Comparing changes

…1798) Since ReAuth is a second factor credential, it is not necessary to require UV here. This was discussed with ReAuth folks. Also, in practice, downstream clients disregard this because the U2F protocol doesn't expose UV enforcement. --------- Co-authored-by: Kevin Zheng <147537668+gkevinzheng@users.noreply.github.com> Co-authored-by: Chalmer Lowe <chalmerlowe@google.com> Co-authored-by: Anthonios Partheniou <partheniou@google.com>

addresses #1781 * Moves away from using `utcfromtimestamp()` in the `datetime` library due to deprecation. * Adds a new helper function to manage internal handling of timezone aware versus timezone naive timestamps. ``` DeprecationWarning: datetime.datetime.utcfromtimestamp() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.fromtimestamp(timestamp, datetime.UTC). ``` --------- Co-authored-by: Kevin Zheng <147537668+gkevinzheng@users.noreply.github.com> Co-authored-by: Chalmer Lowe <chalmerlowe@google.com>

Currently, `google.auth.default()` always attempts to authenticate using the Google Compute Engine (GCE) metadata service as a fallback. There is no easy way to prevent this behavior, leading to unnecessary delays and unhelpful exceptions, particularly in cases where GCE-based authentication is pointless or undesired. This pull request introduces a `NO_GCE_CHECK` environment variable, allowing users to explicitly skip GCE metadata service authentication. This implementation mirrors `NO_GCE_CHECK` in [googleapis/google-auth-library-java](https://github.com/googleapis/google-auth-library-java/blob/f154edb3d8503d29f0020b6904dfa40e034ded93/README.md?plain=1#L106-L119): > _The following are searched (in order) to find the Application Default Credentials:_ > > [...] > > 5. Google Compute Engine built-in credentials > - Skip this check by setting the environment variable `NO_GCE_CHECK=true` > [!NOTE] > Other clouds also provide similar environment variables, such as `AWS_EC2_METADATA_DISABLED` on AWS. This change is also tangentially related to the following pull requests: - #1488 - #1481 --------- Co-authored-by: Anthonios Partheniou <partheniou@google.com> Co-authored-by: Chalmer Lowe <chalmerlowe@google.com>

Treat empty strings as if the env var was not set. This fixes an issue where an environment variable for `GOOGLE_APPLICATION_CREDENTIALS` is set, but it empty. Because the default sentinel is `None`, the auth library attempts to load this file. Some systems can set or update an env var, but not unset an env var (e.g. Docker). Fixes: https://togithub.com/googleapis/python-pubsub/issues/983

The `rsa` library is archived, and scheduled to be removed. `google-auth` already supports an alternate implementation, using `cryptography`. This PR adds a warning to users still relying on the old library, and adds `rsa` as an optional dependency to allow users to continue to opt-in to rsa during deprecation persion After release, a follow-up version will remove rsa as a required dependency, leaving it only for opt-in users

This PR aims to replicate the functionality of the Nodejs library implemented here: https://togithub.com/googleapis/gcp-metadata/pull/275

When performing a IMDS request, the code incorrectly adds a content-type header to the request: `content-type: application/json` to AWS metadata (IMDS) GET requests.` Some services at AWS (such as AWS SageMaker Jupyter notebook) have a stricter than normal metadata server (IMDS, both v1 and v2) when it comes to handling incoming http requests. This PR removes the default content-header and replaces it with `None`. NOTE: initializing headers to `None` (instead of an empty `dict`) when no session token is present matches the existing behavior in `_get_metadata_role_name` and allows the transport adapter to handle default headers cleanly. This PR updates existing unit tests (`tests/test_aws.py`) to match the new behavior. NOTE: closing PR #1489 due to inactivity as we make the push to migrate this library to the `google-cloud-python` monorepo For more information about the genesis of this, see the following issue: https://issuetracker.google.com/issues/328089077

The indentation and leading/trailing newlines made it a little harder than necessary to `filterwarnings` the deprecation warning. (For instance, for pytest's filterwarnings, you'd need `"ignore:\\s+You are using a Python version 3.8:FutureWarning",`...)

Extracts unit tests into individual github actions to help parallelize the tests and increase development velocity.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google-cloud-compute](https://redirect.github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-compute) ([source](https://redirect.github.com/googleapis/google-cloud-python)) | `==1.41.0` → `==1.42.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/google-cloud-compute/1.42.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/google-cloud-compute/1.41.0/1.42.0?slim=true) | --- ### Release Notes <details> <summary>googleapis/google-cloud-python (google-cloud-compute)</summary> ### [`v1.42.0`](https://redirect.github.com/googleapis/google-cloud-python/releases/tag/google-cloud-compute-v1.42.0): google-cloud-compute 1.42.0 [Compare Source](https://redirect.github.com/googleapis/google-cloud-python/compare/google-cloud-compute-v1.41.0...google-cloud-compute-v1.42.0) ##### Features - Update Compute Engine v1 API to revision [`2025121`](https://redirect.github.com/googleapis/google-cloud-python/commit/20251210) ([#1137](https://redirect.github.com/googleapis/google-cloud-python/issues/1137)) ([63cc1cdf](https://redirect.github.com/googleapis/google-cloud-python/commit/63cc1cdf)) - Update Compute Engine v1 API to revision [`2025103`](https://redirect.github.com/googleapis/google-cloud-python/commit/20251031) ([63cc1cdf](https://redirect.github.com/googleapis/google-cloud-python/commit/63cc1cdf)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/googleapis/google-auth-library-python).  Co-authored-by: Chalmer Lowe <chalmerlowe@google.com>

@chalmerlowe

This PR fixes flaky system tests that fail when `google.auth.default()` picks up expired User Credentials. The previous logic only exempted failures if the `GOOGLE_APPLICATION_CREDENTIALS` environment variable pointed to a file ending in "authorized_user.json". However, User Credentials can be loaded from other locations (e.g., gcloud config), causing the test to fail with `RefreshError` instead of ignoring it as intended. Changes: - Added `isinstance` check for `google.oauth2.credentials.Credentials` to robustly identify User Credentials. - Added `invalid_client` to the list of ignored error messages, as this error can also occur with invalid tokens. - Applied these fixes to both sync and async system tests. --- *PR created automatically by Jules for task [13051961428180802207](https://jules.google.com/task/13051961428180802207) started by @chalmerlowe* Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: Chalmer Lowe <chalmerlowe@google.com>

We have a couple circular imports in the library: - _mtls_helper and _agent_identity_utils both require each other - credentials and _default form a cycle This makes it difficult to import the library into google3 This PR resolved the import issues

Some google3 tests were failing due to timeouts. It seems like there were some tests that preformed up to 10 retries, with exponential backoff between each one This PR mocks out sleep, so these tests will complete ~ instantly, rather than > 10 mins --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

…1938) Update the IAM endpoint so that it supports the certificate based Access control

The `rsa` library has been deprecated and archived. This PR adds `cryptography` as a the new preferred backend for RSA operations In the short term, both `rsa` and `cryptography` will be listed as dependencies. Soon, `rsa` will be removed, but still supported as an optional dependency. Eventually, it will be completely removed from the codebase. As a part of this change, I introduced new RSASigner and RSAVerifier wrapper classes, that can use either cryptography or rsa implementations. Previously, the library would only import one or the other, depending on if cryptography was installed. This simplifies the import structure, and puts rsa and cryptography on equal footing Fixes #912 Towards https://github.com/googleapis/google-auth-library-python/issues/1810 Towards #941 --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Add new required dependency to test constraints, to ensure minimum versions are tested Also, moved constraints file to 3.8, since 3.7 is no longer supported

PR created by the Librarian CLI to initialize a release. Merging this PR will auto trigger a release. Librarian Version: v1.0.1 Language Image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:b8058df4c45e9a6e07f6b4d65b458d0d059241dd34c814f151c8bf6b89211209 <details><summary>google-auth: 2.48.0</summary> ## [2.48.0](v2.47.0...v2.48.0) (2026-01-21) ### Features * honor `NO_GCE_CHECK` environment variable (#1610) ([383c982](383c9827)) * add configurable GCE Metadata Server retries (#1488) ([454b441](454b441b)) * add cryptography as required dependency (#1929) ([52558ae](52558ae2)) * Support the mTLS IAM domain for Certificate based Access (#1938) ([8dcf91a](8dcf91a1)) ### Bug Fixes * resolve circular imports (#1942) ([25c1b06](25c1b064)) * Use `user_verification=preferred` for ReAuth WebAuthn challenge (#1798) ([3f88a24](3f88a240)) * removes `content-header` from AWS IMDS get request (#1934) ([97bfea9](97bfea9e)) * detect correct auth when ADC env var is set but empty (#1374) ([bfc07e1](bfc07e10)) * replace deprecated utcfromtimestamp (#1799) ([e431f20](e431f20c)) </details>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comparing changes

Open a pull request

Commits on Jan 8, 2026

Commits on Jan 9, 2026

Commits on Jan 10, 2026

Commits on Jan 12, 2026

Commits on Jan 14, 2026

Commits on Jan 15, 2026

Commits on Jan 16, 2026

Commits on Jan 26, 2026

This comparison is taking too long to generate.

Uh oh!