chore(deps): bump adm-zip and azure-pipelines-task-lib in /ext/azuredevops/setupAzd#9215
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [adm-zip](https://github.com/cthackers/adm-zip) to 0.6.0 and updates ancestor dependency [azure-pipelines-task-lib](https://github.com/Microsoft/azure-pipelines-task-lib). These dependencies need to be updated together. Updates `adm-zip` from 0.5.16 to 0.6.0 - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](cthackers/adm-zip@v0.5.16...v0.6.0) Updates `azure-pipelines-task-lib` from 5.276.0 to 5.278.0 - [Commits](https://github.com/Microsoft/azure-pipelines-task-lib/commits) --- updated-dependencies: - dependency-name: adm-zip dependency-version: 0.6.0 dependency-type: indirect - dependency-name: azure-pipelines-task-lib dependency-version: 5.278.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
requested review from
RickWinter,
hemarina and
tg-msft
as code owners
July 20, 2026 18:13
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates the Azure DevOps setupAzd task’s Node dependency to a newer azure-pipelines-task-lib version.
Changes:
- Bumps
azure-pipelines-task-libfrom^5.276.0to^5.278.0.
Files not reviewed (1)
- ext/azuredevops/setupAzd/package-lock.json: Generated file
|
Azure Pipelines: Successfully started running 1 pipeline(s). 19 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
microsoft-github-policy-service
Bot
added
the
customer-reported
Contributor
|
Thank you for your contribution @dependabot[bot]! We will review the pull request and get back to you soon. |
RickWinter
approved these changes
Jul 20, 2026
Member
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Member
dependabot
Bot
deleted the
dependabot/npm_and_yarn/ext/azuredevops/setupAzd/multi-844ff41875
branch
July 21, 2026 22:58
2 tasks
vhvb1989
added a commit
that referenced
this pull request
Jul 24, 2026
…9240) * chore(deps): group Dependabot security updates into one PR Addresses all open Dependabot alerts across the repo: - cli/azd/extensions/azure.ai.rle: bump golang.org/x/crypto 0.49.0 -> 0.52.0 and golang.org/x/net 0.52.0 -> 0.55.0 (alerts #456-#469). Note x/net requires 0.55.0 for full remediation of #456. - ext/vscode: js-yaml -> 4.3.0, brace-expansion -> 2.1.2 & 5.0.7 (alerts #539, #540, #541) - ext/azuredevops/setupAzd: adm-zip -> 0.6.0, azure-pipelines-task-lib -> 5.278.0, brace-expansion -> 1.1.16 & 2.1.2 (alerts #535, #537, #538) - cli/azd/test/eval: brace-expansion -> 1.1.16 (alert #536) Supersedes and consolidates #9093 and #9215. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cef6dea-2ec8-4538-8e55-7a2b0dfa196c * ci: make azdo-extension npm steps non-blocking on PR builds The azdo-extension pipeline currently fails on the self-hosted Linux and Windows agents because they cannot reach registry.npmjs.org (npm EPERM egress block); `npm i -g npm` fails before any dependency is resolved. Build Mac (hosted pool) and the vscode build (same self-hosted pool) are unaffected, confirming this is an agent egress issue, not a code problem. Make the npm-dependent steps (install, test, package) non-blocking for PR validation builds only (Build.Reason == PullRequest) so this gate does not block unrelated PRs such as the grouped Dependabot security update. Release and CD builds on main remain strict, so CodeQL and artifact generation are unaffected. Artifact staging is skipped on PR builds since the package step may not produce a VSIX while the egress issue persists. Tracking issue to fix the egress block and re-enable the gate: #9286 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cef6dea-2ec8-4538-8e55-7a2b0dfa196c * ci: trigger azdo pipeline PR validation on build template changes Add the azuredevops build/stage templates to the release-azuredevops pipeline PR and CI path filters so edits to the build job template are validated by the azdo-extension pipeline (previously only changes under ext/azuredevops or the root pipeline file triggered it). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cef6dea-2ec8-4538-8e55-7a2b0dfa196c * ci: skip azdo-extension Sign stage on PR builds Now that the BuildAndTest stage completes with issues (instead of hard failing) on PR validation builds while the self-hosted agent npm egress issue persists (#9286), the Sign stage began running on PRs and failed because no vsix artifact is produced on PR builds. Signing is never performed for PR builds, so gate the whole Sign stage to release/CI/manual build reasons. Also add the sign/publish stage templates to the pipeline PR path filters so template changes are validated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cef6dea-2ec8-4538-8e55-7a2b0dfa196c --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cef6dea-2ec8-4538-8e55-7a2b0dfa196c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps adm-zip to 0.6.0 and updates ancestor dependency azure-pipelines-task-lib. These dependencies need to be updated together.
Updates
adm-zipfrom 0.5.16 to 0.6.0Release notes
Sourced from adm-zip's releases.
Changelog
Sourced from adm-zip's changelog.
... (truncated)
Commits
2b4d840updated minimum node engine version to >= 14dc57f0fHardened entry-name lookup, fixed test(), and sped up entry sortingf81806aMade utimes best-effort so it can't abort extraction (#379)ab04324Fixed extractEntryTo flattening subdirectories (#306)8a5d9baFixed empty name for directory entries (#466)3e72790Fixed uncaught crash in writeFileToAsync on write failure (#470, #459, #402)651ae4cAdded typescript typese72021dFixed infinite recursion on symlink loops in addLocalFolder (#541)8f3176bFixed directory permissions on linux4d2c8f9Fixed error introduced with zip descriptor checksUpdates
azure-pipelines-task-libfrom 5.276.0 to 5.278.0Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.