googleapis / googleapis/synthtool
Nodejs: `0.1.0` Snippet Metadata Version Leakage
- Dominant language
- Python
- Stars
- 108
- Forks
- 102
- Avg merge
- 1h 23m
- Merged PRs (30d)
- 1
Description
The legacy OwlBot post-processing pipeline for Node.js monoreposactively skips updating the hardcoded `0.1.0` `clientLibrary.version` in `snippet_metadata_*.json` files. This is due to a refactor that bypassed the original Python version-updating logic in favor of a newer JavaScript post-processor (`node-monorepo-newprocess.js`) which omits the version replacement code.
## Detailed Diagnosis
1. **The Hardcoded Placeholder:** During upstream generation (`bazel-bot`), `gapic-generator-typescript` runs hermetically and has no knowledge of the downstream package version. Therefore, it hardcodes `"version": "0.1.0"` in [`typescript/src/templater.ts:66`](https://github.com/googleapis/gapic-generator-typescript/blob/main/typescript/src/templater.ts#L66) when generating snippet metadata.
2. **The Intended Fix (The Old Way):** Originally, `synthtool` handled this during post-processing. [`synthtool/languages/node.py` (lines 414-416)](https://github.com/googleapis/synthtool/blob/master/synthtool/languages/node.py#L414-L416) would read `package.json` and call [`common.update_library_version()`](https://github.com/googleapis/synthtool/blob/master/synthtool/languages/common.py#L20) to rewrite the metadata files.
3. **The Regression (The Root Cause):** The monorepo post-processing was refactored to use a dedicated script. [`synthtool/languages/node_mono_repo.py` (line 625)](https://github.com/googleapis/synthtool/blob/master/synthtool/languages/node_mono_repo.py#L625) now executes `node-monorepo-newprocess.js` instead of the logic in `node.py`.
4. **The Missing Code:** Reviewing [`node-monorepo-newprocess.js`](https://github.com/googleapis/synthtool/blob/master/synthtool/languages/node-monorepo-newprocess.js) reveals that it **entirely lacks any logic to update metadata versions**. It only executes:
* `librarian.js` (if present).
* README generation via `gapic-node-processing`.
* `npm run fix`.
5. **The Consequence:** Because `node-monorepo-newprocess.js` skips the version update, the raw `0.1.0` placeholder from the Bazel sandbox is committed to `main` by OwlBot.
## Proof
OwlBot PR [#8092](https://github.com/googleapis/google-cloud-node/pull/8092) (merged April 28, 2026) updated snippets for `google-cloud-cloudsecuritycompliance` but leaked the `0.1.0` version into `main` precisely because the post-processor failed to rewrite it.
## Proposed Solutions
We have two viable paths forward:
**Option A: Rely on Manual Patching until Librarian Migration**
Acknowledge the bug in the legacy pipeline but avoid investing effort into patching `synthtool`. let the upcoming migration to `librarian` permanently solve the issue and do a manual update before the migration to reduce the diff noise.
**Option B: Fix the Legacy Pipeline**
Port the version replacement logic into `node-monorepo-newprocess.js` within the `googleapis/synthtool` repository.
1. Read the local `package.json` version.
2. Iterate through `./samples/generated/**/*.json`.
3. Overwrite `clientLibrary.version` and save.
4. Release a new `synthtool` Docker image (`owlbot-nodejs`) to the CI pipeline to halt the leakage immediately.
Contributor guide
Assessment
This issue has not been assessed yet.