From 3085b76c1512e27fda492779bd5e9d458daf6341 Mon Sep 17 00:00:00 2001
From: Stella Huang <stellahuang@microsoft.com>
Date: Mon, 20 Jul 2026 15:56:51 -0700
Subject: [PATCH] Upgrade compliance BinSkim to 4.4.9

Pin the standalone compliance pipeline to BinSkim scanner version 4.4.9 using the task's Exact version inputs. This avoids the deprecated 1.9.5 default without changing the BinSkim task version.
---
 azure-pipelines-compliance.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/azure-pipelines-compliance.yml b/azure-pipelines-compliance.yml
index c8adc44f31..58dd250c90 100644
--- a/azure-pipelines-compliance.yml
+++ b/azure-pipelines-compliance.yml
@@ -152,6 +152,8 @@ jobs:
   - task: BinSkim@4
     displayName: Run BinSkim
     inputs:
+      toolVersion: Exact
+      exactToolVersion: '4.4.9'
       # Use the same files copied for ApiScan
       TargetPattern: binskimPattern
       AnalyzeTargetBinskim: |