Uploading to Google Cloud Storage has been broken since Tesla was bumped from
1.18.2 to 1.18.3 on 2026-07-27 (#4913). History exports to a GCS backend
crash:
** (FunctionClauseError) no function clause matching in
Tesla.Multipart.assert_quoted_string_safe!/2
(google_gax 0.4.1) lib/google_api/gax/connection.ex:183: build_body/3
(google_api_storage 0.46.1) .../objects.ex:831: storage_objects_insert_simple/7
(lightning) lib/lightning/workorders/export_worker.ex:114: store_project_file/2
Tesla 1.18.3 now requires multipart part names to be binaries. google_gax
labels its metadata part with an atom, so every upload through
google_api_storage raises before the request is sent.
We can't fix this by moving versions in either direction:
- Upstream is archived. https://github.com/googleapis/elixir-google-api is
archived, and google_gax 0.4.1 (published 2021-12-28) is its last release.
- Tesla can't be pinned back. 1.18.3 was itself a security release; 1.18.2
reintroduces the CVEs it closed.
Proposal
Call the GCS JSON API directly from lib/lightning/storage/gcs.ex and drop the
google_api_storage dependency.
The module uses the library at only two call sites — an object insert and an
object delete — and get_url/1 already bypasses it entirely (it signs URLs via
gcs_signed_url). The Goth token and Tesla client stay as they are; only the
request builders are replaced. Removing the dep should also take google_gax
and poison out of the lockfile.
Uploading to Google Cloud Storage has been broken since Tesla was bumped from
1.18.2 to 1.18.3 on 2026-07-27 (#4913). History exports to a GCS backend
crash:
Tesla 1.18.3 now requires multipart part names to be binaries.
google_gaxlabels its metadata part with an atom, so every upload through
google_api_storageraises before the request is sent.We can't fix this by moving versions in either direction:
archived, and
google_gax0.4.1 (published 2021-12-28) is its last release.reintroduces the CVEs it closed.
Proposal
Call the GCS JSON API directly from
lib/lightning/storage/gcs.exand drop thegoogle_api_storagedependency.The module uses the library at only two call sites — an object insert and an
object delete — and
get_url/1already bypasses it entirely (it signs URLs viagcs_signed_url). The Goth token and Tesla client stay as they are; only therequest builders are replaced. Removing the dep should also take
google_gaxand
poisonout of the lockfile.