BigQuery source refresh fails on Node 26 with node-fetch Premature close

[BigCactusLabs]

Summary

Evidence BigQuery source refresh can fail on Node 26 when the BigQuery connector/auth stack reads gzip/chunked responses from Google APIs through node-fetch@2. The failure is not credential-specific: a minimal unauthenticated request to the OAuth token endpoint reproduces the same response-body error, while Node's built-in fetch reads the same response successfully.

Versions observed

• @evidence-dev/evidence@40.1.8
• @evidence-dev/bigquery@2.0.12
• @google-cloud/bigquery@6.2.0 via the BigQuery connector
• Node 26.3.1 locally; app runtime pinned to Node 26.2.0
• BigQuery source configured with authenticator: gcloud-cli

Error

Invalid response body while trying to fetch https://oauth2.googleapis.com/token: Premature close

A similar Premature close can also occur when reading BigQuery API responses after auth succeeds.

Minimal reproduction of the response-body failure

With node-fetch@2 installed under Node 26:

const fetch = require("node-fetch");

fetch("https://oauth2.googleapis.com/token", {
  method: "POST",
  headers: { "content-type": "application/x-www-form-urlencoded" },
  body: "grant_type=invalid",
})
  .then(async (res) => {
    console.log("status", res.status, "encoding", res.headers.get("content-encoding"));
    console.log(await res.text());
  })
  .catch((err) => {
    console.error(err);
    process.exit(1);
  });

Observed output starts with:

status 400 encoding gzip
FetchError: Invalid response body while trying to fetch https://oauth2.googleapis.com/token: Premature close

The same request using Node 26 built-in fetch returns the JSON error body successfully.

Workaround verified locally

Forcing node-fetch@2 to use identity/uncompressed responses avoids the failure:

const fetch = require("node-fetch");

fetch(url, {
  ...options,
  compress: false,
});

Using that workaround as a Node preload for Evidence commands allowed evidence sources to complete successfully for BigQuery sources.

Expected behavior

Evidence BigQuery source refresh should either avoid this legacy node-fetch@2 gzip/chunk handling problem or use a dependency path compatible with Node 26 responses from Google APIs.

Privacy note

This report intentionally omits project IDs, local paths, account names, tokens, and dataset/table names.