GoogleCloudPlatform / GoogleCloudPlatform/cloud-sql-nodejs-connector

Dependency `gaxios` was archived - migration needed/advised

Open
#520 0 comments 3 reactions 1 assignee Claimed by @hessjcg View on GitHub
type: bug
Dominant language
TypeScript
Stars
97
Forks
16
Avg merge
4d 16h
Merged PRs (30d)
4

Description

## Foreword

I wasn't entirely certain which category this falls under - realistically it's not a _bug_ and it's not a pressing security issue, but it's not really a feature request either. It's more of a flag/warning; so feel free to recategorise.

## Description

### What happened?

The `gaxios` package, which this project directly depends on (`gaxios@^7.1.3`), was [archived by its owner on January 3, 2026](https://github.com/googleapis/gaxios). The repository is now read-only and will no longer receive updates, bug fixes, or security patches.

### Why does this matter?

1. **Security risk**: Archived dependencies won't receive security updates
2. **Deprecation warnings**: The gaxios dependency chain includes deprecated packages:
- `gaxios` → `node-fetch` → `fetch-blob` → `node-domexception`
- `node-domexception` is deprecated (Node.js 18+ has native `DOMException`)
- Node.js 18 itself is [no longer in active support (even from a security perspective)](https://endoflife.date/nodejs)
3. **Ecosystem health**: Both `node-fetch` (last release Nov 2023) and `fetch-blob` (last release May 2023) appear to be unmaintained

### Current dependency chain

```
@google-cloud/cloud-sql-connector
└── gaxios@^7.1.3 (ARCHIVED)
└── node-fetch@^3.3.2 (stale)
└── fetch-blob (abandoned)
└── node-domexception (deprecated)
```

### Suggested migration path

Node.js 18+ includes native `fetch` support. Migrating to native fetch would:
- Remove the dependency on the archived `gaxios` package
- Eliminate the entire deprecated dependency chain
- Reduce bundle size
- Improve long-term maintainability

### Environment

- `@google-cloud/cloud-sql-connector` version: 1.8.4 (latest at time of writing)
- Node.js: 20.x / 22.x

### Additional context

This was discovered while investigating npm deprecation warnings in a project using `firebase-tools`, which depends on `@google-cloud/cloud-sql-connector`.

The deprecation warning during `npm install`:
```
npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
```

There is an [open issue in `firebase-tools` that provides a more thorough dependency tree](https://github.com/firebase/firebase-tools/issues/9421)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.