Merge branch 'main' into patch-1

Author: chalmerlowe

.github/workflows/unittest.yml

@@ -0,0 +1,76 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  
+name: unittest
+jobs:
+  unit:
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        python: ['3.8']
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ matrix.python }}
+    - name: Install nox
+      run: |
+        python -m pip install --upgrade setuptools pip wheel
+        python -m pip install nox
+    - name: Run unit tests
+      env:
+        COVERAGE_FILE: .coverage-${{ matrix.python }}
+      run: |
+        nox -s unit-${{ matrix.python }}
+    - name: Upload coverage results
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage-artifact-${{ matrix.python }}
+        path: .coverage-${{ matrix.python }}
+        include-hidden-files: true
+
+  cover:
+    runs-on: ubuntu-latest
+    needs:
+        - unit
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.13"
+    - name: Install coverage
+      run: |
+        python -m pip install --upgrade setuptools pip wheel
+        python -m pip install coverage
+    - name: Download coverage results
+      uses: actions/download-artifact@v4
+      with:
+        path: .coverage-results/
+    - name: Report coverage results
+      run: |
+        find .coverage-results -type f -name '*.zip' -exec unzip {} \;
+        coverage combine .coverage-results/**/.coverage*
+        coverage report --show-missing --fail-under=99

.librarian/state.yaml

@@ -1,7 +1,7 @@
-image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:39628f6e89c9cad27973b9a39a50f7052bec0435ee58c7027b4fa6b655943e31
+image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:b8058df4c45e9a6e07f6b4d65b458d0d059241dd34c814f151c8bf6b89211209
 libraries:
   - id: google-auth
-    version: 2.45.0
+    version: 2.47.0
     last_generated_commit: 102d9f92ac6ed649a61efd9b208e4d1de278e9bb
     apis: []
     source_roots:

CHANGELOG.md

@@ -4,6 +4,40 @@
 
 [1]: https://pypi.org/project/google-auth/#history
 
+## [2.47.0](https://github.com/googleapis/google-auth-library-python/compare/v2.46.0...v2.47.0) (2026-01-06)
+
+
+### Features
+
+* drop `cachetools` dependency in favor of simple local implementation (#1590) ([5c07e1c4f52bc77a1b16fa3b7b3c5269c242f6f4](https://github.com/googleapis/google-auth-library-python/commit/5c07e1c4f52bc77a1b16fa3b7b3c5269c242f6f4))
+
+
+### Bug Fixes
+
+* Python 3.8 support (#1918) ([60dc20014a35ec4ba71e8065b9a33ecbdbeca97a](https://github.com/googleapis/google-auth-library-python/commit/60dc20014a35ec4ba71e8065b9a33ecbdbeca97a))
+
+## [2.46.0](https://github.com/googleapis/google-auth-library-python/compare/v2.45.0...v2.46.0) (2026-01-05)
+
+
+### Documentation
+
+* update urllib3 docstrings for v2 compatibility (#1903) ([3f1aeea2d1014ea1d244a4c3470e52d74d55404b](https://github.com/googleapis/google-auth-library-python/commit/3f1aeea2d1014ea1d244a4c3470e52d74d55404b))
+
+
+### Features
+
+* Recognize workload certificate config in has_default_client_cert_source for mTLS for Agentic Identities (#1907) ([0b9107d573123e358c347ffa067637f992af61b4](https://github.com/googleapis/google-auth-library-python/commit/0b9107d573123e358c347ffa067637f992af61b4))
+
+
+### Bug Fixes
+
+* add types to default and verify_token and Request __init__ based on comments in the source code. (#1588) ([59a5f588f7793b59d923a4185c8c07738da618f7](https://github.com/googleapis/google-auth-library-python/commit/59a5f588f7793b59d923a4185c8c07738da618f7))
+* fix the document of secure_authorized_session (#1536) ([5d0014707fc359782df5ccfcaa75fd372fe9dce3](https://github.com/googleapis/google-auth-library-python/commit/5d0014707fc359782df5ccfcaa75fd372fe9dce3))
+* remove setup.cfg configuration for creating universal wheels (#1693) ([c767531ce05a89002d109f595187aff1fcaacfb7](https://github.com/googleapis/google-auth-library-python/commit/c767531ce05a89002d109f595187aff1fcaacfb7))
+* use .read() instead of .content.read() in aiohttp transport (#1899) ([12f4470f808809e8abf1141f98d88ab720c3899b](https://github.com/googleapis/google-auth-library-python/commit/12f4470f808809e8abf1141f98d88ab720c3899b))
+* raise RefreshError for missing token in impersonated credentials (#1897) ([94d04e090fdfc61926dd32bc1d65f8820b9cede5](https://github.com/googleapis/google-auth-library-python/commit/94d04e090fdfc61926dd32bc1d65f8820b9cede5))
+* Fix test coverage for mtls_helper (#1886) ([02e71631fe275d93825c2e957e830773e75133f7](https://github.com/googleapis/google-auth-library-python/commit/02e71631fe275d93825c2e957e830773e75133f7))
+
 ## [2.45.0](https://github.com/googleapis/google-auth-library-python/compare/v2.44.0...v2.45.0) (2025-12-15)
 
 

CONTRIBUTING.rst

@@ -19,7 +19,7 @@ A few notes on making changes to ``google-auth-library-python``.
   using ``nox -s docs``.
 
 - The change must work fully on the following CPython versions:
-  3.7, 3.8, 3.9, 3.10, 3.11, 3.12 and 3.13 across macOS, Linux, and Windows.
+  3.8, 3.9, 3.10, 3.11, 3.12, 3.13 and 3.14 across macOS, Linux, and Windows.
 
 - The codebase *must* have 100% test statement coverage after each commit.
   You can test coverage via ``nox -e cover``.

README.rst

@@ -35,15 +35,16 @@ Note that the extras pyopenssl and enterprise_cert should not be used together b
 
 Supported Python Versions
 ^^^^^^^^^^^^^^^^^^^^^^^^^
-Python >= 3.7
+Python >= 3.8
 
 **NOTE**:
-Python 3.7 was marked as `unsupported`_ by the python community in June 2023.
-We recommend that all developers upgrade to Python 3.8 and newer as soon as
-they can. Support for Python 3.7 will be removed from this library after
-January 1 2024. Previous releases that support Python 3.7 will continue to be available
-for download, but releases after January 1 2024 will only target Python 3.8 and
-newer.
+Python 3.8 and Python 3.9 were marked as `unsupported`_ by the python community in 
+October 2024 and October 2025, respectively.
+We recommend that all developers upgrade to Python 3.10 and newer as soon as
+they can. Support for end-of-life Python runtimes will be removed from this
+library in future updates.
+Previous releases that support end-of-life Python versions will continue to be available
+for download, but future releases will only target supported versions.
 
 .. _unsupported: https://devguide.python.org/versions/#unsupported-versions
 
@@ -58,6 +59,10 @@ Unsupported Python Versions
 - Python 3.6:   The last version of this library with support for Python 3.6
   was `google.auth == 2.22.0`.
 
+- Python 3.7:   The last version of this library with support for Python 3.7
+  was `google.auth == 2.45.0`.
+
+
 Documentation
 -------------
 

google/auth/__init__.py

@@ -41,13 +41,17 @@ class Python37DeprecationWarning(DeprecationWarning):  # pragma: NO COVER
     pass
 
 
-# Checks if the current runtime is Python 3.7.
-if sys.version_info.major == 3 and sys.version_info.minor == 7:  # pragma: NO COVER
-    message = (
-        "After January 1, 2024, new releases of this library will drop support "
-        "for Python 3.7."
-    )
-    warnings.warn(message, Python37DeprecationWarning)
+# Raise warnings for deprecated versions
+eol_message = """
+    You are using a Python version {} past its end of life. Google will update
+    google-auth with critical bug fixes on a best-effort basis, but not
+    with any other fixes or features. Please upgrade your Python version,
+    and then update google-auth.
+    """
+if sys.version_info.major == 3 and sys.version_info.minor == 8:  # pragma: NO COVER
+    warnings.warn(eol_message.format("3.8"), FutureWarning)
+elif sys.version_info.major == 3 and sys.version_info.minor == 9:  # pragma: NO COVER
+    warnings.warn(eol_message.format("3.9"), FutureWarning)
 
 # Set default logging handler to avoid "No handler found" warnings.
 logging.getLogger(__name__).addHandler(logging.NullHandler())

google/auth/_cache.py

@@ -0,0 +1,64 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from collections import OrderedDict
+
+
+class LRUCache(dict):
+    def __init__(self, maxsize):
+        super().__init__()
+        self._order = OrderedDict()
+        self.maxsize = maxsize
+
+    def clear(self):
+        super().clear()
+        self._order.clear()
+
+    def get(self, key, default=None):
+        try:
+            value = super().__getitem__(key)
+            self._update(key)
+            return value
+        except KeyError:
+            return default
+
+    def __getitem__(self, key):
+        value = super().__getitem__(key)
+        self._update(key)
+        return value
+
+    def __setitem__(self, key, value):
+        maxsize = self.maxsize
+        if maxsize <= 0:
+            return
+        if key not in self:
+            while len(self) >= maxsize:
+                self.popitem()
+        super().__setitem__(key, value)
+        self._update(key)
+
+    def __delitem__(self, key):
+        super().__delitem__(key)
+        del self._order[key]
+
+    def popitem(self):
+        """Remove and return the least recently used key-value pair."""
+        key, _ = self._order.popitem(last=False)
+        return key, super().pop(key)
+
+    def _update(self, key):
+        try:
+            self._order.move_to_end(key)
+        except KeyError:
+            self._order[key] = None

google/auth/_default.py

@@ -16,13 +16,13 @@
 
 Implements application default credentials and project ID detection.
 """
+from __future__ import annotations
 
-from collections.abc import Sequence
 import io
 import json
 import logging
 import os
-from typing import Optional, TYPE_CHECKING
+from typing import Optional, Sequence, TYPE_CHECKING
 import warnings
 
 from google.auth import environment_vars

google/auth/_helpers.py

@@ -334,7 +334,8 @@ def is_python_3():
     Returns:
         bool: True if the Python interpreter is Python 3 and False otherwise.
     """
-    return sys.version_info > (3, 0)
+
+    return sys.version_info > (3, 0)  # pragma: NO COVER
 
 
 def _hash_sensitive_info(data: Union[dict, list]) -> Union[dict, list, str]:

google/auth/compute_engine/credentials.py

@@ -123,7 +123,7 @@ def _retrieve_info(self, request):
     def _metric_header_for_usage(self):
         return metrics.CRED_TYPE_SA_MDS
 
-    def _refresh_token(self, request):
+    def _perform_refresh_token(self, request):
         """Refresh the access token and scopes.
 
         Args: