fix: upgrade @google-cloud/storage@7.19.0#3071
Conversation
Summary of ChangesHello @lahirumaramba, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request focuses on enhancing the project's security posture and maintaining compatibility with modern development standards. It primarily addresses a known security vulnerability by updating a key optional dependency and simultaneously upgrades the TypeScript version, necessitating minor code adjustments to conform to stricter type-checking rules. These changes ensure the project remains secure and aligned with current best practices. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
lahirumaramba
force-pushed
the
lm-update-deps
branch
from
19716d3 to
b2f7bef
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly upgrades @google-cloud/storage to resolve a security vulnerability and updates TypeScript to a newer version. The corresponding code changes in src/utils/api-request.ts are functional. However, I've provided suggestions to replace the type assertions with type guards. This is a safer and more robust approach that improves code clarity and prevents potential type-related issues in the future.
| this.httpConfigImpl = httpConfigImpl; | ||
| this.options = this.httpConfigImpl.buildRequestOptions(); | ||
| this.entity = this.httpConfigImpl.buildEntity(this.options.headers!); | ||
| this.entity = this.httpConfigImpl.buildEntity(this.options.headers as http.OutgoingHttpHeaders); |
There was a problem hiding this comment.
While using as http.OutgoingHttpHeaders works, it's a type assertion that tells the compiler to trust you, which can hide potential bugs if the type assumptions are wrong. A safer and clearer approach is to use a type guard. This ensures this.options.headers is always an object, making the code more robust against future changes and satisfying the compiler without forcing a type.
if (!this.options.headers) {
this.options.headers = {};
}
this.entity = this.httpConfigImpl.buildEntity(this.options.headers);| this.http2ConfigImpl = http2ConfigImpl; | ||
| this.options = this.http2ConfigImpl.buildRequestOptions(); | ||
| this.entity = this.http2ConfigImpl.buildEntity(this.options.headers!); | ||
| this.entity = this.http2ConfigImpl.buildEntity(this.options.headers as http.OutgoingHttpHeaders); |
There was a problem hiding this comment.
Similar to the previous comment, using a type assertion with as can suppress potential type errors. A safer and clearer approach is to use a type guard. This ensures this.options.headers is always an object, making the code more robust against future changes and satisfying the compiler without forcing a type.
if (!this.options.headers) {
this.options.headers = {};
}
this.entity = this.http2ConfigImpl.buildEntity(this.options.headers);
…in fast-xml-parser
lahirumaramba
force-pushed
the
lm-update-deps
branch
from
b2f7bef to
82d350b
Compare
jonathanedey
left a comment
jonathanedey
left a comment
There was a problem hiding this comment.
LGTM with one comment!
| this.http2ConfigImpl = http2ConfigImpl; | ||
| this.options = this.http2ConfigImpl.buildRequestOptions(); | ||
| this.entity = this.http2ConfigImpl.buildEntity(this.options.headers!); | ||
| this.entity = this.http2ConfigImpl.buildEntity(this.options.headers as http.OutgoingHttpHeaders); |
There was a problem hiding this comment.
I think this one should be as http2.OutgoingHttpHeaders but I also don't remember if both map to the same interface.
2 participants
Description
This PR bumps the optional dependency
@google-cloud/storageto address a known security vulnerability in its underlying dependency,fast-xml-parser. As part of this update, TypeScript has been bumped in a minor version bump (breaking change exception) to support newer compilation requirements.Changes Included:
@google-cloud/storagedependency from^7.14.0to^7.19.0to resolve a vulnerability infast-xml-parser. Fixes: UPDATEfast-xml-parserto fixCVE-2026-25128#3060typescriptfrom5.5.4to^5.7.3. (this will result in future typescript upgrades in minor version bumps).options.headersnon-null assertion (!) to an explicit type assertion (as http.OutgoingHttpHeaders) insrc/utils/api-request.tsto satisfy stricter type-checking requirements introduced by the newer TypeScript version.Type of change
Testing