Fix glob package vulnerability #1138

nemanjarogic · 2025-12-02T13:16:37Z

Fix glob package vulnerability by updating packages from which it is referenced (shelljs and mocha).

This only partially fixes the problem, since we depend on internal implementation of these packages and the newest version of mocha is based on glob 10.4.5. However, suggestion is to upgrade to 10.5.0, 11.1.0 or higher.

Additional explanation about changes made in PR:

node make.js test for /node directory for master branch (without any of mine changes) fails with the following error

node_modules/@types/node/buffer.d.ts(552,19): error TS2430: Interface 'Buffer' incorrectly extends interface 'Uint8Array<ArrayBufferLike>'.      
  The types of 'slice(...).buffer' are incompatible between these types.
    Type 'ArrayBufferLike' is not assignable to type 'ArrayBuffer'.
      Type 'SharedArrayBuffer' is not assignable to type 'ArrayBuffer'.
        Types of property '[Symbol.toStringTag]' are incompatible.
          Type '"SharedArrayBuffer"' is not assignable to type '"ArrayBuffer"'.
Unhandled rejection: exec:
Error: exec:
    at Object.error (C:\Repos\Github\azure-pipelines-task-lib\node\node_modules\shelljs\src\common.js:110:27)
    at execSync (C:\Repos\Github\azure-pipelines-task-lib\node\node_modules\shelljs\src\exec.js:120:12)
    at _exec (C:\Repos\Github\azure-pipelines-task-lib\node\node_modules\shelljs\src\exec.js:223:12)
    at C:\Repos\Github\azure-pipelines-task-lib\node\node_modules\shelljs\src\common.js:335:23
    at run (C:\Repos\Github\azure-pipelines-task-lib\node\buildutils.js:15:14)
    at target.test (C:\Repos\Github\azure-pipelines-task-lib\node\make.js:42:5)

node make.js test for /powershell directory for master branch (without any of mine changes) fails with the following error


mocha tool:
Unhandled rejection: mocha not found.  might need to run npm install
Error: mocha not found.  might need to run npm install
    at Object.ensureTool (C:\Repos\Github\azure-pipelines-task-lib\powershell\make-util.js:89:15)
    at target.test (C:\Repos\Github\azure-pipelines-task-lib\powershell\make.js:69:10)
    at global.target.<computed> [as test] (C:\Repos\Github\azure-pipelines-task-lib\powershell\node_modules\shelljs\make.js:36:40)
    at C:\Repos\Github\azure-pipelines-task-lib\powershell\node_modules\shelljs\make.js:48:27
    at Array.forEach (<anonymous>)
    at Timeout._onTimeout (C:\Repos\Github\azure-pipelines-task-lib\powershell\node_modules\shelljs\make.js:46:10)
    at listOnTimeout (node:internal/timers:588:17)
    at process.processTimers (node:internal/timers:523:7)

The mentioned problems are not the only ones, because consequent errors will be shown when errors above are fixed. Therefore, changes in this PR also fix testing infrastructure.

Work item: ADO#2335511

nemanjarogic · 2025-12-02T13:17:29Z

/azp run

azure-pipelines · 2025-12-02T13:17:42Z

Azure Pipelines successfully started running 1 pipeline(s).

nemanjarogic · 2025-12-03T13:21:48Z

/azp run

azure-pipelines · 2025-12-03T13:22:00Z

Azure Pipelines successfully started running 1 pipeline(s).

nemanjarogic · 2025-12-04T09:51:32Z

/azp run

azure-pipelines · 2025-12-04T09:51:44Z

Azure Pipelines successfully started running 1 pipeline(s).

nemanjarogic · 2025-12-04T10:42:26Z

/azp run

azure-pipelines · 2025-12-04T10:42:37Z

Azure Pipelines successfully started running 1 pipeline(s).

nemanjarogic · 2025-12-04T15:22:37Z

/azp run

azure-pipelines · 2025-12-04T15:22:49Z

Azure Pipelines successfully started running 1 pipeline(s).

raujaiswal · 2025-12-05T06:17:50Z

node/test/tsconfig.json

        "outDir": "../_test",
-        "moduleResolution": "node"
+        "moduleResolution": "node",
+        "skipLibCheck": true


Hi @nemanjarogic ,
With skipLibCheck: true, any inconsistencies inside .d.ts files will not be flagged by the TypeScript compiler. Could we consider removing this setting to ensure stricter type checking?
For more details, please refer to the discussion here: microsoft/azure-pipelines-extensions#1295 (comment)

It would be great if I can avoid this, but not sure how. The problem is not related to any file we have in this repository.
To make it even worse, I can reproduce this problem even on master branch.

When I try to run tests locally, they fail (I ensured that all folders like node_modules, _build, etc. are deleted after switching to master branch), however they work when executed on pipeline. I created a dummy PR to confirm this.

Therefore, if we don't have a concrete suggestion how to actually fix this, I would prefer to leave skipLibCheck. It ignores only files from dependencies, and not files in our repository, so I don't see that as a major issue. I am aware of cons, but need to unblock my PR. If needed this can be fixed as a separate work item from repo owners.

node/test/tsconfig.json

sanjuyadav24 · 2025-12-05T07:05:39Z

node/make.js

    process.env['TASKLIB_INPROC_UNITS'] = '1'; // export task-lib internals for internal unit testing
    set('+e'); // Don't throw an exception when tests fail
-    run('mocha ' + testPath);
+    run('npx mocha ' + testPath);


why add npx here?

Because without it I was getting
'mocha' is not recognized as an internal or external command

sanjuyadav24 · 2025-12-05T07:19:09Z

node/internal.ts

    }

-    _debug(name + '=' + varval);
+    if (!skipDebug) {


please add a comment why skipDebug is required here

this doesn't seem to be related to glob vulnerability fix, should this be part of separate repo?

I left that in PR description, but will leave it here since description will be modified (and this change is no longer needed since I managed to avoid es upgrade).

skipDebug parameter in node/internal.ts is introduced to avoid circular dependency and compilator error that happens while resolving debugMode field (debugMode -> getVariable() -> _debug() -> debugMode). With ES5 fields

const debugMode = _getVariable('system.debug')?.toLowerCase() === 'true'; const shouldCheckDebugMode = _getVariable('DistributedTask.Tasks.Node.SkipDebugLogsWhenDebugModeOff')?.toLowerCase() === 'true';

were converted to

var debugMode = ... var shouldCheckDebugMode = ...

However, with ES2020 that is no longer case and we have compilator error due to circular dependency.

P.S. Even if this works with ES5, I think we have bug here, because debugMode and shouldCheckDebugMode will always be falsy when this happens (they are not initialized).

nemanjarogic · 2025-12-05T12:32:01Z

/azp run

azure-pipelines · 2025-12-05T12:32:13Z

Azure Pipelines successfully started running 1 pipeline(s).

Fix glob package vulnerability

1f339d6

nemanjarogic requested review from a team as code owners December 2, 2025 13:16

Fix build

0e0f10a

nemanjarogic added 3 commits December 4, 2025 10:05

Upgrade version and partially fix tests

e950a7e

Fix powershell test

01da704

Fix node tests

34b4e75

nemanjarogic added 2 commits December 4, 2025 11:34

Minimize changes

de4ea7d

Update typescript version

8256c1f

Align es versions

3e5befb

raujaiswal reviewed Dec 5, 2025

View reviewed changes

sanjuyadav24 reviewed Dec 5, 2025

View reviewed changes

nemanjarogic added 2 commits December 5, 2025 12:31

Minimize changes and revert from migration to es2020

37d5578

Remove unnecessary changes

9104892

Fix glob package vulnerability #1138

Are you sure you want to change the base?

Fix glob package vulnerability #1138

Uh oh!

Conversation

nemanjarogic commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nemanjarogic commented Dec 2, 2025

Uh oh!

azure-pipelines bot commented Dec 2, 2025

Uh oh!

nemanjarogic commented Dec 3, 2025

Uh oh!

azure-pipelines bot commented Dec 3, 2025

Uh oh!

nemanjarogic commented Dec 4, 2025

Uh oh!

azure-pipelines bot commented Dec 4, 2025

Uh oh!

nemanjarogic commented Dec 4, 2025

Uh oh!

azure-pipelines bot commented Dec 4, 2025

Uh oh!

nemanjarogic commented Dec 4, 2025

Uh oh!

azure-pipelines bot commented Dec 4, 2025

Uh oh!

raujaiswal Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

nemanjarogic Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sanjuyadav24 Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

nemanjarogic Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

sanjuyadav24 Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

sanjuyadav24 Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

nemanjarogic Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

nemanjarogic commented Dec 5, 2025

Uh oh!

azure-pipelines bot commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nemanjarogic commented Dec 2, 2025 •

edited

Loading

nemanjarogic Dec 5, 2025 •

edited

Loading