@google-cloud/profiler: upstream pprof dependency is effectively unmaintained

[nstandif]

@google-cloud/profiler pins pprof@4.0.0. google/pprof-nodejs hasn't released since v4.0.0 (Feb 2024). Renovate keeps deps moving, no humans landing PRs or triaging issues.

Stalled:

• pprof#323: CVE-2026-24842 fix (@mapbox/node-pre-gyp v2). Mergeable, blocked since March.
• pprof#327, pprof#328: more security PRs, same state.
• pprof#311: heap profiler race condition fix, ~1 year, no review.
• pprof#283, pprof#284: Node 21+ support, open since Feb 2024. No prebuilts past Node 16.
• pprof#227, pprof#236: inspector-based rewrite, abandoned 2022.

Downstream: forced overrides to clear security scanners, no Node 21+ without node-gyp, can't forward-pin pprof since @google-cloud/profiler literal-pins it.

The public docs at https://docs.cloud.google.com/profiler/docs/profiling-nodejs are misleading. They claim "Node.js 14 or higher" is supported and recommend using "the most recently released version of the agent," with no mention that the underlying pprof is effectively unmaintained, that no prebuilts ship for Node 17+, or that known security PRs are sitting unreviewed. A user following that page today gets a working install on Node 14-16 and a broken or insecure install on anything newer, with no warning.

Either the docs need to reflect reality, or someone needs to start landing PRs again.

[nstandif]

@aabmass, you're the most recent human committer here. Who owns the profiler agent and pprof now? CODEOWNERS says @googleapis/cloud-profiler-team but nobody from that team is active on either repo.

[pearigee]

I spoke with @aabmass , who confirmed that his team still has ownership of @google-cloud/profiler and pprof.

He's reviewing the open PRs (specifically google/pprof-nodejs#320). Check over there for updates.

[nstandif]

Does Google Cloud have a patched node 16?