Repository navigation
Update gaxios to 7.2.0 in gcp-metadata #8868
Description
gcp-metadata is pinning gaxios@7.1.3, which pulls in rimraf. That version of rimraf has a downstream dependency to brace-expansion@2.1.x with this flagged security vulnerability: https://www.cve.org/CVERecord?id=CVE-2026-13149
Dependency tree:
│ └─┬ gcp-metadata@8.1.3
│ └─┬ gaxios@7.1.3
│ └─┬ rimraf@5.0.10
Reacted by OIRNOIR, Trent Mick, Olli Paakkunainen, Brad Clark, Jorge Sebastian Miguel, Kirill Groshkov, David McLaughlin, Pier Bover, kennethd-decathlon and Milenko Tomic
Activity
[-]Update gaxios to 7.0.0 in gcp-metadata[/-][+]Update gaxios to 7.2.0 in gcp-metadata[/+]trentm commentedon Jul 15, 2026
Seconded. I'm happy to create a PR for this.
I'm a maintainer of OpenTelemetry JS, and the
@opentelemetry/resource-detector-gcpis usinggcp-metadata.(The
rimrafdep was moved to a devDep of gaxios back in Nov 2025, but there hasn't be bump here.)PierBover commentedon Aug 10, 2026
There's also the
uuidvulnerability whichgaxios 6.4.0 - 6.7.1depends on:GHSA-w5hq-g745-h8pq
Hilariously,
npm auditsuggests downgrading to@google-cloud/storage@5.18.3released in 2022.