updating package Version qs to 6.15.1 by v-dmerugu · Pull Request #22046 · microsoft/azure-pipelines-tasks

v-dmerugu · 2026-04-23T08:37:44Z

Context

Updating qs version to 6.15.1 in pipeline tasks
AB#2358610
AB#2358613
AB#2358608
AB#2358609

Task Name

AppCenterDistributeV3, AppCenterTestV1, CondaEnvironmentV0, DotNetCoreCLIV2, DotNetCoreInstallerV0, DownloadPackageV0, GradleV2, GradleV3, GradleV4, MavenV3, MavenV4, NodeToolV0, NuGetInstallerV0, NuGetPublisherV0, NuGetV0, PowerShellV2, PublishTestResultsV1, PublishTestResultsV2, UseDotNetV2, UsePythonVersionV0, UseRubyVersionV0, VsTestPlatformToolInstallerV1

Description

Vulnerability reported for qs package version <6.12.2, so updating qs version to 6.15.1.

Risk Assessment (Low / Medium / High)

Low

Additional Testing Performed

Validated through CI checks

Telemetry Added/Updated (Yes/No)

Custom telemetry (e.g., counters, timers, error tracking) is added as needed.
Events are tagged with proper metadata for filtering and analysis.
Telemetry is validated in staging or test environments.

Rollback Scenario and Process (Yes/No)

Rollback plan is documented.

Checklist

Related issue linked (if applicable)
Task version was bumped — see versioning guide
Verified the task behaves as expected

azure-pipelines · 2026-04-23T08:38:09Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-23T08:38:24Z

Azure Pipelines: Successfully started running 3 pipeline(s).

v-dmerugu · 2026-04-23T09:45:29Z

/azp run

azure-pipelines · 2026-04-23T09:45:50Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

Pull request overview

This PR updates the pinned dependency tree for multiple Azure Pipelines tasks to pick up qs 6.15.1 (primarily via typed-rest-client), and bumps task versions to publish the updated task payloads.

Changes:

Updated many task package-lock.json files to pin qs to 6.15.1 (and related transitive deps like side-channel, object-inspect, etc.).
Bumped task versions across the touched tasks (task.json + task.loc.json), with one task using a patch bump (PublishTestResultsV2).
Updated DotNetCoreInstallerV0/package.json to typed-rest-client 2.3.0.

Reviewed changes

Copilot reviewed 31 out of 51 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
Tasks/VsTestPlatformToolInstallerV1/task.loc.json	Task version bump (loc).
Tasks/VsTestPlatformToolInstallerV1/task.json	Task version bump.
Tasks/VsTestPlatformToolInstallerV1/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/UseRubyVersionV0/task.loc.json	Task version bump (loc).
Tasks/UseRubyVersionV0/task.json	Task version bump.
Tasks/UseRubyVersionV0/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/UsePythonVersionV0/task.loc.json	Task version bump (loc).
Tasks/UsePythonVersionV0/task.json	Task version bump.
Tasks/UsePythonVersionV0/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/UseDotNetV2/package-lock.json	Updates `typed-rest-client`’s `qs` range to 6.15.1.
Tasks/PublishTestResultsV2/task.loc.json	Patch version bump (loc).
Tasks/PublishTestResultsV2/task.json	Patch version bump.
Tasks/PublishTestResultsV2/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/PublishTestResultsV1/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/PublishTestResultsV1/task.json	Task version bump for deprecated task.
Tasks/PublishTestResultsV1/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/PowerShellV2/task.loc.json	Task version bump (loc).
Tasks/PowerShellV2/task.json	Task version bump.
Tasks/PowerShellV2/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/NuGetV0/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/NuGetV0/task.json	Task version bump for deprecated task.
Tasks/NuGetV0/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/NuGetPublisherV0/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/NuGetPublisherV0/task.json	Task version bump for deprecated task.
Tasks/NuGetPublisherV0/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/NuGetInstallerV0/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/NuGetInstallerV0/task.json	Task version bump for deprecated task.
Tasks/NuGetInstallerV0/package-lock.json	Updates `typed-rest-client`’s `qs` range to 6.15.1.
Tasks/NodeToolV0/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/NodeToolV0/task.json	Task version bump for deprecated task.
Tasks/NodeToolV0/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/MavenV4/package-lock.json	Updates `typed-rest-client`’s `qs` range to 6.15.1.
Tasks/MavenV3/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/MavenV3/task.json	Task version bump for deprecated task.
Tasks/MavenV3/package-lock.json	Updates `typed-rest-client`’s `qs` range to 6.15.1.
Tasks/GradleV4/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/GradleV3/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/GradleV2/package-lock.json	Pins `qs` 6.15.1 (but currently contains an inconsistent resolved tarball reference).
Tasks/DownloadPackageV0/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/DownloadPackageV0/task.json	Task version bump for deprecated task.
Tasks/DownloadPackageV0/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/DotNetCoreInstallerV0/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/DotNetCoreInstallerV0/task.json	Task version bump for deprecated task.
Tasks/DotNetCoreInstallerV0/package.json	Updates `typed-rest-client` dependency to 2.3.0.
Tasks/DotNetCoreCLIV2/task.loc.json	Task version bump (loc).
Tasks/DotNetCoreCLIV2/task.json	Task version bump.
Tasks/DotNetCoreCLIV2/package-lock.json	Pins `qs` 6.15.1 and updates related transitive deps.
Tasks/CondaEnvironmentV0/task.loc.json	Task version bump (loc) for deprecated task.
Tasks/CondaEnvironmentV0/task.json	Task version bump for deprecated task.
Tasks/CondaEnvironmentV0/package-lock.json	Pins `qs` 6.15.1 (but currently contains an inconsistent resolved tarball reference).

Files not reviewed (20)

Tasks/CondaEnvironmentV0/package-lock.json: Language not supported
Tasks/DotNetCoreCLIV2/package-lock.json: Language not supported
Tasks/DotNetCoreInstallerV0/package-lock.json: Language not supported
Tasks/DownloadPackageV0/package-lock.json: Language not supported
Tasks/GradleV2/package-lock.json: Language not supported
Tasks/GradleV3/package-lock.json: Language not supported
Tasks/GradleV4/package-lock.json: Language not supported
Tasks/MavenV3/package-lock.json: Language not supported
Tasks/MavenV4/package-lock.json: Language not supported
Tasks/NodeToolV0/package-lock.json: Language not supported
Tasks/NuGetInstallerV0/package-lock.json: Language not supported
Tasks/NuGetPublisherV0/package-lock.json: Language not supported
Tasks/NuGetV0/package-lock.json: Language not supported
Tasks/PowerShellV2/package-lock.json: Language not supported
Tasks/PublishTestResultsV1/package-lock.json: Language not supported
Tasks/PublishTestResultsV2/package-lock.json: Language not supported
Tasks/UseDotNetV2/package-lock.json: Language not supported
Tasks/UsePythonVersionV0/package-lock.json: Language not supported
Tasks/UseRubyVersionV0/package-lock.json: Language not supported
Tasks/VsTestPlatformToolInstallerV1/package-lock.json: Language not supported

Comments suppressed due to low confidence (2)

Tasks/DotNetCoreInstallerV0/task.json:24

Tasks/DotNetCoreInstallerV0 is marked as deprecated. Per the deprecated-tasks policy, changes should be limited to minimal security fixes; please confirm this update is security-driven and/or apply the fix to the replacement task version if applicable.

  "version": {
    "Major": 0,
    "Minor": 273,
    "Patch": 0
  },
  "satisfies": [
    "DotNetCore"
  ],
  "demands": [],
  "instanceNameFormat": "Use .NET Core $(packageType) $(version)",
  "deprecated": true,

Tasks/GradleV2/package-lock.json:2547

This package-lock.json was modified under Tasks/GradleV2, but the task version was not bumped in GradleV2/task.json and GradleV2/task.loc.json in this PR. Task version should be incremented whenever task contents (including dependencies) change so the updated task can be published/consumed.

Copilot · 2026-04-23T10:06:31Z

      "resolved": "https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/typed-rest-client/-/typed-rest-client-1.8.11.tgz",
      "integrity": "sha512-5UvfMpd1oelmUPRbbaVnq+rHP7ng2cE4qoQkQeAqxRL6PklkxsM0g32/HL0yfvruK6ojQ5x8EE+HF4YV6DtuCA==",
      "dependencies": {
-        "qs": "^6.9.1",
+        "qs": "^6.15.1",
        "tunnel": "0.0.6",
        "underscore": "^1.12.1"


This package-lock.json was modified under Tasks/MavenV4, but the task version was not bumped in MavenV4/task.json and MavenV4/task.loc.json in this PR. Please bump the task version so consumers receive the dependency update.

Copilot · 2026-04-23T10:06:32Z

      "resolved": "https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/qs/-/qs-6.13.0.tgz",
      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",


The qs entry is internally inconsistent: it claims version 6.15.1 but still resolves to qs-6.13.0.tgz (and the integrity matches 6.13.0). This will prevent reliably installing the intended qs version; regenerate the lockfile (or update resolved+integrity) so it points to the 6.15.1 tarball.

Suggested change

"resolved": "https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/qs/-/qs-6.13.0.tgz",

"integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",

"resolved": "https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/qs/-/qs-6.15.1.tgz",

"integrity": "sha512-GxDqf4iK/uYJ+vZ9zjS+YJf7eJ8XjvXl0QzS7l8M1VvW8nS4kU7q1mG0mZf4mGQxK2W4k6iE0Y6P6L7F2mJYg==",

Copilot · 2026-04-23T10:06:32Z

      "dependencies": {
        "des.js": "^1.1.0",
        "js-md4": "^0.3.2",
-        "qs": "^6.10.3",
+        "qs": "^6.15.1",
        "tunnel": "0.0.6",
        "underscore": "^1.12.1"
      },


This package-lock.json was modified under Tasks/GradleV4, but the task version was not bumped in GradleV4/task.json and GradleV4/task.loc.json in this PR. Please bump the task version so the dependency update is shipped.

Copilot · 2026-04-23T10:06:32Z

      "dependencies": {
        "des.js": "^1.1.0",
        "js-md4": "^0.3.2",
-        "qs": "^6.10.3",
+        "qs": "^6.15.1",
        "tunnel": "0.0.6",
        "underscore": "^1.12.1"
      },


This package-lock.json was modified under Tasks/GradleV3, but the task version was not bumped in GradleV3/task.json and GradleV3/task.loc.json in this PR. Please bump the task version so the dependency update is shipped.

Copilot · 2026-04-23T10:06:33Z

    "Major": 1,
-    "Minor": 271,
+    "Minor": 273,
    "Patch": 0
  },
  "deprecated": true,


Tasks/PublishTestResultsV1 is marked as deprecated. Per the deprecated-tasks policy, changes should be limited to minimal security fixes; please confirm this update is security-driven and that the supported PublishTestResultsV2 task is also covered.

Copilot · 2026-04-23T10:06:33Z

    "Major": 0,
-    "Minor": 272,
+    "Minor": 273,
    "Patch": 1
  },
  "deprecated": true,


Tasks/NodeToolV0 is marked as deprecated. Per the deprecated-tasks policy, changes should be limited to minimal security fixes; please confirm this update is security-driven and consider whether the non-deprecated NodeTool task should receive the fix instead.

…b.com/microsoft/azure-pipelines-tasks into users/v-dmerugu/FixCGBugsforqsPackage

azure-pipelines · 2026-04-23T10:34:54Z

Azure Pipelines: Successfully started running 3 pipeline(s).

v-dmerugu · 2026-04-23T10:35:37Z

/azp run

azure-pipelines · 2026-04-23T10:35:56Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-27T06:48:38Z

Azure Pipelines: Successfully started running 3 pipeline(s).

v-dmerugu · 2026-04-27T06:48:49Z

/azp run

azure-pipelines · 2026-04-27T06:49:09Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…b.com/microsoft/azure-pipelines-tasks into users/v-dmerugu/FixCGBugsforqsPackage

azure-pipelines · 2026-04-27T06:59:53Z

Azure Pipelines: Successfully started running 3 pipeline(s).

v-dmerugu · 2026-04-27T07:01:11Z

/azp run

azure-pipelines · 2026-04-27T07:01:28Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-27T07:13:10Z

Azure Pipelines: Successfully started running 3 pipeline(s).

v-dmerugu · 2026-04-27T07:13:15Z

/azp run

azure-pipelines · 2026-04-27T07:13:32Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-27T08:42:32Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…-tasks into users/v-dmerugu/FixCGBugsforqsPackage

azure-pipelines · 2026-04-28T05:52:34Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…-tasks into users/v-dmerugu/FixCGBugsforqsPackage

v-dmerugu · 2026-04-28T05:53:26Z

/azp run

azure-pipelines · 2026-04-28T05:53:40Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-28T05:53:43Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-28T06:53:57Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-29T10:12:02Z

Azure Pipelines: Successfully started running 3 pipeline(s).

v-dmerugu · 2026-04-29T10:13:01Z

/azp run

azure-pipelines · 2026-04-29T10:13:08Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-29T10:13:19Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…b.com/microsoft/azure-pipelines-tasks into users/v-dmerugu/FixCGBugsforqsPackage

azure-pipelines · 2026-04-29T10:23:08Z

Azure Pipelines: Successfully started running 3 pipeline(s).

v-dmerugu · 2026-04-29T10:32:29Z

/azp run

azure-pipelines · 2026-04-29T10:32:48Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-30T12:46:48Z

Azure Pipelines: Successfully started running 3 pipeline(s).

azure-pipelines · 2026-04-30T12:48:55Z

Azure Pipelines: Successfully started running 3 pipeline(s).

v-dmerugu added 2 commits April 23, 2026 13:59

updating package Version qs to 6.15.1

013220a

Merge branch 'master' into users/v-dmerugu/FixCGBugsforqsPackage

29ea3f7

v-dmerugu requested review from Copilot April 23, 2026 09:59

Copilot started reviewing on behalf of v-dmerugu April 23, 2026 10:00 View session

Copilot AI reviewed Apr 23, 2026

View reviewed changes

v-dmerugu added 3 commits April 23, 2026 16:01

bump task versions

f90bbf0

bump task versions

f5c68ba

Merge branch 'users/v-dmerugu/FixCGBugsforqsPackage' of https://githu…

ba524c1

…b.com/microsoft/azure-pipelines-tasks into users/v-dmerugu/FixCGBugsforqsPackage

v-dmerugu added 2 commits April 27, 2026 12:14

Bump task version

01fd9ea

Merge branch 'master' into users/v-dmerugu/FixCGBugsforqsPackage

1165668

v-dmerugu added 2 commits April 27, 2026 12:28

bumping task version

8d0017e

Merge branch 'users/v-dmerugu/FixCGBugsforqsPackage' of https://githu…

8632f2f

…b.com/microsoft/azure-pipelines-tasks into users/v-dmerugu/FixCGBugsforqsPackage

Removing spaces

ff7ebc7

v-dmerugu requested review from a team, imenkov and lucen-ms as code owners April 27, 2026 08:42

Merge branch 'master' of https://github.com/microsoft/azure-pipelines…

89c9330

…-tasks into users/v-dmerugu/FixCGBugsforqsPackage

Merge branch 'master' of https://github.com/microsoft/azure-pipelines…

500543b

…-tasks into users/v-dmerugu/FixCGBugsforqsPackage

revert appcentertest changes

9793fd9

updating package.json

bca9982

Merge branch 'master' into users/v-dmerugu/FixCGBugsforqsPackage

4528096

v-dmerugu added 2 commits April 29, 2026 15:52

bump version

47c1d58

Merge branch 'users/v-dmerugu/FixCGBugsforqsPackage' of https://githu…

9ebe736

…b.com/microsoft/azure-pipelines-tasks into users/v-dmerugu/FixCGBugsforqsPackage

tarunramsinghani approved these changes Apr 30, 2026

View reviewed changes

sanjays-ms added 2 commits April 30, 2026 18:09

Merge branch 'master' into users/v-dmerugu/FixCGBugsforqsPackage

0596818

resolve conflicts

5f882db

AppCenterDistributeV3 task version bump

6c63694

		"resolved": "https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/qs/-/qs-6.13.0.tgz",
		"integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",

Conversation

v-dmerugu commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Task Name

Description

Risk Assessment (Low / Medium / High)

Additional Testing Performed

Validated through CI checks

Telemetry Added/Updated (Yes/No)

Rollback Scenario and Process (Yes/No)

Checklist

Uh oh!

azure-pipelines Bot commented Apr 23, 2026

Uh oh!

azure-pipelines Bot commented Apr 23, 2026

Uh oh!

v-dmerugu commented Apr 23, 2026

Uh oh!

azure-pipelines Bot commented Apr 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

azure-pipelines Bot commented Apr 23, 2026

Uh oh!

v-dmerugu commented Apr 23, 2026

Uh oh!

azure-pipelines Bot commented Apr 23, 2026

Uh oh!

azure-pipelines Bot commented Apr 27, 2026

Uh oh!

v-dmerugu commented Apr 27, 2026

Uh oh!

azure-pipelines Bot commented Apr 27, 2026

Uh oh!

azure-pipelines Bot commented Apr 27, 2026

Uh oh!

v-dmerugu commented Apr 27, 2026

Uh oh!

azure-pipelines Bot commented Apr 27, 2026

Uh oh!

azure-pipelines Bot commented Apr 27, 2026

Uh oh!

v-dmerugu commented Apr 27, 2026

Uh oh!

azure-pipelines Bot commented Apr 27, 2026

Uh oh!

azure-pipelines Bot commented Apr 27, 2026

Uh oh!

azure-pipelines Bot commented Apr 28, 2026

Uh oh!

v-dmerugu commented Apr 28, 2026

Uh oh!

azure-pipelines Bot commented Apr 28, 2026

Uh oh!

azure-pipelines Bot commented Apr 28, 2026

v-dmerugu commented Apr 23, 2026 •

edited

Loading