googleapis / googleapis/google-cloud-node
secret-manager v6 + google-auth-library v10 + gaxios v7: Could not refresh access token in Cloud Build
- Dominant language
- TypeScript
- Stars
- 3.2k
- Forks
- 712
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 99
Description
## Library Name
`google-auth-library`
## Environment
- **@google-cloud/secret-manager**: v6.1.2
- **google-gax**: v5.0.6
- **google-auth-library**: v10.6.2
- **gaxios**: v7.1.4 (uses node-fetch v3.3.2)
- **Node.js**: 20
- **Runtime**: Google Cloud Build with custom service account
- **Container image**: Custom Node 20 Docker image
## Description
After upgrading `@google-cloud/secret-manager` from v5 to v6, we get the following error when `SecretManagerServiceClient` attempts to access the GCE metadata server for token refresh inside a Cloud Build step:
```
2 UNKNOWN: Getting metadata from plugin failed with error: Could not refresh access token: Unexpected Gaxios Error
at callErrorFromStatus (node_modules/@grpc/grpc-js/src/call.ts:84:17)
at Object.onReceiveStatus (node_modules/@grpc/grpc-js/src/client.ts:360:55)
...
at node_modules/@google-cloud/secret-manager/build/src/v1/secret_manager_service_client.js:227:29
at node_modules/google-gax/build/src/normalCalls/timeout.js:44:16
at repeat (node_modules/google-gax/build/src/normalCalls/retries.js:114:25)
```
The key difference between the working (v5) and broken (v6) dependency chains:
- **v5 (works):** secret-manager → google-gax v4 → google-auth-library v9 → gaxios v6 → node-fetch **v2**
- **v6 (fails):** secret-manager → google-gax v5 → google-auth-library v10 → gaxios v7 → node-fetch **v3**
This is related to the previously reported #6276, which was closed without resolution.
## Workaround
Pinning `@google-cloud/secret-manager` to v5 (which pulls google-gax v4 → google-auth-library v9 → gaxios v6 → node-fetch v2) resolves the issue.
## Expected behavior
`google-auth-library` v10 should be able to reach the GCE metadata server and refresh tokens in Cloud Build environments, just as v9 does.
## Hypothesis
The core issue seems to be:
```
TypeError: A dynamic import callback was invoked without --experimental-vm-modules
Cause:
...
at Function.#getFetch (node_modules/gcp-metadata/node_modules/gaxios/src/gaxios.ts:675:10)
```
Contributor guide
Assessment
This issue has not been assessed yet.