[gaxios] v7.1.4 was not published to npmjs.com

[AviVahl]

Please make sure you have searched for information in the following guides.

• Search the issues already opened: https://github.com/googleapis/google-cloud-node-core/issues
• Search StackOverflow: http://stackoverflow.com/questions/tagged/google-cloud-platform+node.js
• Check our Troubleshooting guide: https://github.com/googleapis/google-cloud-node-core/blob/main/docs/troubleshooting.md
• Check our FAQ: https://github.com/googleapis/google-cloud-node-core/blob/main/docs/faq.md
• Check our libraries HOW-TO: https://github.com/googleapis/gax-nodejs/blob/main/client-libraries.md
• Check out our authentication guide: https://github.com/googleapis/google-auth-library-nodejs
• Check out handwritten samples for many of our APIs: https://github.com/GoogleCloudPlatform/nodejs-docs-samples
• Check the API's issue tracker: https://cloud.google.com/support/docs/issue-trackers

Link to the code that reproduces this issue. A link to a public Github Repository or gist with a minimal reproduction.

this is not a code issue, it's a release one

A step-by-step description of how to reproduce the issue, based on the linked reproduction.

npm info gaxios versions

A clear and concise description of what the bug is, and what you expected to happen.

The changelog says v7.1.4 was released on 2025-12-17. It is not available on the npm registry.

The following commit should have released it: 383aa51

A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **

Because the changelog says so?
https://github.com/googleapis/google-cloud-node-core/blob/main/packages/gaxios/CHANGELOG.md#714-2025-12-17

[AviVahl]

Making sure it's released would resolve the advisory below, as gaxios@7.1.4 removed the dependency on old rimraf (which depends on vulnerable old minimatch):
GHSA-3ppc-4f35-3m26

FYI @feywind (you're the one who merged #821)

[syedmwma]

google-auth-library is still using gaxios@7.1.3, but looks like this is using a fix dependency. Might need to be updated with 7.1.4 once it is published (publically) in the registry.

[AviVahl]

google-auth-library is still using gaxios@7.1.3, but looks like this is using a fix dependency. Might need to be updated with 7.1.4 once it is published (publically) in the registry.

Latest google-auth-library uses the following semver range: "gaxios": "^7.0.0", so it will be fixed once newer gaxios patch is released (without needing to have a new release of google-auth-library itself).

You will have to unlock the current resolution when using a lock file (e.g. package-lock.json, yarn.lock, etc).

[realAP]

As @syedmwma mentioned, I am also waiting for v7.1.4 to be published on npm: https://www.npmjs.com/package/gaxios.

In the meantime, I am using a workaround: I pin to the GitHub release/commit and let pnpm build it during pnpm install, so all transitive dependents resolve to the pinned version:

 "pnpm": {
    "overrides": {
        "gaxios": "github:googleapis/google-cloud-node-core#383aa514c3aba283a8a654466cf9eade6a20e2f2&path:/packages/gaxios"
      }
    }

Important

This works, but it is still just a workaround, and it also reduces the usefulness of pnpm audit for catching new vulnerabilities in gaxios while it is not published on npm.

[jswalden]

Spot-checking three of the libraries (gaxis, google-auth-url, teeny-request) whose versions were bumped in 383aa51, it looks like none of them were updated on NPM. I'm guessing some kind of automated version publishing workflow broke and nobody noticed (although I didn't see one in .github/workflows on a quick skim).