Amplify Backend CLI introduces multiple deprecated dependencies (inflight, glob@7, rimraf@3, core-js@2, outdated Babel plugins)

[michaelgiraldo]

Environment information

npx ampx info output:

(Replace this line with your actual output — run `npx ampx info` in your project.)

The issue appears on:
- macOS (Apple Silicon)
- Node v25.2.1
- npm 11.6.2
- @aws-amplify/backend-cli 1.8.0

Multiple deprecated dependency chains originate from Amplify’s backend toolchain and model generation plugins, independent of project code.

Describe the bug

Installing or updating dependencies in a project that uses @aws-amplify/backend-cli results in a large number of deprecated, unsupported, and in some cases unsafe dependency warnings.

All deprecated packages originate from Amplify’s backend CLI toolchain and related plugins (modelgen, form generator, GraphQL types generator).

These include:

• inflight@1.0.6 (memory leak, unmaintained)
• glob@7.2.3 (deprecated, unsupported)
• rimraf@3.0.2 (deprecated)
• core-js@2.6.12 (no longer maintained; major performance issues)
• @babel/plugin-proposal-class-properties (obsolete)
• @babel/plugin-proposal-object-rest-spread (obsolete)
• node-domexception@1.0.0 (deprecated)

This results in dozens of warnings during npm install and impacts CI, security scanning tools, and developer experience.

These warnings cannot be resolved from the consuming project because the deprecated dependencies are deeply nested inside Amplify’s dependency graph.

Reproduction steps

1. Create or open any project that uses:

   • @aws-amplify/backend-cli
   • Amplify form generator
   • Amplify modelgen
   • Amplify GraphQL types generator

2. Run:
   npm install
   or
   npm update
   or any dependency update script.

3. Observe warnings such as:
   npm WARN deprecated inflight@1.0.6
   npm WARN deprecated glob@7.2.3
   npm WARN deprecated rimraf@3.0.2
   npm WARN deprecated core-js@2.6.12
   npm WARN deprecated node-domexception@1.0.0
   npm WARN deprecated @babel/plugin-proposal-class-properties
   npm WARN deprecated @babel/plugin-proposal-object-rest-spread

4. Run:
   npm ls inflight
   npm ls glob@7
   npm ls rimraf@3
   npm ls core-js@2
   npm ls node-domexception
   npm ls @babel/plugin-proposal-class-properties

5. The dependency trace reveals that all deprecated packages come from the Amplify toolchain.

Dependency trace example:

inflight@1.0.6:
@aws-amplify/backend-cli
└─ @aws-amplify/form-generator
└─ @aws-amplify/appsync-modelgen-plugin
└─ @graphql-codegen/visitor-plugin-common
└─ @graphql-tools/relay-operation-optimizer
└─ @ardatan/relay-compiler
└─ glob@7.2.3
└─ inflight@1.0.6

glob@7.2.3 and rimraf@3.0.2:
@aws-amplify/model-generator
└─ @aws-amplify/graphql-types-generator
└─ rimraf@3.0.2
└─ glob@7.2.3

node-domexception@1.0.0:
@aws-amplify/backend-cli
└─ @aws-amplify/form-generator
└─ node-fetch@3
└─ fetch-blob
└─ node-domexception

Deprecated Babel proposal plugins:
@aws-amplify/appsync-modelgen-plugin
└─ relay-compiler@12
└─ babel-preset-fbjs
├─ @babel/plugin-proposal-class-properties
└─ @babel/plugin-proposal-object-rest-spread

[michaelgiraldo]

---

📦 Deprecated Dependency Trace — Command List

Below is the complete set of npm ls commands needed to determine which packages are responsible for each deprecated dependency reported during installation.

Run these commands:

npm ls inflight
npm ls glob@7
npm ls rimraf@3
npm ls core-js@2
npm ls @babel/plugin-proposal-class-properties
npm ls @babel/plugin-proposal-object-rest-spread
npm ls node-domexception

---

🧭 What Each Command Detects

Command	Detects	Reason
npm ls inflight	inflight@1.0.6	Deprecated + memory leak, pulled in via old glob
npm ls glob@7	glob@7.2.3	Deprecated; replaced by v9+
npm ls rimraf@3	rimraf@3.0.2	Deprecated; replaced by v4+
npm ls core-js@2	core-js@2.6.12	Fully EOL; causes performance issues
npm ls @babel/plugin-proposal-class-properties	Old Babel proposal plugin	Deprecated because proposal finalized in ECMAScript
npm ls @babel/plugin-proposal-object-rest-spread	Old Babel proposal plugin	Same reason — proposal now standardized
npm ls node-domexception	node-domexception@1.0.0	Deprecated; replace with native DOMException

---

✔️ Result Summary

Using these commands, you confirmed:

• All deprecated packages originate from the AWS Amplify Backend CLI toolchain.

  The problematic chain involves Amplify’s:

  • @aws-amplify/backend-cli

  • @aws-amplify/form-generator

  • @aws-amplify/model-generator

  • @aws-amplify/graphql-types-generator

  • @aws-amplify/appsync-modelgen-plugin

  • old relay-compiler and graphql-codegen subdependencies

[michaelgiraldo]

✅ GitHub Attachment: Deprecated Dependency Analysis

🔍 Deprecated Dependency Analysis

The following deprecated dependencies appear when installing or updating a project using @aws-amplify/backend-cli.
All dependency traces confirm that these warnings originate exclusively from the Amplify Backend CLI toolchain and its transitive packages.

📦 Deprecated Packages Reported by npm

npm WARN deprecated inflight@1.0.6
npm WARN deprecated glob@7.2.3
npm WARN deprecated rimraf@3.0.2
npm WARN deprecated core-js@2.6.12
npm WARN deprecated node-domexception@1.0.0
npm WARN deprecated @babel/plugin-proposal-class-properties
npm WARN deprecated @babel/plugin-proposal-object-rest-spread

🧭 Commands Used to Identify Root Causes

To trace each deprecated dependency to its source, the following commands were used:

npm ls inflight
npm ls glob@7
npm ls rimraf@3
npm ls core-js@2
npm ls @babel/plugin-proposal-class-properties
npm ls @babel/plugin-proposal-object-rest-spread
npm ls node-domexception

🧩 Dependency Trace Results

inflight@1.0.6 (via deprecated glob@7)

@aws-amplify/backend-cli
└─ @aws-amplify/form-generator
└─ @aws-amplify/appsync-modelgen-plugin
└─ @graphql-codegen/visitor-plugin-common
└─ @graphql-tools/relay-operation-optimizer
└─ @ardatan/relay-compiler
└─ glob@7.2.3
└─ inflight@1.0.6

glob@7.2.3 and rimraf@3.0.2

@aws-amplify/model-generator
└─ @aws-amplify/graphql-types-generator
└─ rimraf@3.0.2
└─ glob@7.2.3

core-js@2.6.12

Introduced through older versions of GraphQL or Relay compiler utilities used by Amplify.

node-domexception@1.0.0

@aws-amplify/backend-cli
└─ @aws-amplify/form-generator
└─ node-fetch@3
└─ fetch-blob
└─ node-domexception

Deprecated Babel Plugins

@aws-amplify/appsync-modelgen-plugin
└─ relay-compiler@12.x
└─ babel-preset-fbjs
├─ @babel/plugin-proposal-class-properties
└─ @babel/plugin-proposal-object-rest-spread

🛑 Summary of Findings

• All deprecated packages originate from Amplify’s model generation and form generation tooling.
• The Amplify Backend CLI currently relies on outdated versions of:
  • glob
  • rimraf
  • core-js@2
  • old relay-compiler
  • deprecated Babel proposal plugins
  • outdated fetch polyfills

These outdated dependencies generate warnings, reduce ecosystem compatibility, and trigger issues in CI and security scanners.

🙏 Request

Please update the relevant Amplify packages to modern, supported dependency versions:

• Replace glob@7 → glob@10
• Replace rimraf@3 → rimraf@5
• Remove inflight entirely (unmaintained)
• Replace core-js@2 → core-js@3
• Upgrade Relay compiler to a supported version
• Replace deprecated Babel plugins with their transform-* versions
• Remove node-domexception in favor of the platform-native DOMException

[pahud]

Hi @michaelgiraldo,

Thank you for the detailed report with comprehensive dependency traces. This is a valid concern about deprecated dependencies in the Amplify Backend CLI toolchain.

The deprecation warnings you're seeing originate from transitive dependencies in several Amplify packages:

While these warnings don't cause functional issues, they do impact developer experience and CI/CD logs.

These updates would require coordination across multiple Amplify repositories (amplify-backend, amplify-codegen, amplify-category-api).

I am bring this up to the team for visibility and we'll see if we can share anything here. Thank you.