resource-detector-gcp pulls deprecated node-domexception via archived gaxios chain

[shimscho]

What happened

@opentelemetry/resource-detector-gcp (loaded via auto-instrumentations-node) transitively depends on a deprecated, unmaintained chain. Every install emits:

WARN deprecated subdependencies found: node-domexception@1.0.0

Reproduction

npm init -y
npm i @opentelemetry/auto-instrumentations-node@0.74.0
# or directly:
# npm i @opentelemetry/resource-detector-gcp@0.51.0

The deprecation warning is emitted by pnpm/npm during install. Verified against latest published versions on npm.

Dependency chain

@opentelemetry/auto-instrumentations-node@0.74.0
  └─ @opentelemetry/resource-detector-gcp@0.51.0   (engines: ^18.19.0 || >=20.6.0)
       └─ gcp-metadata@8.1.2
            └─ gaxios@7.1.4              (repo archived; last push 2025-10-31)
                 └─ node-fetch@3.3.2
                      └─ fetch-blob@3.2.0   (repo dormant since 2023-08-14)
                           └─ node-domexception@1.0.0   (all versions deprecated)

Why bumping gcp-metadata will not fix it this time

Same shape as #3358 (punycode warning, resolved by #3359 bumping gcp-metadata to v8). The current resource-detector-gcp already pulls gcp-metadata@8.1.2, so the deprecation persists.

The chain cannot be repaired upstream:

• googleapis/gaxios: archived (archived: true, last push 2025-10-31), no further releases.
• node-fetch/fetch-blob: dormant since 2023-08-14, fix PR fix(deps): remove deprecated node-domexception dependency node-fetch/fetch-blob#176 sits unmerged. Reviewer @YasharF stated: "I don't think node-fetch and related projects are being maintained anymore."
• node-domexception: maintainer deprecated every published version (1.0.0, 2.0.1, 2.0.2) with message "Use your platform's native DOMException instead". Native DOMException is available since Node 17.

Suggested options

1. Drop gcp-metadata from resource-detector-gcp and inline a minimal metadata-server call using global fetch. The package already requires node: '^18.19.0 || >=20.6.0' (per its engines field on npm), so global fetch is guaranteed available without bumping the supported Node range.
2. Wait for a gcp-metadata rewrite that drops gaxios. Unlikely given gaxios is archived and gcp-metadata's maintenance posture is unclear.
3. Accept the warning and document it. Weakest option, and it overlaps with shared use of node-fetch by app and resource-detector-gcp can result in https module not getting instrumented #2440 where the same chain causes a real instrumentation problem (not just cosmetic).

Option 1 likely also addresses #2440, since the root cause there is gaxios → require('node-fetch') evaluating before HTTP instrumentation can hook http/https. Removing gaxios/node-fetch from this path eliminates that early require.

Environment

• @opentelemetry/auto-instrumentations-node@0.74.0
• @opentelemetry/resource-detector-gcp@0.51.0
• Node 24.15.0, pnpm 10.33.2