From bdbdfc0664485855cf08747e99faca438456ad42 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 23:21:32 +0000 Subject: [PATCH] chore: bump cloud.google.com/go/auth from 0.23.3 to 0.24.0 Bumps [cloud.google.com/go/auth](https://github.com/googleapis/google-cloud-go) from 0.23.3 to 0.24.0. - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.3...v0.24.0) --- updated-dependencies: - dependency-name: cloud.google.com/go/auth dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 +- vendor/cloud.google.com/go/auth/CHANGES.md | 12 +++++ vendor/cloud.google.com/go/auth/auth.go | 2 +- .../go/auth/credentials/detect.go | 21 +++++---- .../go/auth/credentials/filetypes.go | 46 +++++++++++-------- .../externalaccount/externalaccount.go | 17 +++++-- .../externalaccountuser.go | 13 +++++- .../go/auth/internal/transport/transport.go | 19 ++++---- .../go/auth/internal/version.go | 2 +- .../cloud.google.com/go/auth/threelegged.go | 9 +++- vendor/modules.txt | 4 +- 12 files changed, 99 insertions(+), 52 deletions(-) diff --git a/go.mod b/go.mod index f20e21158a..a93ead2988 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/GoogleContainerTools/config-sync go 1.26.0 require ( - cloud.google.com/go/auth v0.23.3 + cloud.google.com/go/auth v0.24.0 cloud.google.com/go/compute/metadata v0.9.1 cloud.google.com/go/logging v1.19.1 cloud.google.com/go/monitoring v1.30.0 diff --git a/go.sum b/go.sum index fb7b698422..4e9a7f7d65 100644 --- a/go.sum +++ b/go.sum @@ -5,8 +5,8 @@ cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4= cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= -cloud.google.com/go/auth v0.23.3 h1:UMK+oBtuNGMCR/6i6mmySUItqjOazpJrbmZyhGbGBWo= -cloud.google.com/go/auth v0.23.3/go.mod h1:fClbry28fo7XkxhSeT6AQtAVAp6Jy0fW9N99PoPNPFM= +cloud.google.com/go/auth v0.24.0 h1:UYMbF8otPZnLAkNJ5/LYQYOq0ARcJS1P4JqTeMKbCYU= +cloud.google.com/go/auth v0.24.0/go.mod h1:IFG/AMA1VWfuTrdbieEsB2GcpJyJV/phGAvogkOoPR4= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/compute/metadata v0.9.1 h1:CTE1OWBQ0vnF5uHwdFAQJvMQ0Fi/KRcqqKTo9V0F8Ik= diff --git a/vendor/cloud.google.com/go/auth/CHANGES.md b/vendor/cloud.google.com/go/auth/CHANGES.md index b28726ccfb..a194a7ba5e 100644 --- a/vendor/cloud.google.com/go/auth/CHANGES.md +++ b/vendor/cloud.google.com/go/auth/CHANGES.md @@ -1,5 +1,17 @@ # Changes +## [0.24.0](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.3...auth/v0.24.0) (2026-09-23) + + +### Features + +* **all:** Update supported go versions ([#20520](https://github.com/googleapis/google-cloud-go/issues/20520)) ([90413d3](https://github.com/googleapis/google-cloud-go/commit/90413d3e9d381ef4b92e3c496d98b023c5b2d8cc)) + + +### Bug Fixes + +* **auth:** Honor DisableAsyncRefresh and EarlyTokenRefresh consistently ([#20564](https://github.com/googleapis/google-cloud-go/issues/20564)) ([39f0ea5](https://github.com/googleapis/google-cloud-go/commit/39f0ea51dcbcae2bef1e8c900bdf2e675a19199c)), refs [#20563](https://github.com/googleapis/google-cloud-go/issues/20563) + ## [0.23.3](https://github.com/googleapis/google-cloud-go/compare/auth/v0.23.2...auth/v0.23.3) (2026-09-17) diff --git a/vendor/cloud.google.com/go/auth/auth.go b/vendor/cloud.google.com/go/auth/auth.go index c6d8015833..fd6a11ddfb 100644 --- a/vendor/cloud.google.com/go/auth/auth.go +++ b/vendor/cloud.google.com/go/auth/auth.go @@ -386,7 +386,7 @@ func (c *cachedTokenProvider) tokenBlocking(ctx context.Context) (*Token, error) c.mu.Lock() defer c.mu.Unlock() c.isRefreshErr = false - if c.cachedToken.IsValid() || (!c.autoRefresh && !c.cachedToken.isEmpty()) { + if c.cachedToken.isValidWithEarlyExpiry(c.expireEarly) || (!c.autoRefresh && !c.cachedToken.isEmpty()) { return c.cachedToken, nil } t, err := c.tp.Token(ctx) diff --git a/vendor/cloud.google.com/go/auth/credentials/detect.go b/vendor/cloud.google.com/go/auth/credentials/detect.go index 9ce369d79f..f79cca4dcc 100644 --- a/vendor/cloud.google.com/go/auth/credentials/detect.go +++ b/vendor/cloud.google.com/go/auth/credentials/detect.go @@ -458,16 +458,17 @@ func clientCredConfigFromJSON(b []byte, opts *DetectOptions) *auth.Options3LO { } } return &auth.Options3LO{ - ClientID: c.ClientID, - ClientSecret: c.ClientSecret, - RedirectURL: c.RedirectURIs[0], - Scopes: opts.scopes(), - AuthURL: c.AuthURI, - TokenURL: c.TokenURI, - Client: opts.client(), - Logger: opts.logger(), - EarlyTokenExpiry: opts.EarlyTokenRefresh, - AuthHandlerOpts: handleOpts, + ClientID: c.ClientID, + ClientSecret: c.ClientSecret, + RedirectURL: c.RedirectURIs[0], + Scopes: opts.scopes(), + AuthURL: c.AuthURI, + TokenURL: c.TokenURI, + Client: opts.client(), + Logger: opts.logger(), + EarlyTokenExpiry: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + AuthHandlerOpts: handleOpts, // TODO(codyoss): refactor this out. We need to add in auto-detection // for this use case. AuthStyle: auth.StyleInParams, diff --git a/vendor/cloud.google.com/go/auth/credentials/filetypes.go b/vendor/cloud.google.com/go/auth/credentials/filetypes.go index a82995582c..59932fc6df 100644 --- a/vendor/cloud.google.com/go/auth/credentials/filetypes.go +++ b/vendor/cloud.google.com/go/auth/credentials/filetypes.go @@ -109,7 +109,8 @@ func fileCredentials(b []byte, opts *DetectOptions) (*auth.Credentials, error) { } return auth.NewCredentials(&auth.CredentialsOptions{ TokenProvider: auth.NewCachedTokenProvider(tp, &auth.CachedTokenProviderOptions{ - ExpireEarly: opts.EarlyTokenRefresh, + ExpireEarly: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, }), JSON: b, ProjectIDProvider: internalauth.StaticCredentialsProperty(projectID), @@ -172,16 +173,17 @@ func handleServiceAccount(f *credsfile.ServiceAccountFile, opts *DetectOptions) func handleUserCredential(f *credsfile.UserCredentialsFile, opts *DetectOptions) (auth.TokenProvider, error) { opts3LO := &auth.Options3LO{ - ClientID: f.ClientID, - ClientSecret: f.ClientSecret, - Scopes: opts.scopes(), - AuthURL: googleAuthURL, - TokenURL: opts.tokenURL(), - AuthStyle: auth.StyleInParams, - EarlyTokenExpiry: opts.EarlyTokenRefresh, - RefreshToken: f.RefreshToken, - Client: opts.client(), - Logger: opts.logger(), + ClientID: f.ClientID, + ClientSecret: f.ClientSecret, + Scopes: opts.scopes(), + AuthURL: googleAuthURL, + TokenURL: opts.tokenURL(), + AuthStyle: auth.StyleInParams, + EarlyTokenExpiry: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + RefreshToken: f.RefreshToken, + Client: opts.client(), + Logger: opts.logger(), } return auth.New3LOTokenProvider(opts3LO) } @@ -199,6 +201,8 @@ func handleExternalAccount(f *credsfile.ExternalAccountFile, opts *DetectOptions QuotaProjectID: f.QuotaProjectID, Scopes: opts.scopes(), WorkforcePoolUserProject: f.WorkforcePoolUserProject, + EarlyTokenRefresh: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, Client: opts.client(), Logger: opts.logger(), IsDefaultClient: opts.Client == nil, @@ -243,15 +247,17 @@ func handleExternalAccount(f *credsfile.ExternalAccountFile, opts *DetectOptions func handleExternalAccountAuthorizedUser(f *credsfile.ExternalAccountAuthorizedUserFile, opts *DetectOptions) (auth.TokenProvider, error) { externalOpts := &externalaccountuser.Options{ - Audience: f.Audience, - RefreshToken: f.RefreshToken, - TokenURL: f.TokenURL, - TokenInfoURL: f.TokenInfoURL, - ClientID: f.ClientID, - ClientSecret: f.ClientSecret, - Scopes: opts.scopes(), - Client: opts.client(), - Logger: opts.logger(), + Audience: f.Audience, + RefreshToken: f.RefreshToken, + TokenURL: f.TokenURL, + TokenInfoURL: f.TokenInfoURL, + ClientID: f.ClientID, + ClientSecret: f.ClientSecret, + Scopes: opts.scopes(), + EarlyTokenRefresh: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + Client: opts.client(), + Logger: opts.logger(), } tp, err := externalaccountuser.NewTokenProvider(externalOpts) if err != nil { diff --git a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go index f4f49f175d..ae38487fa9 100644 --- a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go +++ b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccount/externalaccount.go @@ -100,6 +100,13 @@ type Options struct { // for AWS credentials. One of SubjectTokenProvider, // AWSSecurityCredentialProvider or CredentialSource must be provided. Optional. AwsSecurityCredentialsProvider AwsSecurityCredentialsProvider + // EarlyTokenRefresh configures how early before a token expires that it + // should be refreshed. If unset, the default value is 3 minutes and 45 + // seconds. Optional. + EarlyTokenRefresh time.Duration + // DisableAsyncRefresh configures a synchronous workflow that refreshes + // stale tokens while blocking. The default is false. Optional. + DisableAsyncRefresh bool // Client for token request. Client *http.Client // IsDefaultClient marks whether the client passed in is a default client that can be overriden. @@ -249,8 +256,12 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) { logger: logger, } + cacheOpts := &auth.CachedTokenProviderOptions{ + ExpireEarly: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + } if opts.ServiceAccountImpersonationURL == "" { - return auth.NewCachedTokenProvider(tp, nil), nil + return auth.NewCachedTokenProvider(tp, cacheOpts), nil } scopes := make([]string, len(opts.Scopes)) @@ -261,14 +272,14 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) { Client: client, URL: opts.ServiceAccountImpersonationURL, Scopes: scopes, - Tp: auth.NewCachedTokenProvider(tp, nil), + Tp: auth.NewCachedTokenProvider(tp, cacheOpts), TokenLifetimeSeconds: opts.ServiceAccountImpersonationLifetimeSeconds, Logger: logger, }) if err != nil { return nil, err } - return auth.NewCachedTokenProvider(imp, nil), nil + return auth.NewCachedTokenProvider(imp, cacheOpts), nil } type subjectTokenProvider interface { diff --git a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go index ae39206e5f..e4a34b1e58 100644 --- a/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go +++ b/vendor/cloud.google.com/go/auth/credentials/internal/externalaccountuser/externalaccountuser.go @@ -51,6 +51,14 @@ type Options struct { // Scopes contains the desired scopes for the returned access token. Scopes []string + // EarlyTokenRefresh configures how early before a token expires that it + // should be refreshed. If unset, the default value is 3 minutes and 45 + // seconds. Optional. + EarlyTokenRefresh time.Duration + // DisableAsyncRefresh configures a synchronous workflow that refreshes + // stale tokens while blocking. The default is false. Optional. + DisableAsyncRefresh bool + // Client for token request. Client *http.Client // Logger for logging. @@ -71,7 +79,10 @@ func NewTokenProvider(opts *Options) (auth.TokenProvider, error) { tp := &tokenProvider{ o: opts, } - return auth.NewCachedTokenProvider(tp, nil), nil + return auth.NewCachedTokenProvider(tp, &auth.CachedTokenProviderOptions{ + ExpireEarly: opts.EarlyTokenRefresh, + DisableAsyncRefresh: opts.DisableAsyncRefresh, + }), nil } type tokenProvider struct { diff --git a/vendor/cloud.google.com/go/auth/internal/transport/transport.go b/vendor/cloud.google.com/go/auth/internal/transport/transport.go index fb0a8a1e07..c4f4c26b70 100644 --- a/vendor/cloud.google.com/go/auth/internal/transport/transport.go +++ b/vendor/cloud.google.com/go/auth/internal/transport/transport.go @@ -67,15 +67,16 @@ func CloneDetectOptions(oldDo *credentials.DetectOptions) *credentials.DetectOpt } newDo := &credentials.DetectOptions{ // Simple types - TokenBindingType: oldDo.TokenBindingType, - Audience: oldDo.Audience, - Subject: oldDo.Subject, - EarlyTokenRefresh: oldDo.EarlyTokenRefresh, - TokenURL: oldDo.TokenURL, - STSAudience: oldDo.STSAudience, - CredentialsFile: oldDo.CredentialsFile, - UseSelfSignedJWT: oldDo.UseSelfSignedJWT, - UniverseDomain: oldDo.UniverseDomain, + TokenBindingType: oldDo.TokenBindingType, + Audience: oldDo.Audience, + Subject: oldDo.Subject, + EarlyTokenRefresh: oldDo.EarlyTokenRefresh, + DisableAsyncRefresh: oldDo.DisableAsyncRefresh, + TokenURL: oldDo.TokenURL, + STSAudience: oldDo.STSAudience, + CredentialsFile: oldDo.CredentialsFile, + UseSelfSignedJWT: oldDo.UseSelfSignedJWT, + UniverseDomain: oldDo.UniverseDomain, // These fields are pointer types that we just want to use exactly as // the user set, copy the ref diff --git a/vendor/cloud.google.com/go/auth/internal/version.go b/vendor/cloud.google.com/go/auth/internal/version.go index 0021a6c4c3..eda0ad9f81 100644 --- a/vendor/cloud.google.com/go/auth/internal/version.go +++ b/vendor/cloud.google.com/go/auth/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "0.23.3" +const Version = "0.24.0" diff --git a/vendor/cloud.google.com/go/auth/threelegged.go b/vendor/cloud.google.com/go/auth/threelegged.go index 07804dc162..9a9d02657a 100644 --- a/vendor/cloud.google.com/go/auth/threelegged.go +++ b/vendor/cloud.google.com/go/auth/threelegged.go @@ -67,6 +67,9 @@ type Options3LO struct { // refreshed. If not set the default value is 3 minutes and 45 seconds. // Optional. EarlyTokenExpiry time.Duration + // DisableAsyncRefresh configures a synchronous workflow that refreshes + // stale tokens while blocking. The default is false. Optional. + DisableAsyncRefresh bool // AuthHandlerOpts provides a set of options for doing a // 3-legged OAuth2 flow with a custom [AuthorizationHandler]. Optional. @@ -192,7 +195,8 @@ func New3LOTokenProvider(opts *Options3LO) (TokenProvider, error) { return new3LOTokenProviderWithAuthHandler(opts), nil } return NewCachedTokenProvider(&tokenProvider3LO{opts: opts, refreshToken: opts.RefreshToken, client: opts.client()}, &CachedTokenProviderOptions{ - ExpireEarly: opts.EarlyTokenExpiry, + ExpireEarly: opts.EarlyTokenExpiry, + DisableAsyncRefresh: opts.DisableAsyncRefresh, }), nil } @@ -211,7 +215,8 @@ type AuthorizationHandlerOptions struct { func new3LOTokenProviderWithAuthHandler(opts *Options3LO) TokenProvider { return NewCachedTokenProvider(&tokenProviderWithHandler{opts: opts, state: opts.AuthHandlerOpts.State}, &CachedTokenProviderOptions{ - ExpireEarly: opts.EarlyTokenExpiry, + ExpireEarly: opts.EarlyTokenExpiry, + DisableAsyncRefresh: opts.DisableAsyncRefresh, }) } diff --git a/vendor/modules.txt b/vendor/modules.txt index 59ed6ac1a3..411b080e71 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -4,8 +4,8 @@ al.essio.dev/pkg/shellescape # cloud.google.com/go v0.123.0 ## explicit; go 1.24.0 cloud.google.com/go -# cloud.google.com/go/auth v0.23.3 -## explicit; go 1.25.0 +# cloud.google.com/go/auth v0.24.0 +## explicit; go 1.26.0 cloud.google.com/go/auth cloud.google.com/go/auth/credentials cloud.google.com/go/auth/credentials/idtoken