Specifying a version to install requires newer dependencies than specified, which breaks on older systems

[nabeards]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

I have a legacy project that requires node version 14. I know this version is no longer officially supported, but this is actually an issue with just installation, not use. Installing the last version of the SDK that supports nodejs version 14 doesn't work due to dependency issues.

Install and resulting error:
yarn add @aws-sdk/client-sts@3.565
error @aws-sdk/types@3.804.0: The engine "node" is incompatible with this module. Expected version ">=18.0.0". Got "14.18.1"

I installed that same version into another project using a later nodejs version, and found that multiple dependencies somehow force-require later versions (3.804). Below is the full module dependency tree. For example, you'll see that later versions of lower dependencies are being required, client-sts@3.804, types@3.804, core@3.804, etc. I would expect installing a specific version would work.

└─┬ @aws-sdk/client-s3@3.565.0
  └─┬ @aws-sdk/credential-provider-node@3.565.0
    ├─┬ @aws-sdk/credential-provider-ini@3.565.0
    │ └─┬ @aws-sdk/client-sts@3.804.0
    │   ├─┬ @aws-crypto/sha256-browser@5.2.0
    │   │ ├─┬ @aws-crypto/util@5.2.0
    │   │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-crypto/sha256-js@5.2.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-sdk/core@3.804.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-sdk/credential-provider-node@3.804.0
    │   │ ├─┬ @aws-sdk/credential-provider-env@3.804.0
    │   │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ ├─┬ @aws-sdk/credential-provider-http@3.804.0
    │   │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ ├─┬ @aws-sdk/credential-provider-ini@3.804.0
    │   │ │ ├─┬ @aws-sdk/nested-clients@3.804.0
    │   │ │ │ ├─┬ @aws-crypto/sha256-browser@5.2.0
    │   │ │ │ │ ├─┬ @aws-crypto/util@5.2.0
    │   │ │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├─┬ @aws-crypto/sha256-js@5.2.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├─┬ @aws-sdk/core@3.804.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├─┬ @aws-sdk/middleware-host-header@3.804.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├─┬ @aws-sdk/middleware-logger@3.804.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├─┬ @aws-sdk/middleware-recursion-detection@3.804.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├─┬ @aws-sdk/middleware-user-agent@3.804.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├─┬ @aws-sdk/region-config-resolver@3.804.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├── @aws-sdk/types@3.804.0
    │   │ │ │ ├─┬ @aws-sdk/util-endpoints@3.804.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ ├─┬ @aws-sdk/util-user-agent-browser@3.804.0
    │   │ │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ │ └─┬ @aws-sdk/util-user-agent-node@3.804.0
    │   │ │ │   └── @aws-sdk/types@3.804.0 deduped
    │   │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ ├─┬ @aws-sdk/credential-provider-process@3.804.0
    │   │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ ├─┬ @aws-sdk/credential-provider-sso@3.804.0
    │   │ │ ├─┬ @aws-sdk/client-sso@3.804.0
    │   │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ ├─┬ @aws-sdk/token-providers@3.804.0
    │   │ │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ ├─┬ @aws-sdk/credential-provider-web-identity@3.804.0
    │   │ │ └── @aws-sdk/types@3.804.0 deduped
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-sdk/middleware-host-header@3.804.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-sdk/middleware-logger@3.804.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-sdk/middleware-recursion-detection@3.804.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-sdk/middleware-user-agent@3.804.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-sdk/region-config-resolver@3.804.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├── @aws-sdk/types@3.804.0
    │   ├─┬ @aws-sdk/util-endpoints@3.804.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   ├─┬ @aws-sdk/util-user-agent-browser@3.804.0
    │   │ └── @aws-sdk/types@3.804.0 deduped
    │   └─┬ @aws-sdk/util-user-agent-node@3.804.0
    │     └── @aws-sdk/types@3.804.0 deduped
    └─┬ @aws-sdk/credential-provider-sso@3.565.0
      └─┬ @aws-sdk/token-providers@3.565.0
        └─┬ @aws-sdk/client-sso-oidc@3.804.0
          ├─┬ @aws-crypto/sha256-browser@5.2.0
          │ ├─┬ @aws-crypto/util@5.2.0
          │ │ └── @aws-sdk/types@3.804.0 deduped
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-crypto/sha256-js@5.2.0
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-sdk/core@3.804.0
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-sdk/credential-provider-node@3.804.0
          │ ├─┬ @aws-sdk/credential-provider-env@3.804.0
          │ │ └── @aws-sdk/types@3.804.0 deduped
          │ ├─┬ @aws-sdk/credential-provider-http@3.804.0
          │ │ └── @aws-sdk/types@3.804.0 deduped
          │ ├─┬ @aws-sdk/credential-provider-ini@3.804.0
          │ │ └── @aws-sdk/types@3.804.0 deduped
          │ ├─┬ @aws-sdk/credential-provider-process@3.804.0
          │ │ └── @aws-sdk/types@3.804.0 deduped
          │ ├─┬ @aws-sdk/credential-provider-sso@3.804.0
          │ │ ├─┬ @aws-sdk/client-sso@3.804.0
          │ │ │ └── @aws-sdk/types@3.804.0 deduped
          │ │ ├─┬ @aws-sdk/token-providers@3.804.0
          │ │ │ └── @aws-sdk/types@3.804.0 deduped
          │ │ └── @aws-sdk/types@3.804.0 deduped
          │ ├─┬ @aws-sdk/credential-provider-web-identity@3.804.0
          │ │ └── @aws-sdk/types@3.804.0 deduped
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-sdk/middleware-host-header@3.804.0
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-sdk/middleware-logger@3.804.0
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-sdk/middleware-recursion-detection@3.804.0
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-sdk/middleware-user-agent@3.804.0
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-sdk/region-config-resolver@3.804.0
          │ └── @aws-sdk/types@3.804.0 deduped
          ├── @aws-sdk/types@3.804.0
          ├─┬ @aws-sdk/util-endpoints@3.804.0
          │ └── @aws-sdk/types@3.804.0 deduped
          ├─┬ @aws-sdk/util-user-agent-browser@3.804.0
          │ └── @aws-sdk/types@3.804.0 deduped
          └─┬ @aws-sdk/util-user-agent-node@3.804.0
            └── @aws-sdk/types@3.804.0 deduped

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/client-s3@3.565

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

node v14.18.1

Reproduction Steps

nvm use 14
npm i yarn
yarn add @aws-sdk/client-s3@3.565

error @aws-sdk/types@3.804.0: The engine "node" is incompatible with this module. Expected version ">=18.0.0". Got "14.18.1"

Observed Behavior

error @aws-sdk/types@3.804.0: The engine "node" is incompatible with this module. Expected version ">=18.0.0". Got "14.18.1"

Expected Behavior

Installing version 3.565 should successfully install with proper dependencies.

Possible Solution

No response

Additional Information/Context

No response

[zshzbh]

Please update your node version as the JS SDK v3 has dropped support for Node.js 14.x on May 1, 2024. PR

[nabeards]

@zshzbh As already stated: "I have a legacy project that requires node version 14. I know this version is no longer officially supported, but this is actually an issue with just installation, not use. Installing the last version of the SDK that supports nodejs version 14 doesn't work due to dependency issues."

Running the same install with Node 18 still installs the later versions of the packages, so specifying the version number is broken on later versions of node as well. Here's the wrong version install from node 18:

└─┬ @aws-sdk/client-s3@3.565.0
  ├─┬ @aws-crypto/sha1-browser@3.0.0
  │ ├─┬ @aws-crypto/util@3.0.0
  │ │ └── @aws-sdk/types@3.804.0
  │ └── @aws-sdk/types@3.804.0
  ├─┬ @aws-crypto/sha256-browser@3.0.0
  │ └── @aws-sdk/types@3.804.0
  ├─┬ @aws-crypto/sha256-js@3.0.0
  │ └── @aws-sdk/types@3.804.0
  └─┬ @aws-sdk/middleware-flexible-checksums@3.535.0
    ├─┬ @aws-crypto/crc32@3.0.0
    │ └── @aws-sdk/types@3.804.0
    └─┬ @aws-crypto/crc32c@3.0.0
      └── @aws-sdk/types@3.804.0

[zshzbh]

I think the one last try would be setting engine-strict=true .

---

If you insist to use Node 14, I just came up with a solution, it might be weird, but you can upgrade the node version to ">=18.0.0" and install the aws js sdk package, and use node version 14(I don't know if that's gonna work tho, if that's not working, it's not working, and we won't fix this because the support for Node.js 14.x has been dropped).

Still, I highly suggest to upgrade node version as node 14 has reached end of life in Feb 16, 2023 - https://nodejs.org/en/about/previous-releases

---

For node 18 installations -

Running the same install with Node 18 still installs the later versions of the packages, so specifying the version number is broken on later versions of node as well. Here's the wrong version install from node 18:

└─┬ @aws-sdk/client-s3@3.565.0
  ├─┬ @aws-crypto/sha1-browser@3.0.0
  │ ├─┬ @aws-crypto/util@3.0.0
  │ │ └── @aws-sdk/types@3.804.0
  │ └── @aws-sdk/types@3.804.0
  ├─┬ @aws-crypto/sha256-browser@3.0.0
  │ └── @aws-sdk/types@3.804.0
  ├─┬ @aws-crypto/sha256-js@3.0.0
  │ └── @aws-sdk/types@3.804.0
  └─┬ @aws-sdk/middleware-flexible-checksums@3.535.0
    ├─┬ @aws-crypto/crc32@3.0.0
    │ └── @aws-sdk/types@3.804.0
    └─┬ @aws-crypto/crc32c@3.0.0
      └── @aws-sdk/types@3.804.0

What error message did you see? Could you please post the error message here?

[nabeards]

@zshzbh thanks for the response.

engine-strict=true produces a similar error:

% npm i @aws-sdk/client-sts@3.565      
npm ERR! code ENOTSUP
npm ERR! notsup Unsupported engine for @aws-sdk/util-locate-window@3.804.0: wanted: {"node":">=18.0.0"} (current: {"node":"14.18.1","npm":"6.14.15"})
npm ERR! notsup Not compatible with your version of node/npm: @aws-sdk/util-locate-window@3.804.0
npm ERR! notsup Not compatible with your version of node/npm: @aws-sdk/util-locate-window@3.804.0
npm ERR! notsup Required: {"node":">=18.0.0"}
npm ERR! notsup Actual:   {"npm":"6.14.15","node":"14.18.1"}

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/nabeards/.npm/_logs/2025-05-08T08_59_58_233Z-debug.log

---

Regarding upgrading: Legacy projects can't just be upgraded to the latest version of node for convenience sake. It would be a major undertaking to rewrite the software to work with a newer version.

---

Regarding the Node 18 installation: there isn't an error per se, but you can see that it is still installing the latest versions of the tooling even when requesting a specific version of the software. If I request installation of version 3.565, I expect all of the dependencies to match that version. Instead, types@3.804 is still installed. This is the crux of the issue: if I want a specific version of the tooling, I should only get that version and not the latest dependencies.

---

The good news is that I think I found a solution. I had to manually install two packages with specific versions in order to get client-s3 to install, and I could not use yarn (so this is not a great solution since I'll have to do a lot of magic to get this to auto-install). But here's what I did nonetheless:

npm i @aws-sdk/types@3.535
npm i @aws-sdk/util-locate-window@3.535
npm i @aws-sdk/client-s3@3.565

As I said, the main issue is that requesting a specific version of client-s3 just doesn't work with dependencies. I would expect installing client-s3@3.565 would install only the matching dependencies of 3.565 (in other words, installed types@3.535 and util-locate-window@3.535 for me). It currently just installs the latest dependencies instead, breaking everything.

Another solution would be that the package here was using proper semver instead, but I don't see that happening. (Completely removing support for a specific node version should have moved the major release version number up from 3 to 4.)

[kuhe]

Edit: I posted this without the latest comment from @nabeards having loaded, a workaround was found.

---

This is because the @aws-crypto/* packages use a range of @aws-sdk/types.

Please work around this by adding an override for the @aws-sdk/types package used by the crypto packages. Either include @aws-sdk/types@<=3.565.0 in dependencies, or set

  "overrides": {
    "@aws-sdk/types": "<=3.565.0"
  },
  "resolutions": {
    "@aws-sdk/types": "<=3.565.0"
  },