fix: patch gaxios v7 Array.toString() stream corruption by gsquared94 · Pull Request #21884 · google-gemini/gemini-cli

gsquared94 · 2026-03-10T14:56:03Z

Root Cause

google-auth-library v10+ depends on gaxios v7.1.3 which has a bug in its _request method:

// BUGGY (gaxios v7.1.3):
const response = [];
for await (const chunk of data) {
  response.push(chunk);
}
translatedResponse.data = response.toString(); // Array.toString() = chunks.join(",")!

Array.toString() joins Buffer elements with commas, injecting stray commas at TCP chunk boundaries. This corrupts error response JSON — e.g. type.googleapis.com/google.rpc.ErrorInfo becomes type.googleapis.com/google,.rpc.ErrorInfo — causing TerminalQuotaError to be misclassified.

This was introduced when google-auth-library was upgraded from v9 to v10 and @google/genai from 1.30.0 to 1.41.0 in c3b52b82 (#18880). google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk).

Fix

Pins both packages to their pre-#18880 versions via npm overrides + direct dependency specs:

@google/genai: pinned to 1.30.0 (all workspace packages + override)
google-auth-library: pinned to ^9.15.1 (direct dep + override)

⚠️ DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream (unfixed as of v7.1.4).

Changed files

package.json — added npm overrides for both packages
packages/core/package.json — reverted both deps
packages/cli/package.json — reverted @google/genai
packages/a2a-server/package.json — pinned @google/genai (removed caret)
package-lock.json — updated resolution

scripts/patch_gaxios.js

gemini-code-assist · 2026-03-10T15:43:30Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves a critical data corruption issue stemming from a bug in gaxios v7.1.3, which was causing API stream responses to be malformed. The solution involves introducing a robust postinstall script that automatically patches all instances of the affected gaxios library, ensuring correct handling of stream data and preventing downstream errors. This proactive fix maintains system stability without requiring an upstream gaxios update.

Highlights

Gaxios v7 Stream Corruption Fix: Addressed a critical bug in gaxios v7.1.3 where Array.toString() incorrectly joined stream chunks with commas, corrupting JSON error responses and leading to misclassification of errors like TerminalQuotaError.
Postinstall Patch Script Implemented: Introduced a new scripts/patch_gaxios.js script that runs automatically during postinstall to find and replace the buggy response.toString() with response.join('') in all relevant gaxios v7 instances across the project.
Package.json Updated: Configured the package.json to execute the patch_gaxios.js script automatically after package installation, ensuring the fix is applied consistently.

Changelog

package.json
- Added a postinstall script entry to execute scripts/patch_gaxios.js.
scripts/patch_gaxios.js
- New file created to contain the logic for patching gaxios v7 instances.

Activity

No specific activity (comments, reviews, progress) has been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a postinstall script to patch a stream corruption bug in the gaxios v7 dependency, which is a clever workaround for an upstream issue. The change to simplify the TerminalQuotaError message is also a good defensive measure. While the patch script's reliance on hardcoded paths is noted, for a developer-facing script in a trusted environment, this approach can be acceptable. I've left a comment with suggestions for potential future improvements to make it more robust and maintainable if needed.

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix pins: - @google/genai to 1.30.0 (direct deps + npm override) - google-auth-library to ^9.15.1 (direct dep + npm override) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix reverts the dependency bumps from google-gemini#18880: - @google/genai: 1.41.0 → 1.30.0 (packages/core, packages/cli, packages/a2a-server) - google-auth-library: ^10.5.0 → ^9.11.0 (packages/core) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix reverts the dependency bumps from google-gemini#18880: - @google/genai: 1.41.0 → 1.30.0 (packages/core, packages/cli, packages/a2a-server) - google-auth-library: ^10.5.0 → ^9.11.0 (packages/core) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix reverts the dependency bumps from google-gemini#18880: - @google/genai: 1.41.0 → 1.30.0 (packages/core, packages/cli, packages/a2a-server) - google-auth-library: ^10.5.0 → ^9.11.0 (packages/core) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix reverts the dependency bumps from google-gemini#18880: - @google/genai: 1.41.0 → 1.30.0 (packages/core, packages/cli, packages/a2a-server) - google-auth-library: ^10.5.0 → ^9.11.0 (packages/core) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix reverts the dependency bumps from google-gemini#18880: - @google/genai: 1.41.0 → 1.30.0 (packages/core, packages/cli, packages/a2a-server) - google-auth-library: ^10.5.0 → ^9.11.0 (packages/core) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

packages/cli/src/ui/hooks/useGeminiStream.ts

sehoon38 · 2026-03-10T18:53:42Z

scripts/check-lockfile.js

+const gaxiosViolations = [];
+for (const [location, details] of Object.entries(packages)) {
+  if (
+    location.match(/^packages\/[^/]+\/node_modules\/gaxios$/) &&


Got this feedback which seems valid:

There is a slight flaw in the regex used for your preventative lockfile check in scripts/check-lockfile.js:

1 // Current PR code:
2 location.match(/^packages/[^/]+/node_modules/gaxios$/)

The problem: In an npm workspaces environment, gaxios might get hoisted to the root node_modules instead of being nested inside
packages//node_modules. If another dependency update triggers npm to hoist gaxios v7 to the root, its location string in
package-lock.json will simply be "node_modules/gaxios", and your regex will not match it, allowing the bug to slip through CI.

The fix: Update the regex to catch gaxios regardless of whether it is hoisted to the root or nested in a workspace:

1 // Proposed fix:
2 location.match(/(^|/)node_modules/gaxios$/)

sehoon38

approved after addressing the comments

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix reverts the dependency bumps from google-gemini#18880: - @google/genai: 1.41.0 → 1.30.0 (packages/core, packages/cli, packages/a2a-server) - google-auth-library: ^10.5.0 → ^9.11.0 (packages/core) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix reverts the dependency bumps from google-gemini#18880: - @google/genai: 1.41.0 → 1.30.0 (packages/core, packages/cli, packages/a2a-server) - google-auth-library: ^10.5.0 → ^9.11.0 (packages/core) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

@type

…eam corruption google-auth-library v10+ depends on gaxios v7.1.3 which has a bug: its _request() method reads stream error bodies using Array.toString(), which joins Buffer chunks with commas — corrupting JSON error responses at TCP chunk boundaries. This causes TerminalQuotaError to be misclassified due to corrupted @type fields in error details. This fix reverts the dependency bumps from google-gemini#18880: - @google/genai: 1.41.0 → 1.30.0 (packages/core, packages/cli, packages/a2a-server) - google-auth-library: ^10.5.0 → ^9.11.0 (packages/core) google-auth-library v9.x uses gaxios v6.x which correctly concatenates chunks via string addition (response += chunk). DO NOT upgrade these packages until the gaxios v7 bug is fixed upstream. See: google-gemini#21884

galz10 · 2026-03-10T22:54:07Z

/patch preview

github-actions · 2026-03-10T22:54:25Z

🚀 [Step 1/4] Patch workflow(s) waiting for approval!

📋 Details:

Channels: preview
Commit: 3ff68a9e55fbf45285f206464e9cbb09a73b2a98
Workflows Created: 1

⏳ Status: The patch creation workflow has been triggered and is waiting for deployment approval. Please visit the specific workflow links below and approve the runs.

🔗 Track Progress:

# Conflicts: # package-lock.json # packages/core/package.json

github-actions · 2026-03-10T22:58:18Z

🚀 [Step 2/4] Patch PR Created!

📋 Patch Details:

Environment: prod
Channel: preview → will publish to npm tag preview
Commit: 3ff68a9e55fbf45285f206464e9cbb09a73b2a98
Hotfix Branch: hotfix/v0.33.0-preview.14/0.33.0-preview.15/preview/cherry-pick-3ff68a9/pr-21884
Hotfix PR: #21940
⚠️ Status: Cherry-pick conflicts detected - manual resolution required

📝 Next Steps:

⚠️ Resolve conflicts in the hotfix PR first: #21940
Test your changes after resolving conflicts
Once merged, the patch release will automatically trigger
You'll receive updates here when the release completes

🔗 Track Progress:

galz10 · 2026-03-10T23:32:43Z

/patch preview

github-actions · 2026-03-10T23:33:02Z

🚀 [Step 1/4] Patch workflow(s) waiting for approval!

📋 Details:

Channels: preview
Commit: 3ff68a9e55fbf45285f206464e9cbb09a73b2a98
Workflows Created: 1

⏳ Status: The patch creation workflow has been triggered and is waiting for deployment approval. Please visit the specific workflow links below and approve the runs.

🔗 Track Progress:

github-actions · 2026-03-10T23:33:54Z

ℹ️ [Step 2/4] Patch branch exists but no PR found!

A patch branch hotfix/v0.33.0-preview.14/0.33.0-preview.15/preview/cherry-pick-3ff68a9/pr-21884 exists but has no open PR.

🔍 Issue: This might indicate an incomplete patch process.

📝 Next Steps:

Delete the branch: git branch -D hotfix/v0.33.0-preview.14/0.33.0-preview.15/preview/cherry-pick-3ff68a9/pr-21884
Run the patch command again

🔗 Links:

View branch on GitHub

galz10 · 2026-03-10T23:35:08Z

/patch preview

github-actions · 2026-03-10T23:35:30Z

🚀 [Step 1/4] Patch workflow(s) waiting for approval!

📋 Details:

Channels: preview
Commit: 3ff68a9e55fbf45285f206464e9cbb09a73b2a98
Workflows Created: 1

⏳ Status: The patch creation workflow has been triggered and is waiting for deployment approval. Please visit the specific workflow links below and approve the runs.

🔗 Track Progress:

# Conflicts: # package-lock.json # packages/core/package.json

github-actions · 2026-03-10T23:36:54Z

🚀 [Step 2/4] Patch PR Created!

📋 Patch Details:

Environment: prod
Channel: preview → will publish to npm tag preview
Commit: 3ff68a9e55fbf45285f206464e9cbb09a73b2a98
Hotfix Branch: hotfix/v0.33.0-preview.14/0.33.0-preview.15/preview/cherry-pick-3ff68a9/pr-21884
Hotfix PR: #21952
⚠️ Status: Cherry-pick conflicts detected - manual resolution required

📝 Next Steps:

⚠️ Resolve conflicts in the hotfix PR first: #21952
Test your changes after resolving conflicts
Once merged, the patch release will automatically trigger
You'll receive updates here when the release completes

🔗 Track Progress:

github-actions · 2026-03-11T00:17:19Z

🚀 [Step 3/4] Patch Release Waiting for Approval!

📋 Release Details:

Environment: prod
Channel: preview → publishing to npm tag preview
Version: v0.33.0-preview.14
Hotfix PR: Merged ✅
Release Branch: release/v0.33.0-preview.14-pr-21884

⏳ Status: The patch release has been triggered and is waiting for deployment approval. Please visit the specific workflow run link below and approve the deployment. You'll receive another update when it completes.

🔗 Track Progress:

github-actions · 2026-03-11T00:50:12Z

✅ [Step 4/4] Patch Release Complete!

📦 Release Details:

Version: 0.33.0-preview.15
NPM Tag: preview
Channel: preview
Dry Run: false

🎉 Status: Your patch has been successfully released and published to npm!

📝 What's Available:

GitHub Release: View release v0.33.0-preview.15
NPM Package: npm install @google/gemini-cli@preview

🔗 Links:

…i#21884)

gsquared94 requested review from a team as code owners March 10, 2026 14:56

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from 3b5f60c to 557fa64 Compare March 10, 2026 15:01

gsquared94 enabled auto-merge March 10, 2026 15:02

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from 557fa64 to 81479fd Compare March 10, 2026 15:05

gundermanc reviewed Mar 10, 2026

View reviewed changes

scripts/patch_gaxios.js Outdated Show resolved Hide resolved

gemini-code-assist bot reviewed Mar 10, 2026

View reviewed changes

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from 81479fd to 42b6909 Compare March 10, 2026 16:33

gsquared94 force-pushed the fix/gaxios-stream-corruption branch 2 times, most recently from 6f5e1ce to 70c82b4 Compare March 10, 2026 17:40

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from 70c82b4 to 19d08bf Compare March 10, 2026 17:52

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from 19d08bf to 5bfb366 Compare March 10, 2026 17:53

gsquared94 requested a review from sehoon38 March 10, 2026 17:55

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from 5bfb366 to e9fda9b Compare March 10, 2026 18:34

sehoon38 reviewed Mar 10, 2026

View reviewed changes

packages/cli/src/ui/hooks/useGeminiStream.ts Show resolved Hide resolved

sehoon38 reviewed Mar 10, 2026

View reviewed changes

sehoon38 approved these changes Mar 10, 2026

View reviewed changes

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from e9fda9b to efc678a Compare March 10, 2026 19:06

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from efc678a to 68bdf4b Compare March 10, 2026 19:12

mattKorwel approved these changes Mar 10, 2026

View reviewed changes

gsquared94 force-pushed the fix/gaxios-stream-corruption branch from 68bdf4b to 426549c Compare March 10, 2026 19:27

Merge branch 'main' into fix/gaxios-stream-corruption

6470e6a

gsquared94 added this pull request to the merge queue Mar 10, 2026

Merged via the queue into google-gemini:main with commit 3ff68a9 Mar 10, 2026
27 checks passed

gsquared94 deleted the fix/gaxios-stream-corruption branch March 10, 2026 20:36

github-actions bot pushed a commit that referenced this pull request Mar 10, 2026

fix: patch gaxios v7 Array.toString() stream corruption (#21884)

c1e74e2

# Conflicts: # package-lock.json # packages/core/package.json

github-actions bot pushed a commit that referenced this pull request Mar 10, 2026

fix: patch gaxios v7 Array.toString() stream corruption (#21884)

3f07aaf

# Conflicts: # package-lock.json # packages/core/package.json

github-actions bot mentioned this pull request Mar 11, 2026

📊 AI CLI 工具社区动态日报 2026-03-11 DenisZheng/agents-radar#7

Open

gemini-code-assist bot mentioned this pull request Mar 11, 2026

Changelog for v0.34.0-preview.0 #21965

Merged

JaisalJain pushed a commit to JaisalJain/gemini-cli that referenced this pull request Mar 11, 2026

fix: patch gaxios v7 Array.toString() stream corruption (google-gemin…

a3f325b

…i#21884)

liamhelmer pushed a commit to badal-io/gemini-cli that referenced this pull request Mar 12, 2026

fix: patch gaxios v7 Array.toString() stream corruption (google-gemin…

73451fd

…i#21884)

gsquared94 mentioned this pull request Mar 12, 2026

SSE serialization corruption causes incorrect 429 error classification and unnecessary retry loops #21704

Closed

yashodipmore pushed a commit to yashodipmore/geemi-cli that referenced this pull request Mar 21, 2026

fix: patch gaxios v7 Array.toString() stream corruption (google-gemin…

4202158

…i#21884)

SUNDRAM07 pushed a commit to SUNDRAM07/gemini-cli that referenced this pull request Mar 30, 2026

fix: patch gaxios v7 Array.toString() stream corruption (google-gemin…

a23152b

…i#21884)

Conversation

gsquared94 commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root Cause

Fix

Changed files

Uh oh!

Uh oh!

gemini-code-assist bot commented Mar 10, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

sehoon38 Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

gsquared94 Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

sehoon38 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

galz10 commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

galz10 commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

galz10 commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

gsquared94 commented Mar 10, 2026 •

edited

Loading