npm missing dependencies with aws-amplify/backend library

[TommyEsteban]

Environment information

System:
  OS: Linux 6.12 openSUSE Leap 16.0
  CPU: (12) x64 Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
  Memory: 7.25 GB / 31.15 GB
  Shell: /bin/bash
Binaries:
  Node: 22.22.2 - /home/tommy/.nvm/versions/node/v22.22.2/bin/node
  Yarn: undefined - undefined
  npm: 10.9.7 - /home/tommy/.nvm/versions/node/v22.22.2/bin/npm
  pnpm: undefined - undefined
NPM Packages:
  @aws-amplify/auth-construct: 1.11.2
  @aws-amplify/backend: 1.22.0
  @aws-amplify/backend-ai: Not Found
  @aws-amplify/backend-auth: 1.9.3
  @aws-amplify/backend-cli: 1.8.2
  @aws-amplify/backend-data: 1.6.4
  @aws-amplify/backend-deployer: 2.1.6
  @aws-amplify/backend-function: 1.18.0
  @aws-amplify/backend-output-schemas: 1.8.0
  @aws-amplify/backend-output-storage: 1.3.4
  @aws-amplify/backend-secret: 1.4.2
  @aws-amplify/backend-storage: 1.4.3
  @aws-amplify/cli-core: 2.2.4
  @aws-amplify/client-config: 1.10.1
  @aws-amplify/data-construct: 1.17.1
  @aws-amplify/data-schema: 1.25.4
  @aws-amplify/deployed-backend-client: 1.8.1
  @aws-amplify/form-generator: 1.2.6
  @aws-amplify/model-generator: 1.2.2
  @aws-amplify/platform-core: 1.11.0
  @aws-amplify/plugin-types: 1.12.0
  @aws-amplify/sandbox: 2.2.0
  @aws-amplify/schema-generator: 1.4.1
  @aws-cdk/toolkit-lib: 1.16.0
  aws-amplify: 6.16.3
  aws-cdk-lib: 2.247.0
  typescript: 5.9.3
No AWS environment variables
No CDK environment variables

Describe the bug

After installed the library aws-amplify/backend, npm ci command fails with multiple not found dependency errors. I tried node 20,22, and 25; npm 9, 10, and 11. Also running npm ci with --legacy-peer-deps option.

npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @aws-amplify/backend-output-schemas@1.8.0
npm warn Found: zod@3.25.17
npm warn node_modules/@aws-amplify/data-construct/node_modules/@aws-amplify/backend-output-schemas/node_modules/zod
npm warn
npm warn Could not resolve dependency:
npm warn peer zod@"3.25.17" from @aws-amplify/backend-output-schemas@1.8.0
npm warn node_modules/@aws-amplify/data-construct/node_modules/@aws-amplify/backend-output-schemas
npm warn bundled @aws-amplify/backend-output-schemas@"^1.0.0" from @aws-amplify/data-construct@1.17.1
npm warn node_modules/@aws-amplify/data-construct
npm warn 2 more (@aws-amplify/ai-constructs, @aws-amplify/backend-output-storage)
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @aws-amplify/backend-output-schemas@1.8.0
npm warn Found: zod@3.25.17
npm warn node_modules/@aws-amplify/graphql-api-construct/node_modules/@aws-amplify/backend-output-schemas/node_modules/zod
npm warn
npm warn Could not resolve dependency:
npm warn peer zod@"3.25.17" from @aws-amplify/backend-output-schemas@1.8.0
npm warn node_modules/@aws-amplify/graphql-api-construct/node_modules/@aws-amplify/backend-output-schemas
npm warn bundled @aws-amplify/backend-output-schemas@"^1.0.0" from @aws-amplify/graphql-api-construct@1.21.1
npm warn node_modules/@aws-amplify/graphql-api-construct
npm warn 2 more (@aws-amplify/ai-constructs, @aws-amplify/backend-output-storage)
npm error code EUSAGE
npm error
npm error npm ci can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with npm install before continuing.
npm error
npm error Missing: json-schema-to-ts@3.1.1 from lock file
npm error Missing: ts-algebra@2.0.0 from lock file
npm error Missing: @aws-sdk/eventstream-handler-node@3.821.0 from lock file
npm error Missing: @aws-sdk/middleware-eventstream@3.821.0 from lock file
npm error Missing: @aws-sdk/types@3.821.0 from lock file
npm error Missing: @aws-sdk/types@3.821.0 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@5.4.1 from lock file
npm error Missing: strnum@2.2.2 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@5.2.5 from lock file
npm error Missing: strnum@2.2.2 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@5.4.1 from lock file
npm error Missing: strnum@2.2.2 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error Missing: fast-xml-parser@5.2.5 from lock file
npm error Missing: strnum@2.2.2 from lock file
npm error Missing: fast-xml-parser@4.4.1 from lock file
npm error
npm error Clean install a project
npm error
npm error Usage:
npm error npm ci
npm error
npm error Options:
npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
npm error [--no-bin-links] [--no-fund] [--dry-run]
npm error [-w|--workspace [-w|--workspace ...]]
npm error [-ws|--workspaces] [--include-workspace-root] [--install-links]
npm error
npm error aliases: clean-install, ic, install-clean, isntall-clean
npm error
npm error Run "npm help ci" for more info
npm error A complete log of this run can be found in: /home/tommy/.npm/_logs/2026-04-02T16_20_58_531Z-debug-0.log

Reproduction steps

1. run the following command to delete node_modules, and package.json files
   rm -rf node_modules package-lock.json

2. run the following command to install dependencies
   npm install

3. delete the node_modules folder
   rm -rf node_modules

4. Run the command to deploy
   npm ci

[jeremy303]

Still trying to wrap my head around what's happening here, but for me it seems like this the cascade was triggered when graphql released v15.10.2, which lead npm to strip away graphql@15.10.1 from the bundled dependencies.

Would dropping use of bundledDependencies for @aws-amplify/ packages fix this?

Any temporary work arounds other then keeping our old package lock and making surgical edits for any packages we need to update?

[svidgen]

The bundled dependencies are required for JSII. Candidate fix is here. I still need to E2E tests and PR checks passing on it. But, it's a WIP.

[michaelgiraldo]

@jeremy303 @TommyEsteban @svidgen

this work around worked for me

Run npm install --package-lock-only first. This step is required to refresh package-lock.json in the way needed to keep downstream npm ci working correctly.