> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/enterprise/keeper-secrets-manager/2026/javascript-gcp-kms-storage-1.1.0.md).

# JavaScript GCP KMS Storage 1.1.0

Released on Oct 7, 2026

> **Breaking changes**
>
> **Node.js 22 or later required:** `@google-cloud/kms` 6.x requires it, and `engines.node` now declares `>=22`. Upgrade Node.js before you upgrade this package.
>
> **The config directory must be writable:** The atomic write creates a temp file next to the config file, so a config file inside a read-only directory now fails with `EACCES`. Make the directory writable.
>
> **A symlinked config path is no longer supported:** Reads and writes both reject one with an error that names the path. Point `keyVaultConfigFileLocation` or `KSM_CONFIG_FILE` at the real file.

### Updates

* **KSM-1553:** The package now loads under Yarn Plug'n'Play and pnpm with `hoist: false`. It no longer imports the undeclared `google-auth-library` directly.
* **KSM-1524:** `getToken()` no longer resolves to `undefined` on the Application Default Credentials path, which sent `RAW_ENCRYPT_DECRYPT` keys down the wrong crypto path. A failed token request now rejects with an error that carries only the message.
* **KSM-1370:** `createConfigFileIfMissing()` recreated the config file on any `fs.access` failure. It now recreates only on `ENOENT`; other failures propagate instead of overwriting the file.
* **KSM-1450, KSM-1458, KSM-1508:** Config writes are now atomic, so a crash mid-write can no longer leave a truncated config. A failed directory fsync no longer fails the write.
* **KSM-1455, KSM-1486:** `loadConfig()` and `decryptConfig()` now throw on a zero-length config file instead of silently re-encrypting it as empty.
* **KSM-1457:** A blank `KSM_CONFIG_FILE` environment variable or `keyVaultConfigFileLocation` option now falls back to the next config source, instead of resolving to the current working directory.
* **KSM-1459, KSM-1507:** `saveConfig()` no longer skips recreating the config file when it was deleted mid-process. Only `ENOENT` counts as deleted; any other access failure now rejects the save.
* **KSM-1460:** A KMS failure during config auto-encryption now reports as a KMS error instead of a damaged config file.
* **KSM-1461:** A failed `changeKey()` now rolls back the key type and encryption algorithm along with the key config, instead of leaving the config permanently undecryptable.
* **KSM-1516:** Every public method except `init()` now rejects until `init()` has completed.
* **KSM-1515:** `loadConfig()` now rejects a parsed config that isn't an object of string values, before any write.
* **KSM-1514:** The SDK now refuses a symlinked config path on read and on write, closing a path where a planted symlink could feed the SDK an attacker-chosen credential file.
* **KSM-1533, KSM-1563:** Raised the declared `axios` floor to `^1.20.0`, resolving known advisories, including a high-severity one that covers every release through 1.19.0, on the bearer-token requests this package makes to GCP Cloud KMS.

### **Resources**

* [npm package](https://www.npmjs.com/package/@keeper-security/secrets-manager-gcp)
* [JavaScript SDK Documentation](/keeperpam/secrets-manager/developer-sdk-library/javascript-sdk.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/release-notes/enterprise/keeper-secrets-manager/2026/javascript-gcp-kms-storage-1.1.0.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.