microsoft / microsoft/azure-pipelines-task-lib
`follow-redirects` has a GitHub advisory to update to 1.16.0
Open
Area: TaskLib
triage
- Dominant language
- TypeScript
- Stars
- 458
- Forks
- 282
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 14
Description
It seems the latest version of azure-pipelines-task-lib is [still on 1.15.6](https://github.com/microsoft/azure-pipelines-task-lib/blob/80be22429d7459920979b2547d5a828d76fa0c3c/node/package-lock.json#L604). We have internal scanners picking up this [GitHub advisory](https://github.com/advisories/GHSA-r4q5-vmmm-2653) to update `follow-redirects` to 1.16.0.
FYI.
Contributor guide
Research direction
Open node/package-lock.json at the follow-redirects entry referenced in the issue and compare its resolved version with the GitHub advisory. Update the dependency to 1.16.0, then verify that the lockfile no longer records 1.15.6 and that the advisory scanner is satisfied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100