Skip to content

feat(storage): support copying CSEK-encrypted files to non-CSEK destinations - #26

Open
thiyaguk09 wants to merge 13 commits into
mainfrom
feat/7351-copy-csek-to-unencrypted
Open

feat(storage): support copying CSEK-encrypted files to non-CSEK destinations#26
thiyaguk09 wants to merge 13 commits into
mainfrom
feat/7351-copy-csek-to-unencrypted

Conversation

@thiyaguk09

@thiyaguk09 thiyaguk09 commented Jun 29, 2026

Copy link
Copy Markdown
Owner

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

  • Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
  • Ensure the tests and linter pass
  • Code coverage does not decrease (if any source code was changed)
  • Appropriate docs were updated (if necessary)

Fixes #<issue_number_goes_here> 🦕

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jun 29, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds support for null encryption keys to allow copying CSEK-encrypted files to standard non-CSEK destinations. The review identifies a critical bug in the copy logic where the source file's encryption key is mutated and the destination file is left in an inconsistent state by bypassing setEncryptionKey. Feedback also suggests correcting the corresponding unit tests to avoid asserting on this buggy behavior and to use the proper setter method instead of manually assigning dummy properties.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment thread handwritten/storage/src/file.ts Outdated
Comment thread handwritten/storage/test/file.ts Outdated
Comment thread handwritten/storage/test/file.ts Outdated
@thiyaguk09
thiyaguk09 force-pushed the feat/7351-copy-csek-to-unencrypted branch 2 times, most recently from 76c3932 to ea8daaa Compare July 10, 2026 12:30
@thiyaguk09
thiyaguk09 force-pushed the feat/7351-copy-csek-to-unencrypted branch 5 times, most recently from a74b4bf to 657755f Compare July 27, 2026 06:48
@thiyaguk09
thiyaguk09 force-pushed the feat/7351-copy-csek-to-unencrypted branch 7 times, most recently from c916584 to 6cb250f Compare August 4, 2026 06:08
@thiyaguk09
thiyaguk09 force-pushed the feat/7351-copy-csek-to-unencrypted branch 7 times, most recently from a016a7a to 887f9a6 Compare August 10, 2026 06:55
release-please Bot and others added 4 commits August 10, 2026 11:21
@release-please
chore(main): release google-ads-datamanager 1.0.0 (googleapis#9113)
bb0b0d5 
🤖 I have created a release *beep* *boop*
---


##
[1.0.0](googleapis/google-cloud-node@google-ads-datamanager-v0.6.0...google-ads-datamanager-v1.0.0)
(2026-08-07)


### ⚠ BREAKING CHANGES

* upgrade minimum Node.js version to 22
([googleapis#9026](googleapis#9026))

### Features

* [datamanager] add encrypted_user_id.proto and the EncryptedUserId
resource
([googleapis#8378](googleapis#8378))
([f5b12cf](googleapis@f5b12cf))
* [datamanager] add the coupon_codes field to CartData to track coupon
redemptions for Google Ads and Google Analytics
([googleapis#8300](googleapis#8300))
([ecec52d](googleapis@ecec52d))
* Update API sources and regenerate
([googleapis#8672](googleapis#8672))
([3391fd2](googleapis@3391fd2))
* Update API sources and regenerate
([googleapis#9104](googleapis#9104))
([61ea9c8](googleapis@61ea9c8))
* Upgrade minimum Node.js version to 22
([googleapis#9026](googleapis#9026))
([1ed703f](googleapis@1ed703f))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
@danieljbruce
fix: upgrade all node core library dependencies to their latest node …
af8074c 
…22 version (googleapis#9084)

## Description

One thing we should do in addition to the plan outlined for the Node
upgrade is we should upgrade the dependencies of the core libraries to
match versions that correspond to Node v22. We do this for our generated
packages so it is reasonable to do it for the core packages too. This
actually addresses
googleapis#9078 (comment)
removing a compiler error that should be addressed.

Generated a script to update the dependencies and ran it.

An additional detail is that we exclude the dependencies for generated
packages for now since we have not confirmed they have been released
with the major upgrade yet and we also exclude upgrading gaxios since it
was not upgraded to Node 22 yet.

## Impact

Ensures Node versions for core library dependencies match the core
library node versions (that they are all v22).
@shivanee-p
chore: update CODEOWNERS file (googleapis#9037)
7e1b441 
Updated team_members: comment definition in `.github/CODEOWNERS`
@release-please
chore: release main (googleapis#9110)
f5ab609 
🤖 I have created a release *beep* *boop*
---


<details><summary>common: 8.0.1</summary>

##
[8.0.1](googleapis/google-cloud-node@common-v8.0.0...common-v8.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>gapic-node-processing: 0.2.1</summary>

##
[0.2.1](googleapis/google-cloud-node@gapic-node-processing-v0.2.0...gapic-node-processing-v0.2.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>google-gax: 6.0.1</summary>

##
[6.0.1](googleapis/google-cloud-node@google-gax-v6.0.0...google-gax-v6.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>gcp-metadata: 9.0.2</summary>

##
[9.0.2](googleapis/google-cloud-node@gcp-metadata-v9.0.1...gcp-metadata-v9.0.2)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>google-auth-library: 11.0.1</summary>

##
[11.0.1](googleapis/google-cloud-node@google-auth-library-v11.0.0...google-auth-library-v11.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>google-logging-utils: 2.0.1</summary>

##
[2.0.1](googleapis/google-cloud-node@google-logging-utils-v2.0.0...google-logging-utils-v2.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>googleapis-common: 9.0.2</summary>

##
[9.0.2](googleapis/google-cloud-node@googleapis-common-v9.0.1...googleapis-common-v9.0.2)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>google-proto-files: 6.0.1</summary>

##
[6.0.1](googleapis/google-cloud-node@google-proto-files-v6.0.0...google-proto-files-v6.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>proto3-json-serializer: 4.0.1</summary>

##
[4.0.1](googleapis/google-cloud-node@proto3-json-serializer-v4.0.0...proto3-json-serializer-v4.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>retry-request: 9.0.1</summary>

##
[9.0.1](googleapis/google-cloud-node@retry-request-v9.0.0...retry-request-v9.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>teeny-request: 11.0.1</summary>

##
[11.0.1](googleapis/google-cloud-node@teeny-request-v11.0.0...teeny-request-v11.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>gapic-tools: 2.0.1</summary>

##
[2.0.1](googleapis/google-cloud-node@gapic-tools-v2.0.0...gapic-tools-v2.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>paginator: 7.0.1</summary>

##
[7.0.1](googleapis/google-cloud-node@paginator-v7.0.0...paginator-v7.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>projectify: 6.0.1</summary>

##
[6.0.1](googleapis/google-cloud-node@projectify-v6.0.0...projectify-v6.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>promisify: 6.0.1</summary>

##
[6.0.1](googleapis/google-cloud-node@promisify-v6.0.0...promisify-v6.0.1)
(2026-08-10)


### Bug Fixes

* Upgrade all node core library dependencies to their latest node 22
version
([googleapis#9084](googleapis#9084))
([af8074c](googleapis@af8074c))
</details>

<details><summary>chat: 0.29.0</summary>

##
[0.29.0](googleapis/google-cloud-node@chat-v0.28.0...chat-v0.29.0)
(2026-08-10)


### Features

* Update API sources and regenerate
([googleapis#9104](googleapis#9104))
([61ea9c8](googleapis@61ea9c8))
</details>

<details><summary>aiplatform: 7.1.0</summary>

##
[7.1.0](googleapis/google-cloud-node@aiplatform-v7.0.0...aiplatform-v7.1.0)
(2026-08-10)


### Features

* Update API sources and regenerate
([googleapis#9104](googleapis#9104))
([61ea9c8](googleapis@61ea9c8))
</details>

<details><summary>commerceproducer: 0.4.0</summary>

##
[0.4.0](googleapis/google-cloud-node@commerceproducer-v0.3.0...commerceproducer-v0.4.0)
(2026-08-10)


### Features

* Update API sources and regenerate
([googleapis#9104](googleapis#9104))
([61ea9c8](googleapis@61ea9c8))
</details>

<details><summary>compute: 7.1.0</summary>

##
[7.1.0](googleapis/google-cloud-node@compute-v7.0.0...compute-v7.1.0)
(2026-08-10)


### Features

* Update API sources and regenerate
([googleapis#9104](googleapis#9104))
([61ea9c8](googleapis@61ea9c8))
</details>

<details><summary>dataform: 3.1.0</summary>

##
[3.1.0](googleapis/google-cloud-node@dataform-v3.0.0...dataform-v3.1.0)
(2026-08-10)


### Features

* Update API sources and regenerate
([googleapis#9104](googleapis#9104))
([61ea9c8](googleapis@61ea9c8))
</details>

<details><summary>google-cloud-firestore-api: 0.5.0</summary>

##
[0.5.0](googleapis/google-cloud-node@google-cloud-firestore-api-v0.4.0...google-cloud-firestore-api-v0.5.0)
(2026-08-10)


### Features

* **firestore-api:** Add explicit ./protos/protos package subpath export
([googleapis#9105](googleapis#9105))
([4ac404d](googleapis@4ac404d))
* Update API sources and regenerate
([googleapis#9104](googleapis#9104))
([61ea9c8](googleapis@61ea9c8))
</details>

<details><summary>iam: 3.1.0</summary>

##
[3.1.0](googleapis/google-cloud-node@iam-v3.0.0...iam-v3.1.0)
(2026-08-10)


### Features

* Update API sources and regenerate
([googleapis#9104](googleapis#9104))
([61ea9c8](googleapis@61ea9c8))
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
dependabot Bot and others added 9 commits August 10, 2026 16:56
@dependabot
chore(deps-dev): bump tmp from 0.2.6 to 0.2.7 in /core/packages/gaxios (
ddb1d99 
googleapis#8647)

Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.6 to 0.2.7.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/raszi/node-tmp/commit/8ea1f37d75c67569e0f151448330d52f7babf211"><code>8ea1f37</code></a>
Bump up the version</li>
<li><a
href="https://github.com/raszi/node-tmp/commit/8f24f788a356b5d45c9bec894632bd4931338153"><code>8f24f78</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/raszi/node-tmp/commit/ce787f37aaacccad921ae90990c9da33481fe59c"><code>ce787f3</code></a>
Reject non-string prefix, postfix, template</li>
<li>See full diff in <a
href="https://github.com/raszi/node-tmp/compare/v0.2.6...v0.2.7">compare
view</a></li>
</ul>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@renovate-bot
chore(deps): update dependency protobufjs-cli to v1.2.1 [security] (g…
a747a1a 
…oogleapis#8253)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [protobufjs-cli](https://redirect.github.com/protobufjs/protobuf.js) |
[`1.2.0` →
`1.2.1`](https://renovatebot.com/diffs/npm/protobufjs-cli/1.2.0/1.2.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/protobufjs-cli/1.2.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/protobufjs-cli/1.2.0/1.2.1?slim=true)
|

---

### protobuf.js is Vulnerable to OS Command Injection in the CLI
[CVE-2026-42290](https://nvd.nist.gov/vuln/detail/CVE-2026-42290) /
[GHSA-f84p-cvgm-xgjj](https://redirect.github.com/advisories/GHSA-f84p-cvgm-xgjj)

<details>
<summary>More information</summary>

#### Details
##### Summary

`pbts` invoked JSDoc by building a shell command string from input file
paths and executing it through `child_process.exec`. File paths
containing shell metacharacters could therefore be interpreted by the
shell instead of being passed to JSDoc as plain arguments.

##### Impact

An attacker who can control file names or paths passed to `pbts` may be
able to execute arbitrary shell commands with the privileges of the
process running `pbts`.

This affects the protobufjs CLI tooling path. The protobufjs runtime
APIs for encoding, decoding, parsing, and loading protobuf messages are
not directly affected by this issue.

##### Preconditions

- The application or user must invoke `pbts` on file paths influenced by
an attacker.
- The attacker must be able to supply or create a path containing
shell-significant characters.
- The vulnerable `pbts` version must execute the generated JSDoc command
through a shell.

##### Workarounds

Do not run affected versions of `pbts` on attacker-controlled file names
or paths. If this cannot be avoided, sanitize or rename input files
before invoking `pbts`, or run the CLI in an isolated environment with
minimal privileges.

#### Severity
- CVSS Score: 7.8 / 10 (High)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

#### References
-
[https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj](https://redirect.github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj)
-
[https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1)
-
[https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-42290](https://nvd.nist.gov/vuln/detail/CVE-2026-42290)
-
[https://github.com/advisories/GHSA-f84p-cvgm-xgjj](https://redirect.github.com/advisories/GHSA-f84p-cvgm-xgjj)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-f84p-cvgm-xgjj)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### protobuf.js: Code injection in pbjs static output from crafted
schema names
[CVE-2026-44295](https://nvd.nist.gov/vuln/detail/CVE-2026-44295) /
[GHSA-6r35-46g8-jcw9](https://redirect.github.com/advisories/GHSA-6r35-46g8-jcw9)

<details>
<summary>More information</summary>

#### Details
##### Summary

`pbjs` static code generation could emit unsafe JavaScript identifiers
derived from schema-controlled names. When generating static JavaScript
from a crafted schema or JSON descriptor, certain namespace, enum,
service, or derived full names could be written into the generated
output without sufficient sanitization.

##### Impact

An attacker who can provide or influence schemas passed to `pbjs` may be
able to cause generated JavaScript output to contain attacker-controlled
code. The injected code would run if the generated file is later
executed or imported by the application or build process.

This affects the protobufjs CLI static code generation path.
Applications that only use trusted schemas, or that do not execute
generated output from untrusted schemas, are not directly affected.

##### Preconditions

- The application or build process must run `pbjs` static code
generation on a schema or JSON descriptor influenced by an attacker.
- The attacker-controlled input must contain crafted schema names that
reach generated JavaScript output.
- The generated JavaScript file must subsequently be executed, imported,
or otherwise evaluated.

##### Workarounds

Do not run affected versions of `pbjs` static code generation on
untrusted schemas or descriptors. If untrusted schemas must be accepted,
validate schema names before code generation and run generation in an
isolated environment.

#### Severity
- CVSS Score: 8.7 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`

#### References
-
[https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-6r35-46g8-jcw9](https://redirect.github.com/protobufjs/protobuf.js/security/advisories/GHSA-6r35-46g8-jcw9)
-
[https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1)
-
[https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-44295](https://nvd.nist.gov/vuln/detail/CVE-2026-44295)
-
[https://github.com/advisories/GHSA-6r35-46g8-jcw9](https://redirect.github.com/advisories/GHSA-6r35-46g8-jcw9)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-6r35-46g8-jcw9)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>protobufjs/protobuf.js (protobufjs-cli)</summary>

###
[`v1.2.1`](https://redirect.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1):
protobufjs-cli: v1.2.1

[Compare
Source](https://redirect.github.com/protobufjs/protobuf.js/compare/protobufjs-cli-v1.2.0...protobufjs-cli-v1.2.1)

##### Bug Fixes

- Backport input hardening and CLI fixes to 7.x
([#&googleapis#8203;2173](https://redirect.github.com/protobufjs/protobuf.js/issues/2173))
([75392ea](https://redirect.github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/google-cloud-node).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzMuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
@release-please
chore(main): release storage 7.22.0 (googleapis#8676)
13d1ca8 
🤖 I have created a release *beep* *boop*
---


##
[7.22.0](googleapis/google-cloud-node@storage-v7.21.0...storage-v7.22.0)
(2026-08-11)


### Features

* **storage:** Add deleteSourceObjects option to combine/compose method
([googleapis#8444](googleapis#8444))
([43abc45](googleapis@43abc45))


### Bug Fixes

* **storage:** Destroy local read stream on upload write failure to
prevent resource leaks
([googleapis#8752](googleapis#8752))
([77dab53](googleapis@77dab53)),
refs
[googleapis#7325](googleapis#7325)
* **storage:** Pass signingEndpoint to URLSigner in file.getSignedUrl
([googleapis#8982](googleapis#8982))
([b001807](googleapis@b001807))
* **storage:** Resolve Node compatibility crashes, security
vulnerability, and stream hangs
([googleapis#8622](googleapis#8622))
([512ba79](googleapis@512ba79))
* **storage:** Set application/json Content-Type for impersonated ADC
requests
([googleapis#8419](googleapis#8419))
([292c688](googleapis@292c688))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
@dependabot @shivanee-p
chore(deps): bump js-yaml from 4.1.1 to 4.3.0 in /core/generator/gapi…
f2f336f 
…c-generator-typescript (googleapis#8775)

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's
changelog</a>.</em></p>
<blockquote>
<h2>4.3.0, 3.15.0 - 2026-06-27</h2>
<h3>Security</h3>
<ul>
<li>Backported <code>maxTotalMergeKeys</code> option.</li>
</ul>
<h2>[5.2.0] - 2026-06-26</h2>
<h3>Added</h3>
<ul>
<li>Added <code>maxTotalMergeKeys</code> (10000) loader option to limit
the total number of
keys processed by YAML merge (<code>&lt;&lt;</code>) across one
<code>load()</code> / <code>loadAll()</code> call.</li>
<li>Added <code>maxAliases</code> (-1) loader option to limit the number
of YAML aliases per
document.</li>
</ul>
<h3>Removed</h3>
<ul>
<li><code>maxMergeSeqLength</code> replaced with
<code>maxTotalMergeKeys</code> for limiting YAML merge
processing.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Round-trip of integers with exponential form (&gt;=
<code>1e21</code>)</li>
</ul>
<h2>[5.1.0] - 2026-06-23</h2>
<h3>Added</h3>
<ul>
<li>Collection tags can finalize an incrementally populated carrier into
a
different result value.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>[breaking] <code>quoteStyle</code> now selects the preferred quote
style; use the
restored <code>forceQuotes</code> option to force quoting non-key
strings.</li>
</ul>
<h2>[5.0.0] - 2026-06-20</h2>
<h3>Added</h3>
<ul>
<li>Added named exports for schemas, tags, parser events and AST
utilities.</li>
<li>Reworked <code>JSON_SCHEMA</code> and <code>CORE_SCHEMA</code> with
spec-compliant scalar resolution
rules, and added <code>YAML11_SCHEMA</code>.</li>
<li>Added <code>realMapTag</code> for lossless mappings with non-string
and complex keys.
Object-based mappings now reject complex keys instead of stringifying
them.</li>
<li>Added <code>dump()</code> <code>transform</code> option for changing
the generated AST before
rendering.</li>
<li>Added <code>dump()</code> options <code>seqInlineFirst</code>,
<code>flowBracketPadding</code>,
<code>flowSkipCommaSpace</code>, <code>flowSkipColonSpace</code>,
<code>quoteFlowKeys</code>, <code>quoteStyle</code> and
<code>tagBeforeAnchor</code>.</li>
<li>Added formal data layers (events and AST) for modular data
pipelines.
<ul>
<li>Added low-level parser (to events), presenter and visitor APIs.</li>
</ul>
</li>
<li>Added the <a href="https://github.com/yaml/yaml-test-suite">YAML
Test Suite</a> to the
test set.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>See the <a
href="https://github.com/nodeca/js-yaml/blob/master/docs/migrate_v4_to_v5.md">migration
guide</a> for upgrade notes.</li>
<li>Rewritten in TypeScript and reorganized the public API around flat
named
exports.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nodeca/js-yaml/commit/33d05b5d29a8c21360f620f7e1c1706e24522eda"><code>33d05b5</code></a>
4.3.0 released</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/663bfab6db2b4a146a9366fd685f069345be4ddb"><code>663bfab</code></a>
Drop demo publish, to not override new v5 one.</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/1cb8c7b94bf75e15116869c1c0482dcb22785986"><code>1cb8c7b</code></a>
Add v4-legacy tag for publish</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/02f27afad532763263cd2b6be35c24ee8e1f6157"><code>02f27af</code></a>
Restore umd builds back to es5</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/8be84edaf15e7c394fa3b813179d1bcc280e87fb"><code>8be84ed</code></a>
Fix es5 compatibility</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"><code>59423c6</code></a>
Replace <code>maxMergeSeqLength</code> option with
<code>maxTotalMergeKeys</code> (more robust). Ba...</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/6842ef6a02df01ca7282ea01dc3c70787710c05d"><code>6842ef6</code></a>
doc polish</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/590dbabadd172b099c07654fab2eabec8c7a07b9"><code>590dbab</code></a>
4.2.0 released</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/f944dc5cd132251752499bdb157f33027d362177"><code>f944dc5</code></a>
Add package.json funding field</li>
<li><a
href="https://github.com/nodeca/js-yaml/commit/f6927192223355b64f2a6e19f3071ccc579ee718"><code>f692719</code></a>
Changelog update</li>
<li>Additional commits viewable in <a
href="https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.0">compare
view</a></li>
</ul>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Shivanee <46910562+shivanee-p@users.noreply.github.com>
@dependabot
chore(deps-dev): bump tmp from 0.2.5 to 0.2.7 in /core/packages/nodej…
aaed24f 
…s-googleapis-common (googleapis#8961)

Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/raszi/node-tmp/commit/8ea1f37d75c67569e0f151448330d52f7babf211"><code>8ea1f37</code></a>
Bump up the version</li>
<li><a
href="https://github.com/raszi/node-tmp/commit/8f24f788a356b5d45c9bec894632bd4931338153"><code>8f24f78</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/raszi/node-tmp/commit/ce787f37aaacccad921ae90990c9da33481fe59c"><code>ce787f3</code></a>
Reject non-string prefix, postfix, template</li>
<li><a
href="https://github.com/raszi/node-tmp/commit/41f71598d03f104a67e0448a7cb9bd4efcdd5980"><code>41f7159</code></a>
Bump up the version</li>
<li><a
href="https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429"><code>efa4a06</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/raszi/node-tmp/commit/7ef2728ce0211b8110b2033dfe62eaf030341acf"><code>7ef2728</code></a>
Check for relative values</li>
<li>See full diff in <a
href="https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@thiyaguk09
feat(storage): allow setting file encryption key to null to disable C…
d9b1796 
…SEK and fix copy behavior for non-encrypted destinations
@thiyaguk09
fix: handle destination encryption headers and prevent key intercepto…
f0b67dd 
…r conflicts during file copy operations
@thiyaguk09
fix: update file rewrite request URI and routing to use bucket reques…
871f24c 
…t instead of file request
@thiyaguk09
feat: update file encryption and KMS keys upon successful rotation an…
849cd96 
…d fix system test service account binding
@thiyaguk09
thiyaguk09 force-pushed the feat/7351-copy-csek-to-unencrypted branch from 887f9a6 to 849cd96 Compare August 11, 2026 05:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shubhangi-google shubhangi-google shubhangi-google approved these changes
@mahendra-google mahendra-google Awaiting requested review from mahendra-google
@gurusai-voleti gurusai-voleti Awaiting requested review from gurusai-voleti
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@thiyaguk09 @shubhangi-google @danieljbruce @shivanee-p @renovate-bot