Skip to content

Commit 1208b2f

Browse files
temblekingtembleking
authored
fix(deps): clear vulnerabilities in task dependencies (#22)
## Summary Fixes 14 vulnerabilities (10 HIGH, 4 MEDIUM) in the transitive dependencies of `package-lock.json` and `sysdig-cli-scan-task/package-lock.json`. It also brings in the routine updates from `just update`. ## Changes ### fix(deps) - **`azure-pipelines-task-lib` `^5.2.11` → `^5.281.0`** (root and `sysdig-cli-scan-task`). The new version no longer depends on `adm-zip` or `uuid`, which removes: - `adm-zip`: CVE-2026-102282, CVE-2026-39244, CVE-2026-77301, GHSA-8238-w5pm-2374, GHSA-rcw4-f5rp-g42v, GHSA-c6fg-446q-cg94, GHSA-p634-w6r4-rjp2 - `uuid`: CVE-2026-41907 - **`overrides.brace-expansion: ^1.1.21`**. It comes in through `minimatch@3.1.5`, which task-lib still pins, so the override is needed to fix: CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, CVE-2026-13149, CVE-2026-14257, CVE-2026-69152 The task only uses core task-lib APIs (`getInput`, `getBoolInput`, `getVariable`, `setVariable`, `setResult`, `tool`, `which`, `loc`), and it compiles cleanly with `tsc`. ### chore - `nix flake update` (nixpkgs 2026-06-16 → 2026-10-05) - `tfx-cli` 0.23.3 → 0.24.2 - Updated pinned GitHub Actions: `actions/checkout` v7.0.1, `nix-installer-action` v23, `magic-nix-cache-action` v15, `azure/login` v3.1.0 ## Verification - `adm-zip` and `uuid` are no longer in the dependency tree, and `brace-expansion` resolves to 1.1.21 - `tsc` build OK ## Known remaining - `braces@3.0.3` (GHSA-vfj7-8cjw-p6xm), via `shelljs` → `fast-glob` → `micromatch`. **No fixed version has been published yet**, so it is out of scope for now. The `npm audit fix --force` that npm suggests would downgrade task-lib, so I didn't apply it.
1 parent 2184743 commit 1208b2f

11 files changed

Lines changed: 55 additions & 101 deletions

File tree

‎.github/workflows/ci-pull-request.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,18 @@ jobs:
1818
shell: nix develop --command bash {0}
1919
steps:
2020
- name: Checkout code
21-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
21+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2222

2323
- name: Install Nix
24-
uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
24+
uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
2525

2626
- name: Enable Nix cache
27-
uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
27+
uses: DeterminateSystems/magic-nix-cache-action@84c0677f58dcedf3b91f8223ce36a9ea5b3c84b7 # v15
2828
with:
2929
use-flakehub: false
3030

3131
- name: Login to Azure DevOps
32-
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
32+
uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
3333
with:
3434
client-id: ${{ secrets.AZURE_APPLICATION_CLIENT_ID }}
3535
tenant-id: ${{ secrets.AZURE_TENANT_ID }}

‎.github/workflows/main.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,15 +23,15 @@ jobs:
2323
shell: nix develop --command bash {0}
2424
steps:
2525
- name: Checkout code
26-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
26+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2727
with:
2828
fetch-depth: 0 # Need history to compare versions
2929

3030
- name: Install Nix
31-
uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
31+
uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
3232

3333
- name: Enable Nix cache
34-
uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
34+
uses: DeterminateSystems/magic-nix-cache-action@84c0677f58dcedf3b91f8223ce36a9ea5b3c84b7 # v15
3535
with:
3636
use-flakehub: false
3737

@@ -54,7 +54,7 @@ jobs:
5454
5555
- name: Login to Azure DevOps
5656
if: steps.check_version.outputs.changed == 'true'
57-
uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
57+
uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
5858
with:
5959
client-id: ${{ secrets.AZURE_APPLICATION_CLIENT_ID }}
6060
tenant-id: ${{ secrets.AZURE_TENANT_ID }}

‎.github/workflows/sync-versions.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,17 +14,17 @@ jobs:
1414
shell: nix develop --command bash {0}
1515
steps:
1616
- name: Checkout code
17-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
17+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1818
with:
1919
ref: ${{ github.head_ref }}
2020
token: ${{ secrets.GITHUB_TOKEN }}
2121
fetch-depth: 0
2222

2323
- name: Install Nix
24-
uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
24+
uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
2525

2626
- name: Enable Nix cache
27-
uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
27+
uses: DeterminateSystems/magic-nix-cache-action@84c0677f58dcedf3b91f8223ce36a9ea5b3c84b7 # v15
2828
with:
2929
use-flakehub: false
3030

‎flake.lock‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎nix/tfx-cli.nix‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,16 @@
77
}:
88
buildNpmPackage rec {
99
pname = "tfx-cli";
10-
version = "0.23.3";
10+
version = "0.24.2";
1111

1212
src = fetchFromGitHub {
1313
owner = "Microsoft";
1414
repo = "tfs-cli";
15-
rev = "3c12ccb53f3fd700224d0db4490ebc0613df0b7e";
16-
hash = "sha256-gnADqxXmaweeaDzV3BTwVzHGjm7qZ4/QNWpx60iJLJ8=";
15+
rev = "69cc3ea887ccb08fccc2b37ffeacc1bdb8dddb7c";
16+
hash = "sha256-GXi/PNSzX3RRisX7rEXahu3sVldhee9IYMmaqx0JF+s=";
1717
};
1818

19-
npmDepsHash = "sha256-wZS8UZNmiuk68NKe8FJzHgqtY9Fs7oZEZALtuB6HRS0=";
19+
npmDepsHash = "sha256-sOraxuomTy6M+ws5I7TOYzdzTpAx+nUFcRT+tg0dfAk=";
2020

2121
# `npm run build` is `tsc -p .`; postbuild copies the bin entrypoint.
2222
npmBuildScript = "build";

‎package-lock.json‎

Lines changed: 8 additions & 28 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
{
22
"dependencies": {
3-
"azure-pipelines-task-lib": "^5.2.11",
3+
"azure-pipelines-task-lib": "^5.281.0",
44
"vss-web-extension-sdk": "^5.141.0"
5+
},
6+
"overrides": {
7+
"brace-expansion": "^1.1.21"
58
}
69
}

‎sysdig-cli-scan-task/package-lock.json‎

Lines changed: 18 additions & 50 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sysdig-cli-scan-task/package.json‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "sysdig-cli-scan-task",
3-
"version": "1.0.4",
3+
"version": "1.0.5",
44
"description": "Sysdig Secure Scan Task",
55
"main": "index.js",
66
"scripts": {
@@ -20,12 +20,15 @@
2020
"homepage": "https://github.com/sysdiglabs/sysdig-azure-devops-task.git#readme",
2121
"dependencies": {
2222
"@types/http-proxy-agent": "^4.0.1",
23-
"azure-pipelines-task-lib": "^5.2.11",
23+
"azure-pipelines-task-lib": "^5.281.0",
2424
"https-proxy-agent": "^7.0.4"
2525
},
2626
"devDependencies": {
2727
"@types/node": "^20.0.0",
2828
"@types/q": "^1.5.5",
2929
"typescript": "^5.0.0"
30+
},
31+
"overrides": {
32+
"brace-expansion": "^1.1.21"
3033
}
3134
}

‎sysdig-cli-scan-task/task.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"version": {
1111
"Major": 1,
1212
"Minor": 0,
13-
"Patch": 4
13+
"Patch": 5
1414
},
1515
"minimumAgentVersion": "3.232.1",
1616
"groups": [

0 commit comments

Comments
 (0)