update form-data package in tasks to resolve vulnerability issues #21234
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
rishabhmalikMS
approved these changes
Aug 21, 2025
tarunramsinghani
approved these changes
Aug 21, 2025
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
cobya
approved these changes
Aug 22, 2025
cobya
approved these changes
Aug 22, 2025
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
Update the form-data package version to resolve vulnerability.
📌 Component Governance Link
Task Name
NpmV0
NpmV1
PublishTestResultsV1
PublishTestResultsV2
VsTestPlatformToolInstallerV1
Description
The form-data package version 2.5.1 is marked as vulnerable. To resolve this update the package version to latest stable version 4.0.4
Risk Assessment (Low / Medium / High)
Low - Update to only 1 package
Additional Testing Performed
We do not have test pipelines for VsTestPlatformToolInstallerV1, NpmV0,NpmV1, PublishTestResultsV1 in canary test.
These were tested in a private test org (Reviewers please request access).
Canary Test Pipelines
PublishTestResultsV2
Private Org Pipelines
PublishTestResultsV1
NpmV0 & NpmV1 (Both are in the same pipeline and uses the tfs-cli repo to install dependencies and packages the repo)
VsTestPlatformToolInstallerV1
Some Notes:
Rollback Scenario and Process (Yes/No)
Checklist