fix(deps): deduplicate google-auth-library to fix release build#1312
Merged
Conversation
The "Version Packages" lockfile regen floated the root google-auth-library to 10.7.0 while googleapis-common pins exactly 10.5.0, creating two copies of the v10 OAuth2Client type. That broke the backend TypeScript build (TS2345 in google.sheets()/google.bigquery() calls), which cascaded into ~15 failed CI checks since nearly every job starts by building the backend. Add a scoped npm override so googleapis-common reuses the hoisted root copy; the ^10.1.0 range auto-tracks future lockfile regens. The separate v9 cluster (@google-cloud/logging/pubsub, google-gax) is untouched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Commit
1ad2615("Version Packages" #1250) turned ~15 CI checks red, all from a single root cause.The
package-lock.jsonregeneration floated the hoisted rootgoogle-auth-libraryto10.7.0, whilegoogleapis-common@8.0.2pins it to exactly10.5.0. That left two physical v10 copies in the tree → two distinctOAuth2Clienttypes →error TS2345in the backend:apps/backend/.../google-sheets/adapters/google-sheets-api.adapter.ts—google.sheets({ version: 'v4', auth })apps/backend/.../bigquery/services/bigquery-storage-resource-browser.service.ts—google.bigquery({ version: 'v2', auth })The backend imports
OAuth2Clientdirectly fromgoogle-auth-library(root copy), butgoogleapisexpects the type fromgoogleapis-common's nested copy. Since almost every job starts withbuild:dep(which compiles the backend), the single build error cascaded into the tests, linters,publish, and all E2E jobs.Fix
Scoped npm override in the root
package.json:googleapis-commonnow reuses the root copy. The^10.1.0range (rather than a pinned10.7.0) auto-tracks the root on future lockfile regenerations, so the tree stays deduplicated. The separate v9 cluster (@google-cloud/logging/pubsub,google-gax— all9.15.1) is left untouched.In
package-lock.json, the duplicategoogle-auth-library@10.5.0and its now-orphanedgcp-metadata/gtokenentries are removed (minimal diff).Verification
npm ci(same as CI)0 vulnerabilitiesgoogle-auth-library@10.7.0TS2345)owoxbuild (CI step repro)