifically, AWS SDK packages reference other workspace packages using *, which appears to take the latest version. In some cases, this results in dependencies referencing versions that haven’t yet been published to npmjs.com.

Here’s an example of the issue:

➜ npm ls @aws-sdk/credential-provider-ini
<redacted>
└─┬ @aws-sdk/client-secrets-manager@3.803.0
  └─┬ @aws-sdk/credential-provider-node@3.803.0
    └── @aws-sdk/credential-provider-ini@3.803.0
@aws-sdk/client-secrets-manager published 4 hours ago
@aws-sdk/credential-provider-node published 3 hours ago
@aws-sdk/credential-provider-ini published 3 hours ago

From the above, @aws-sdk/client-secrets-manager is published earlier and references exact versions of @aws-sdk/credential-provider-node and @aws-sdk/credential-provider-ini that haven’t been published yet. This creates a window of time where dependency resolution breaks.

Relevant package.json files:

• @aws-sdk/client-secrets-manager
• @aws-sdk/credential-provider-node
• @aws-sdk/credential-provider-ini

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/client-secrets-manager@3.803.0

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

18.20.8

Reproduction Steps

I'm not sure what causes the delay for some packages when publishing. But that delay is when this issue would present itself.

Observed Behavior

npm error code ETARGET
npm error notarget No matching version found for @aws-sdk/credential-provider-ini@3.803.0.
npm error notarget In most cases you or one of your dependencies are requesting
npm error a package version that doesn't exist.

Expected Behavior

Dependency resolution to complete successfully.

Possible Solution

Sequence package publishing so that dependencies are published before the packages that consume them.

Additional Information/Context

No response

[kuhe]

The packages are published to NPM with explicit versions and not *, which is only a monorepo convention in the source code.

The versions can be checked https://www.npmjs.com/package/@aws-sdk/client-secrets-manager?activeTab=code in NPM or after installing.

Our workspace manager lerna also publishes things in topological order to avoid this.

https://www.npmjs.com/package/@aws-sdk/client-secrets-manager v3.803.0 shows that it was published at 5/5 X:40pm
https://www.npmjs.com/package/@aws-sdk/credential-provider-node v3.803.0 shows that it was published at 5/5 X:32pm

This order is correct based on the dependency graph. Are you using an NPM registry or internal mirror that copies packages in a different order?

[ryanwarsaw]

@kuhe I don't know how else to explain this... yesterday when I was reviewing the package publish times I was doing so using npmjs.com looking at the publish times for each page, and at that point they were out of order. Now today, that is no longer the case and they are in the correct order. I'll keep an eye on changes that get merged in, to see if I can actually document this.

Looking at the publish times for all 3 packages, on npmjs.com I see the following:

~ via ⬢ v22.1.0
➜ npm show @aws-sdk/client-secrets-manager@3.803.0 time --registry=https://registry.npmjs.com | grep 3.803.0
⠦  '3.803.0': '2025-05-05T19:40:18.078Z'

~ via ⬢ v22.1.0 took 2.1s
➜ npm show @aws-sdk/credential-provider-node@3.803.0 time --registry=https://registry.npmjs.com | grep 3.803.0
⠴  '3.803.0': '2025-05-05T19:32:29.676Z'

~ via ⬢ v22.1.0 took 2.1s
➜ npm show @aws-sdk/credential-provider-ini@3.803.0 time --registry=https://registry.npmjs.com | grep 3.803.0
⠴  '3.803.0': '2025-05-05T19:32:29.284Z'

One thing I wanted to highlight is there is only 392 milliseconds between the releases of @aws-sdk/credential-provider-node and @aws-sdk/credential-provider-ini, while it doesn't explain the nearly one hour delay that I observed, I do find it to be a suspiciously short amount of time between package publishes. WDYT?

[kuhe]

392ms doesn't seem unusual to me. That is enough time for our release process to publish @aws-sdk/credential-provider-node, receive the response from NPM, and then publish the dependent package @aws-sdk/credential-provider-ini.

Our release process often publishes upwards of 500 packages in a 10 minute window.

The 4 or 3 hours ago thing seems to be rounded, so for some small window when you ask for the times, one can report as 4 hours and one as 3 hours.

[github-actions]

This issue has not received a response in 1 week. If you still think there is a problem, please leave a comment to avoid the issue from automatically closing.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.