Fix CG alert: update minimatch 5.x to ^5.1.8 across 17 tasks (CVE-2026-27903)#22065
Open
sanjuyadav24 wants to merge 2 commits intomasterfrom
Open
Fix CG alert: update minimatch 5.x to ^5.1.8 across 17 tasks (CVE-2026-27903)#22065sanjuyadav24 wants to merge 2 commits intomasterfrom
sanjuyadav24 wants to merge 2 commits intomasterfrom
Conversation
sanjuyadav24
requested review from
a team,
b-barthel,
carl-tanner,
fadnavistanmay,
kunalkaroth and
tarunramsinghani
as code owners
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Contributor
Author
|
@copilot resolve the merge conflicts in this pull request |
Contributor
Resolved the merge conflicts in commit Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
sanjuyadav24
force-pushed
the
CopilotSkill/CGFix/2362016
branch
from
36b5d2d to
26b5697
Compare
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
1 similar comment
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
sanjuyadav24
force-pushed
the
CopilotSkill/CGFix/2362016
branch
from
ac7d9f2 to
a6346f8
Compare
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
1 similar comment
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
sanjuyadav24
force-pushed
the
CopilotSkill/CGFix/2362016
branch
from
3a1e908 to
509b05c
Compare
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
sanjuyadav24
force-pushed
the
CopilotSkill/CGFix/2362016
branch
from
509b05c to
30d5e42
Compare
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
1 similar comment
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
…6-27903) - Added override minimatch@>=5.0.0 <6.0.0: ^5.1.8 to fix transitive CVE - Affected via owned common packages -> mocha -> minimatch 5.1.6 - ADO Work Item: #2362016 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
sanjuyadav24
force-pushed
the
CopilotSkill/CGFix/2362016
branch
from
93ce1af to
cb0c977
Compare
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
sanjuyadav24
changed the title
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
This PR fixes a Component Governance security alert identified in AB#2362016.
Vulnerability Details:
Task Name
17 tasks affected (transitive via owned common packages -> mocha -> minimatch):
CargoAuthenticateV0, DotNetCoreCLIV2, DownloadPackageV0 (deprecated), DownloadPackageV1, GradleV2 (deprecated), GradleV3, GradleV4, MavenV2 (deprecated), MavenV3 (deprecated), MavenV4, NpmAuthenticateV0, NpmV1, NuGetCommandV2, NuGetToolInstallerV0, NuGetToolInstallerV1, PublishSymbolsV2, UseDotNetV2
Description
Added version-scoped override
"minimatch@>=5.0.0 <6.0.0": "^5.1.8"in all 17 CG-flagged tasks to fix CVE-2026-27903.minimatch 5.1.6 was pulled in transitively via owned common packages (
azure-pipelines-tasks-packaging-common,azure-pipelines-tasks-codeanalysis-common,azure-pipelines-tasks-codecoverage-tools) through theirmochadependency (mocha -> minimatchandmocha -> glob -> minimatch).The version-scoped override targets only minimatch 5.x instances without affecting the 3.x instances used by
azure-pipelines-task-liband other packages.Risk Assessment (Low)
This is a patch-level dependency update within minimatch 5.x (5.1.6 -> 5.1.8).
Upgrade risk analysis (via upgrade-risk-analyzer) from 5.1.6 to 5.1.8: all 26 flagged risks (ESM/CJS changes, Node version drops, API changes) apply only to major version jumps (5.x -> 9.x/10.x) and are not relevant to this patch-level update. No breaking API changes exist between 5.1.6 and 5.1.8.
The fix addresses a ReDoS vulnerability in
matchOne()with no functional changes expected.Change Behind Feature Flag (No)
Dependency updates don't use feature flags.
Tech Design / Approach
"minimatch@>=5.0.0 <6.0.0": "^5.1.8"in package.json for each taskDocumentation Changes Required (No)
No documentation changes needed for internal dependency updates.
Unit Tests Added or Updated (No)
No new tests needed -- existing tests validate task functionality.
Additional Testing Performed
node make.js build --task <TaskName> --BypassNpmAuditnpm ls minimatchin representative tasksLogging Added/Updated (No)
No logging changes needed.
Telemetry Added/Updated (No)
No telemetry changes needed.
Rollback Scenario and Process (Yes)
Revert this PR if any issues are found.
Dependency Impact Assessed and Regression Tested (Yes)
Checklist