Moved vso-task-lib download to runtime #5277
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
sanjuyadav24
force-pushed
the
user/sanjuyadav/vso_task_lib_runtime
branch
from
19984f2 to
7609295
Compare
sanjuyadav24
force-pushed
the
user/sanjuyadav/vso_task_lib_runtime
branch
from
7609295 to
6200e54
Compare
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
Pull Request Overview
This PR moves the vso-task-lib download from build time to runtime to mitigate security vulnerabilities (CVE-2022-0144, CVE-2022-3517, CVE-2017-18077) in the minimist and shelljs packages. The change ensures that users without custom tasks dependent on vso-task-lib are not exposed to these CVEs.
- Removes build-time download of vso-task-lib from the externals.sh script
- Implements runtime download functionality through a new VsoTaskLibManager class
- Adds telemetry tracking for vso-task-lib usage in NodeHandler
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| src/Misc/externals.sh | Removes the build-time download of vso-task-lib |
| src/Agent.Worker/VsoTaskLibManager.cs | New class implementing runtime download and extraction of vso-task-lib |
| src/Agent.Worker/Handlers/NodeHandler.cs | Integrates runtime download and adds telemetry tracking |
tarunramsinghani
approved these changes
Jul 23, 2025
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
tarunramsinghani
approved these changes
Jul 24, 2025
|
@microsoft-github-policy-service agree |
|
@microsoft-github-policy-service rerun |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
Agent code has few vulnerabilities due to vso-task-lib packaging few old minimist and shelljs packages
moving vso-task-lib loading to run time to avoid these CVEs for users not having custom task dependent on these
📌 AB#2301251
Description
Agent code has few vulnerabilities due to vso-task-lib packaging few old minimist and shelljs pacakages
moving vso-task-lib loading to run time to avoid these CVEs for users not having custom task depdendent on these
CVE-2022-0144
CVE-2022-3517
CVE-2017-18077
Risk Assessment (Low)
Moving the dependency to load from build time to run time, as this dependency is not required till NodeHandler is defined this is a safe place
Unit Tests Added or Updated (Yes / No)
No
Additional Testing Performed
Manually triggered pipelines and validate the folder is available at desired location for tasks using NodeHandler
Change Behind Feature Flag (Yes / No)
No (the original change to use these files is already behind FF, moving this as well in that FF condition
Tech Design / Approach
NA
Documentation Changes Required (Yes/No)
Na
Logging Added/Updated (Yes/No)
Yes
Telemetry Added/Updated (Yes/No)
NA
Rollback Scenario and Process (Yes/No)
Enable the feature flag
Dependency Impact Assessed and Regression Tested (Yes/No)
Yes