@aws-sdk/credential-provider-node doesn't provide @aws-sdk/client-sts about aws-sdk-js-v3

[trivikr]

If you have a minimal repro, please post it in the issue comments. I'll also post my attempts in reproducing.
It'll help identify in which version it was introduced. We suspect it was introduced in either v3.564.0 or v3.565.0

The current workaround is to pin your client dependency to <3.564.0 in package.json as follows:

   "client-dynamodb": "<3.564.0",

[trivikr]

I'm not able to repro with this simple commands in a new workspace, and dependencies are installed

$ node -v
v20.12.2

$ corepack enable && yarn set version 4.2.1

$ yarn init -y && yarn add @aws-sdk/[email protected] --exact

[trivikr]

Minimal repro with [email protected] shows warnings

$ corepack enable && yarn set version 3.5.0

$ yarn init -y && yarn add @aws-sdk/[email protected] --exact
...
➤ YN0000: ┌ Resolution step
➤ YN0002: │ @aws-sdk/credential-provider-node@npm:3.567.0 doesn't provide @aws-sdk/client-sts (pd83b4), requested by @aws-sdk/credential-provider-web-identity
➤ YN0002: │ @aws-sdk/credential-provider-node@npm:3.567.0 doesn't provide @aws-sdk/client-sts (p294b1), requested by @aws-sdk/credential-provider-ini
➤ YN0002: │ @aws-sdk/credential-provider-sso@npm:3.567.0 doesn't provide @aws-sdk/client-sso-oidc (pb330e), requested by @aws-sdk/token-providers
➤ YN0000: │ Some peer dependencies are incorrectly met; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code
➤ YN0000: └ Completed in 0s 805ms
...

Not reproducible with 3.563.0

[trivikr]

The warning is shown in [email protected] as direct dependency of client-sts was removed in #6028. The dependency was removed because other clients were not using it directly. The dependency, however, is required in some default credential providers like credential-provider-web-identity or credential-provider-ini.

In those credential providers, the dependency is added as a peerDependency to avoid circular dependency issue. This is not a problem for majority users, since most of the requests sent on JS SDK do not use those credential providers. For other users, most of them use npm 7+ which automatically installs peerDependencies.

However, it would be a problem for certain package managers where peerDependencies are not automatically installed (like yarn modern) and there's no workaround to install those peerDependencies (like yarn classic).

We're exploring re-adding the direct dependencies on clients.

[conico974]

@trivikr It can also cause issue if you set auto-install-peers=false in .npmrc
Also in some cases in CI, it seems that npx also doesn't install peer dependencies which make CI fail.

[trivikr]

We're exploring re-adding the direct dependencies on clients.

PR posted at #6055

[trivikr]

PR posted at #6055

PR is merged, and the fix is expected to be published in https://github.com/aws/aws-sdk-js-v3/releases/tag/v3.569.0 around 12:30 PM Pacific on Friday, May 3.

Reopening this issue for verification post publish.