Bug: `--build-in-source` appears to remove `devDependencies` in source `node_modules`

[cdriesler]

Description:

I'm using the --build-in-source flag to build a number of js/ts-based resources that share code in a "monorepo" shaped project. It has greatly simplified our ability to share and bundle code between lambdas with BuildMethod: esbuild. The project looks something like:

endpoints/
--endpoint-a/
packages/
--package-a/
node_modules/
package.json

We use npm workspaces in package.json to share code and types.

This may be expected behavior, but I've noticed that each time I run sam build --build-in-source (with or without --cached) our root node_modules loses all packages (including typescript) that are only specified in devDependencies. I have to re-run npm ci after each sam build in order to restore types and typescript commands.

Is there something that can be done to keep them around? Or, if this is expected/required, are there best practices for how to keep our devDependencies around?

Steps to reproduce:

• run npm i or npm ci to install dependencies and devDependencies specified in package.json
• run sam build --build-in-source and build a resource with BuildMethod: esbuild

Observed result:

My devDependencies are no longer in my project's node_modules. Specifically typescript, which is only ever specified there.

Expected result:

My devDependencies remain in my project's node_modules.

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

{
  "version": "1.105.0",
  "system": {
    "python": "3.8.17",
    "os": "Linux-6.2.0-1018-azure-x86_64-with-glibc2.2.5"
  },
  "additional_dependencies": {
    "docker_engine": "Not available",
    "aws_cdk": "Not available",
    "terraform": "Not available"
  },
  "available_beta_feature_env_vars": [
    "SAM_CLI_BETA_FEATURES",
    "SAM_CLI_BETA_BUILD_PERFORMANCE",
    "SAM_CLI_BETA_TERRAFORM_SUPPORT",
    "SAM_CLI_BETA_RUST_CARGO_LAMBDA"
  ]
}

[hawflau]

hi @cdriesler thanks for raising the issue.

Reason for the dev dependencies getting removed is the underlying npm install or npm update command is always run with the --production flag. I believe it made sense for nodejs runtimes because node_modules dir is included in the lambda function artifact. But for typescript or when using esbuild with --build-in-source, the effect of --production results in the inconvenience you saw.

This seems like a reasonable use case to keep the dev dependencies in the node_modules dir in the source dir. I will bring that to the team for discussion and prioritization.

[adesso-os]

Seems like your team discussions went nowhere and we're all still suffering this annoying behavior.