fix: include lock files in dependency hash for cache invalidation#8818
Open
dcabib wants to merge 1 commit intoaws:developfrom
Open
fix: include lock files in dependency hash for cache invalidation#8818dcabib wants to merge 1 commit intoaws:developfrom
dcabib wants to merge 1 commit intoaws:developfrom
Conversation
Resolves aws#8242 When using `sam build --cached`, changes to lock files (package-lock.json, Gemfile.lock, etc.) were not triggering cache invalidation, causing the build to skip dependency installation even when lock files specified different versions. This left functions with outdated or vulnerable dependencies. This fix adds a mapping of dependency managers to their lock file names in DependencyHashGenerator. When a lock file exists, the cache hash now includes both the manifest and lock file, ensuring proper cache invalidation when lock files change. Supported lock files: - npm: package-lock.json - npm-esbuild: package-lock.json - bundler: Gemfile.lock - gradle: gradle.lockfile - cli-package (dotnet): packages.lock.json - modules (go): go.sum - cargo (rust): Cargo.lock - uv (python): uv.lock - poetry (python): poetry.lock The implementation is backward compatible - lock files are optional and the behavior remains unchanged for projects without lock files. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
github-actions
bot
added
area/build
seshubaws
reviewed
Mar 17, 2026
| # Mapping of dependency managers to their lock file names | ||
| LOCK_FILE_MAPPING = { | ||
| "npm": "package-lock.json", | ||
| "npm-esbuild": "package-lock.json", |
Contributor
There was a problem hiding this comment.
do we not need to add yarn.lock and pnpm-lock.yaml?
seshubaws
reviewed
Mar 17, 2026
| """ | ||
| if self._manifest_path_override: | ||
| manifest_file = self._manifest_path_override | ||
| config = None |
Contributor
There was a problem hiding this comment.
why are we not wanting to add the config to the hash if there is a different manifest path? Can the lock file not still be resolved relative to the override path's directory?
Contributor
|
Could you add tests for if there is a lock file present and not present, and if there is an unknown dep manager |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #8242
When using
sam build --cached, changes to lock files (package-lock.json, Gemfile.lock, etc.) were not triggering cache invalidation. This caused the build to skip dependency installation even when lock files specified different dependency versions, leaving functions with outdated or vulnerable dependencies.Changes
Added a mapping of dependency managers to their lock file names in
DependencyHashGenerator. When a lock file exists, the cache hash now includes both the manifest and lock file, ensuring proper cache invalidation when lock files change.Supported lock files:
package-lock.jsonpackage-lock.jsonGemfile.lockgradle.lockfilepackages.lock.jsongo.sumCargo.lockuv.lockpoetry.lockImplementation Details
The fix follows the approach suggested by @seshubaws to add a small mapping in
DependencyHashGeneratorrather than modifying theCONFIGnamedtuple, keeping the change isolated and minimizing impact.The implementation:
Testing
package-lock.jsonchangesTest plan
pytest tests/unit/lib/build_module/test_dependency_hash_generator.pypackage-lock.jsonand verifysam build --cachedinvalidates cacheGemfile.lockand verify cache invalidation