googleapis-common@8.0.2 pins google-auth-library to exact "10.5.0" (was "^10.1.0"), breaking deduplication

[baraknaveh]

Summary

googleapis-common@8.0.2 declares "google-auth-library": "10.5.0" — an exact version with no caret. The previous release, 8.0.1, used "^10.1.0". This prevents google-auth-library from deduplicating for any consumer that also depends on a newer google-auth-library directly, installing two copies.

Where it changed

The caret was dropped in the monorepo migration commit 36277d77 (PR #7606, "chore: google cloud node core migration"), which bulk-pinned sibling cross-dependencies to exact versions across core/packages/*. nodejs-googleapis-common was one of several affected — gaxios, gcp-metadata, etc. got the same treatment.

Current source: core/packages/nodejs-googleapis-common/package.json still shows "google-auth-library": "10.5.0".

Why it's a problem

The pin is already stale — the same monorepo ships google-auth-library@10.7.0. A consumer that depends on google-auth-library@^10.7.0 directly and on googleapis (which pulls googleapis-common@^8.0.0 → 8.0.2) ends up with both 10.5.0 and 10.7.0 installed. In TypeScript this breaks compilation, because the two OAuth2Client classes are structurally incompatible (each declares a private redirectUri):

error TS2322: Type 'OAuth2Client' (google-auth-library@10.5.0) is not assignable to
type 'OAuth2Client' (google-auth-library@10.7.0).
  Types have separate declarations of a private property 'redirectUri'.

Repro

A package depending on googleapis@^173 and google-auth-library@^10.7.0, type-checking any use of google.auth.OAuth2 against google.drive(...).

Note

8.0.2 has no source changes vs 8.0.1 (no commits touched the package src/ between the two releases) — it appears to be a dependency-repinning/version-bump release, so the exact pin looks like an unintended artifact of the migration tooling rather than a deliberate constraint.

Expected

Restore a caret range for google-auth-library (e.g. ^10.1.0 or ^10.7.0) in googleapis-common, and ideally across the other siblings repinned in #7606.

[YasharF]

Related: #7664 reports the same googleapis-common@8.0.2 release also exact-pins gaxios to 7.1.3 (no caret), from the same migration commit (36277d7 / PR #7606) that dropped the caret here. That pin drags in rimraf@5.0.10 → deprecated glob@10.5.0, so anyone installing @googleapis/drive (or any other googleapis-common consumer) gets an npm warn deprecated glob@10.5.0 warning on top of the dedup break described above.

Might be worth fixing both pins — and any other siblings repinned in #7606 — in one pass rather than as separate patches.

[pearigee]

Thanks for the report, we will look into this.