Release JavaScript GCP KMS Storage v1.0.0

[stas-schaller]

Release of @keeper-security/secrets-manager-gcp v1.0.0

Google Cloud Key Management Service integration for secure storage of Keeper Secrets Manager configuration.

Dependencies:

• @keeper-security/secrets-manager-core v17.3.0
• @google-cloud/kms v4.5.0

Bug Fixes

• KSM-867: Fix getKeyDetails() silently swallowing errors — the catch block logged but did not rethrow, leaving key metadata (keyType, encryptionAlgorithm, isAsymmetric) uninitialized when getCryptoKey() fails (bad credentials, non-existent key, network error). init() now propagates the real GCP error. Regression tests for PERMISSION_DENIED and NOT_FOUND scenarios.
• KSM-837: Fix contains() — key in Object.keys(config) checked numeric array indices and always returned false for real config keys. Corrected to key in config. Add regression tests.
• KSM-840: Fix delete() — truthy check if (config[key]) silently skipped deletion of keys with falsy values ("", 0). Corrected to if (key in config). Add regression tests.
• KSM-847: Fix encryption/decryption error propagation — encryptBuffer() and decryptBuffer() in utils.ts returned empty values (Buffer.alloc(0) / "") on GCP KMS failure instead of rethrowing, silently discarding authentication failures, invalid key IDs, and permission errors; saveConfig() also caught and discarded errors without rethrowing; both layers now rethrow, making saveString(), saveBytes(), saveObject(), and changeKey() propagate GCP KMS failures as expected; changeKey()'s rollback path (key and crypto client restoration) is now reachable; removed vestigial blob.length > 0 guards in saveConfig() and createConfigFileIfMissing(), and dead plaintext.length > 0 guard in decryptConfig().
• KSM-849: Fix getBytes() — falsy check if (bytesString) treated an empty base64 string ("", produced by saving a zero-length Uint8Array) as absent, returning undefined instead of Uint8Array(0). Corrected to if (bytesString !== undefined). Add regression tests.
• KSM-858: Replace fast-crc32c with @aws-crypto/crc32c — fast-crc32c native C++ addon segfaults on ARM64 and was incorrectly listed in devDependencies, causing MODULE_NOT_FOUND for consumers. Replaced with @aws-crypto/crc32c (pure JS, AWS-maintained, no native addon).
• Normalize 5 methods from private to public to match Azure and AWS: contains(), isEmpty(), deleteAll(), readStorage(), saveStorage().

Code Quality (KSM-868)

• Replace console.warn with this.logger.warn() in saveConfig()
• Fix "KCP KMS" typo → "GCP KMS" in utils.ts error message
• Fix misleading "encrypt" log messages in decrypt contexts (decryptConfig(), loadConfig())
• Remove dead readStorage() null check (config initialized to {}, condition never triggers)
• Remove unused OAEP_PADDINg constant with typo and its crypto import
• Fix broken eslint.config.mjs glob pattern (src/*.ts} → src/**/*.ts)

Documentation (KSM-868)

• CHANGELOG: Add entries for KSM-867, KSM-837, KSM-840, KSM-849
• README: Remove debug console.log from examples, fix "an GCP" → "a GCP" grammar, replace bankAccount with password field type, fix heading indentation

Maintenance

• Update axios from 1.13.2 to 1.7.9 to resolve high severity SSRF vulnerability (CVE-2025-27152). One low severity transitive finding remains (@tootallnate/once@2.0.0 via @google-cloud/kms) — unfixable without upstream GCP SDK update, accepted as low risk. Grype rescan: 1 low finding.
• Fix jest TypeScript configuration — add tsconfig.test.json with @types/jest types and update jest.config.js to pass the test tsconfig to ts-jest, resolving LSP errors in test files.

Closes https://keeper.atlassian.net/browse/KSM-704
Closes https://keeper.atlassian.net/browse/KSM-837
Closes https://keeper.atlassian.net/browse/KSM-840
Closes https://keeper.atlassian.net/browse/KSM-847
Closes https://keeper.atlassian.net/browse/KSM-849
Closes https://keeper.atlassian.net/browse/KSM-858
Closes https://keeper.atlassian.net/browse/KSM-867
Closes https://keeper.atlassian.net/browse/KSM-868

To address the issue, the workflow YAML should be updated to specify a permissions block at the job or workflow root, stating the minimal necessary privileges. Since this workflow simply checks out code and runs tests — and does not perform write operations to the repository or PRs — the safest default is to set contents: read. This should be added as a new block immediately after the name: directive and before the on: directive (workflow root), or alternatively inside the test job. For clarity and to avoid unexpected privilege inheritance, the recommended location is at the workflow root; this will apply minimal permissions to all jobs.

No new methods or imports are needed to implement this; simply add the following YAML block in the right place:

permissions:
  contents: read

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​typescript-eslint/​parser@​8.47.0
	npm/​typescript-eslint@​8.47.0
	npm/​@​aws-crypto/​crc32c@​5.2.0
	npm/​@​babel/​preset-env@​7.28.5
	npm/​@​babel/​core@​7.28.5
	npm/​@​typescript-eslint/​eslint-plugin@​8.47.0
	npm/​@​types/​node@​22.19.1
	npm/​rimraf@​6.1.2
	npm/​pino-pretty@​13.1.2
	npm/​eslint@​9.39.1
	npm/​@​google-cloud/​kms@​5.4.0
	npm/​axios@​1.13.5
	npm/​pino@​10.1.0
	npm/​ts-jest@​29.4.5

View full report