build: fix cross-span and setuptools CVEs

.github/.OwlBot.lock.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,5 +13,5 @@
 # limitations under the License.
 docker:
   image: gcr.io/cloud-devrel-public-resources/owlbot-nodejs:latest
-  digest: sha256:609822e3c09b7a1bd90b99655904609f162cc15acb4704f1edf778284c36f429
-# created: 2024-10-01T19:34:30.797530443Z
+  digest: sha256:a52bd494fc1fe28479d7982db3d0f8bd49d862b4184c4574ca0931e99ac1ffee
+# created: 2025-07-15T17:18:59.198670588Z

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,7 +1,30 @@
-Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:
-- [ ] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/nodejs-logging-winston/issues/new/choose) before writing your code!  That way we can discuss the change, evaluate designs, and agree on the general idea
+> Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:
+
+## Description
+
+> Please provide a detailed description for the change.
+> As much as possible, please try to keep changes separate by purpose. For example, try not to make a one-line bug fix in a feature request, or add an irrelevant README change to a bug fix.
+
+## Impact
+
+> What's the impact of this change?
+
+## Testing
+
+> Have you added unit and integration tests if necessary?
+> Were any tests changed? Are any breaking changes necessary?
+
+## Additional Information
+
+> Any additional details that we should be aware of?
+
+## Checklist
+
+- [ ] Make sure to open an issue as a [bug/issue](https://github.com/googleapis/nodejs-logging-winston/issues/new/choose) before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
 - [ ] Ensure the tests and linter pass
-- [ ] Code coverage does not decrease (if any source code was changed)
-- [ ] Appropriate docs were updated (if necessary)
+- [ ] Code coverage does not decrease
+- [ ] Appropriate docs were updated
+- [ ] Appropriate comments were added, particularly in complex areas or places that require background
+- [ ] No new warnings or issues will be generated from this change
 
-Fixes #<issue_number_goes_here> 🦕
+Fixes #issue_number_goes_here 🦕

.github/release-trigger.yml

@@ -1 +1,2 @@
 enabled: true
+multiScmName: nodejs-logging-winston

.github/scripts/close-invalid-link.cjs

@@ -12,21 +12,26 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+const fs = require('fs');
+const yaml = require('js-yaml');
+const path = require('path');
+const TEMPLATE_FILE_PATH = path.resolve(__dirname, '../ISSUE_TEMPLATE/bug_report.yml')
+
 async function closeIssue(github, owner, repo, number) {
     await github.rest.issues.createComment({
           owner: owner,
           repo: repo,
           issue_number: number,
-          body: 'Issue was opened with an invalid reproduction link. Please make sure the repository is a valid, publicly-accessible github repository, and make sure the url is complete (example: https://github.com/googleapis/google-cloud-node)'
+          body: "Issue was opened with an invalid reproduction link. Please make sure the repository is a valid, publicly-accessible github repository, and make sure the url is complete (example: https://github.com/googleapis/google-cloud-node)"
         });
     await github.rest.issues.update({
         owner: owner,
         repo: repo,
         issue_number: number,
-        state: 'closed'
+        state: "closed"
       });
 }
-module.exports = async ({github, context}) => {
+module.exports = async ({ github, context }) => {
     const owner = context.repo.owner;
     const repo = context.repo.repo;
     const number = context.issue.number;
@@ -37,20 +42,32 @@ module.exports = async ({github, context}) => {
       issue_number: number,
     });
 
-    const isBugTemplate = issue.data.body.includes('Link to the code that reproduces this issue');
+    const yamlData = fs.readFileSync(TEMPLATE_FILE_PATH, 'utf8');
+    const obj = yaml.load(yamlData);
+    const linkMatchingText = (obj.body.find(x => {return x.type === 'input' && x.validations.required === true && x.attributes.label.includes('link')})).attributes.label;
+    const isBugTemplate = issue.data.body.includes(linkMatchingText);
 
     if (isBugTemplate) {
         console.log(`Issue ${number} is a bug template`)
         try {
-            const link = issue.data.body.split('\n')[18].match(/(https?:\/\/(gist\.)?github.com\/.*)/)[0];
-            console.log(`Issue ${number} contains this link: ${link}`)
-            const isValidLink = (await fetch(link)).ok;
-            console.log(`Issue ${number} has a ${isValidLink ? 'valid' : 'invalid'} link`)
-            if (!isValidLink) {
-            await closeIssue(github, owner, repo, number);
-            }
+            const text = issue.data.body;
+            const match = text.indexOf(linkMatchingText);
+            if (match !== -1) {
+                const nextLineIndex = text.indexOf('http', match);
+                if (nextLineIndex == -1) {
+                    await closeIssue(github, owner, repo, number);
+                    return;
+                }
+                const link = text.substring(nextLineIndex, text.indexOf('\n', nextLineIndex));
+                console.log(`Issue ${number} contains this link: ${link}`);
+                const isValidLink = (await fetch(link)).ok;
+                console.log(`Issue ${number} has a ${isValidLink ? "valid" : "invalid"} link`)
+                if (!isValidLink) {
+                    await closeIssue(github, owner, repo, number);
+                }
+              }            
         } catch (err) {
             await closeIssue(github, owner, repo, number);
         }
     }
-};
+};

.github/scripts/close-unresponsive.cjs

@@ -1,4 +1,4 @@
-// Copyright 2024 Google LLC
+/// Copyright 2024 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -13,57 +13,57 @@
 // limitations under the License.
 
 function labeledEvent(data) {
-    return data.event === 'labeled' && data.label.name === 'needs more info';
-  }
-
-  const numberOfDaysLimit = 15;
-  const close_message = `This has been closed since a request for information has \
-  not been answered for ${numberOfDaysLimit} days. It can be reopened when the \
-  requested information is provided.`;
-
-  module.exports = async ({github, context}) => {
-    const owner = context.repo.owner;
-    const repo = context.repo.repo;
-
-    const issues = await github.rest.issues.listForRepo({
-      owner: owner,
-      repo: repo,
-      labels: 'needs more info',
-    });
-    const numbers = issues.data.map((e) => e.number);
-
-    for (const number of numbers) {
-      const events = await github.paginate(
-        github.rest.issues.listEventsForTimeline,
-        {
-          owner: owner,
-          repo: repo,
-          issue_number: number,
-        },
-        (response) => response.data.filter(labeledEvent)
-      );
-
-      const latest_response_label = events[events.length - 1];
-
-      const created_at = new Date(latest_response_label.created_at);
-      const now = new Date();
-      const diff = now - created_at;
-      const diffDays = diff / (1000 * 60 * 60 * 24);
-
-      if (diffDays > numberOfDaysLimit) {
-        await github.rest.issues.update({
-          owner: owner,
-          repo: repo,
-          issue_number: number,
-          state: 'closed',
-        });
-
-        await github.rest.issues.createComment({
-          owner: owner,
-          repo: repo,
-          issue_number: number,
-          body: close_message,
-        });
-      }
+  return data.event === "labeled" && data.label.name === "needs more info";
+}
+
+const numberOfDaysLimit = 15;
+const close_message = `This has been closed since a request for information has \
+not been answered for ${numberOfDaysLimit} days. It can be reopened when the \
+requested information is provided.`;
+
+module.exports = async ({ github, context }) => {
+  const owner = context.repo.owner;
+  const repo = context.repo.repo;
+
+  const issues = await github.rest.issues.listForRepo({
+    owner: owner,
+    repo: repo,
+    labels: "needs more info",
+  });
+  const numbers = issues.data.map((e) => e.number);
+
+  for (const number of numbers) {
+    const events = await github.paginate(
+      github.rest.issues.listEventsForTimeline,
+      {
+        owner: owner,
+        repo: repo,
+        issue_number: number,
+      },
+      (response) => response.data.filter(labeledEvent)
+    );
+
+    const latest_response_label = events[events.length - 1];
+
+    const created_at = new Date(latest_response_label.created_at);
+    const now = new Date();
+    const diff = now - created_at;
+    const diffDays = diff / (1000 * 60 * 60 * 24);
+
+    if (diffDays > numberOfDaysLimit) {
+      await github.rest.issues.update({
+        owner: owner,
+        repo: repo,
+        issue_number: number,
+        state: "closed",
+      });
+
+      await github.rest.issues.createComment({
+        owner: owner,
+        repo: repo,
+        issue_number: number,
+        body: close_message,
+      });
     }
-  };
+  }
+};

.github/scripts/fixtures/invalidIssueBody.txt

@@ -0,0 +1,50 @@
+### Please make sure you have searched for information in the following guides.
+
+- [X] Search the issues already opened: https://github.com/GoogleCloudPlatform/google-cloud-node/issues
+- [X] Search StackOverflow: http://stackoverflow.com/questions/tagged/google-cloud-platform+node.js
+- [X] Check our Troubleshooting guide: https://googlecloudplatform.github.io/google-cloud-node/#/docs/guides/troubleshooting
+- [X] Check our FAQ: https://googlecloudplatform.github.io/google-cloud-node/#/docs/guides/faq
+- [X] Check our libraries HOW-TO: https://github.com/googleapis/gax-nodejs/blob/main/client-libraries.md
+- [X] Check out our authentication guide: https://github.com/googleapis/google-auth-library-nodejs
+- [X] Check out handwritten samples for many of our APIs: https://github.com/GoogleCloudPlatform/nodejs-docs-samples
+
+### A screenshot that you have tested with "Try this API".
+
+
+N/A
+
+### Link to the code that reproduces this issue. A link to a **public** Github Repository or gist with a minimal reproduction.
+
+not-a-link
+
+### A step-by-step description of how to reproduce the issue, based on the linked reproduction.
+
+
+Change MY_PROJECT to your project name, add credentials if needed and run.
+
+### A clear and concise description of what the bug is, and what you expected to happen.
+
+The application crashes with the following exception (which there is no way to catch). It should just emit error, and allow graceful handling.
+TypeError [ERR_INVALID_ARG_TYPE]: The "chunk" argument must be of type string or an instance of Buffer or Uint8Array. Received an instance of Object
+    at _write (node:internal/streams/writable:474:13)
+    at Writable.write (node:internal/streams/writable:502:10)
+    at Duplexify._write (/project/node_modules/duplexify/index.js:212:22)
+    at doWrite (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:390:139)
+    at writeOrBuffer (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:381:5)
+    at Writable.write (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:302:11)
+    at Pumpify.<anonymous> (/project/node_modules/@google-cloud/speech/build/src/helpers.js:79:27)
+    at Object.onceWrapper (node:events:633:26)
+    at Pumpify.emit (node:events:518:28)
+    at obj.<computed> [as _write] (/project/node_modules/stubs/index.js:28:22)
+    at doWrite (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:390:139)
+    at writeOrBuffer (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:381:5)
+    at Writable.write (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:302:11)
+    at PassThrough.ondata (node:internal/streams/readable:1007:22)
+    at PassThrough.emit (node:events:518:28)
+    at addChunk (node:internal/streams/readable:559:12) {
+  code: 'ERR_INVALID_ARG_TYPE'
+
+
+### A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **
+
+No library should crash an application this way.

.github/scripts/fixtures/validIssueBody.txt

@@ -0,0 +1,50 @@
+### Please make sure you have searched for information in the following guides.
+
+- [X] Search the issues already opened: https://github.com/GoogleCloudPlatform/google-cloud-node/issues
+- [X] Search StackOverflow: http://stackoverflow.com/questions/tagged/google-cloud-platform+node.js
+- [X] Check our Troubleshooting guide: https://googlecloudplatform.github.io/google-cloud-node/#/docs/guides/troubleshooting
+- [X] Check our FAQ: https://googlecloudplatform.github.io/google-cloud-node/#/docs/guides/faq
+- [X] Check our libraries HOW-TO: https://github.com/googleapis/gax-nodejs/blob/main/client-libraries.md
+- [X] Check out our authentication guide: https://github.com/googleapis/google-auth-library-nodejs
+- [X] Check out handwritten samples for many of our APIs: https://github.com/GoogleCloudPlatform/nodejs-docs-samples
+
+### A screenshot that you have tested with "Try this API".
+
+
+N/A
+
+### Link to the code that reproduces this issue. A link to a **public** Github Repository or gist with a minimal reproduction.
+
+https://gist.github.com/orgads/13cbf44c91923da27d8772b5f10489c9
+
+### A step-by-step description of how to reproduce the issue, based on the linked reproduction.
+
+
+Change MY_PROJECT to your project name, add credentials if needed and run.
+
+### A clear and concise description of what the bug is, and what you expected to happen.
+
+The application crashes with the following exception (which there is no way to catch). It should just emit error, and allow graceful handling.
+TypeError [ERR_INVALID_ARG_TYPE]: The "chunk" argument must be of type string or an instance of Buffer or Uint8Array. Received an instance of Object
+    at _write (node:internal/streams/writable:474:13)
+    at Writable.write (node:internal/streams/writable:502:10)
+    at Duplexify._write (/project/node_modules/duplexify/index.js:212:22)
+    at doWrite (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:390:139)
+    at writeOrBuffer (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:381:5)
+    at Writable.write (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:302:11)
+    at Pumpify.<anonymous> (/project/node_modules/@google-cloud/speech/build/src/helpers.js:79:27)
+    at Object.onceWrapper (node:events:633:26)
+    at Pumpify.emit (node:events:518:28)
+    at obj.<computed> [as _write] (/project/node_modules/stubs/index.js:28:22)
+    at doWrite (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:390:139)
+    at writeOrBuffer (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:381:5)
+    at Writable.write (/project/node_modules/duplexify/node_modules/readable-stream/lib/_stream_writable.js:302:11)
+    at PassThrough.ondata (node:internal/streams/readable:1007:22)
+    at PassThrough.emit (node:events:518:28)
+    at addChunk (node:internal/streams/readable:559:12) {
+  code: 'ERR_INVALID_ARG_TYPE'
+
+
+### A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **
+
+No library should crash an application this way.