google-auth: connection leaks in urllib3 transport and metadata helper during mTLS updates
Maintainers usually reply within 1 day
@nbayati is already working on this.
Since Oct 9, 2026.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 72/100
Research direction
Read google/auth/transport/urllib3.py and google/auth/compute_engine/_metadata.py, starting with configure_mtls_channel and the per-request MdsMtlsAdapter mounting path. Confirm the old PoolManager is cleaned up and the metadata adapter is reused or closed rather than accumulating sockets, then add or run focused regression tests for both paths.
Written by the indexing model from the issue text.
Description
When mTLS is configured or dynamically updated, the SDK creates and mounts new HTTP adapters/transports but leaves the old ones hanging. While PR #17689 addressed this for the requests transport, the leak still exists in two other places:
-
urllib3 transport (
google/auth/transport/urllib3.py)
Inconfigure_mtls_channel,self.http = new_httpreplaces the old PoolManager. We need to call.clear()on the oldPoolManagerinstance before overwriting it so that the active connection pool is cleaned up. -
Compute Engine metadata (
google/auth/compute_engine/_metadata.py)
If mTLS is enabled,_metadata.pyinstantiates and mounts a newMdsMtlsAdapteron the session for every single request. Overwriting the mounted adapter without closing the old one leaks sockets. We should either cache and reuse the adapter or close the old one before mounting.
- Dominant language
- Python
- Stars
- 5.4k
- Forks
- 1.8k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 173
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-cloud-python
-
firestore: field path with a quoted name ending in a backslash is misparsedPossibly taken @sebxt claimed this 25 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
googleapis/google-cloud-python#18771 ·
Maintainers usually reply within 1 day
-
api: spanner type: feature request
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
googleapis/google-cloud-python#18584 ·
Maintainers usually reply within 1 day
-
auth: `impersonated_credentials` loses `subject` on copy, so `with_scopes()` and `with_quota_project()` turn off domain wide delegationPossibly taken @Om-singhaI claimed this 55 days ago. Openauth priority: p2 type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
googleapis/google-cloud-python#18428 ·
Maintainers usually reply within 1 day
-
A client called `run_in_transaction` be stuck if Spanner is downPossibly taken @founderinaction claimed this 7 days ago. Openpriority: p2 type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/google-cloud-python#18375 · 1 comment ·
Maintainers usually reply within 1 day
-
ci: enable --strict flag in presubmit twine_checkMay be free again @ohmayr claimed this 44 days ago, and no pull request is open. Open
Difficulty 1/5 Under an hour Newbie friendliness 76/100
googleapis/google-cloud-python#18339 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
All issues in googleapis/google-cloud-python
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
cpp-best-practices/project_validator#267 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Project-N-E-K-O/N.E.K.O#3725 ·
Maintainers usually reply within 1 day
-
[Bug] Sending a Telegram message chain twice duplicates mentionsPossibly taken @123XieC claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
AstrBotDevs/AstrBot#11125 ·
Maintainers usually reply within 1 day
-
backend bug priority: high
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
nooriegarg/ContribIQ#73 ·
Maintainers usually reply within 1 day
-
bug p3 security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day