Fix CVE-2026-27903: upgrade minimatch 5.1.6 → 5.1.9 across all affected tasks

[Copilot]

Context

Fixes CVE-2026-27903 (High severity ReDoS vulnerability) in minimatch 5.1.6. The vulnerable version was pulled in as a transitive dependency via mocha (^5.1.6) and glob (^5.0.1) across 22+ tasks.

---

Task Name

ANTV1, BicepDeployV0, CargoAuthenticateV0, DotNetCoreCLIV2, DownloadPackageV0, DownloadPackageV1, GradleV2, GradleV3, GradleV4, MavenV2, MavenV3, MavenV4, NpmAuthenticateV0, NpmV0, NpmV1, NuGetCommandV2, NuGetToolInstallerV0, NuGetToolInstallerV1, PipAuthenticateV0, TwineAuthenticateV0, UniversalPackagesV1, UseDotNetV2

---

Description

• Added "overrides": { "minimatch": "5.1.9" } to each affected task's package.json to force resolution of the vulnerable transitive dep
• Regenerated all package-lock.json files via npm install --package-lock-only --ignore-scripts — resolves to 5.1.9 everywhere (mocha/glob nested installs deduped)
• Updated _buildConfigs/Wif lock files for CargoAuthenticateV0, NpmAuthenticateV0, UniversalPackagesV1
• Updated _generated/ package and lock files for all affected variants
• Bumped task versions for all 22 modified tasks (sprint 274)

Example of the override pattern applied:

"overrides": {
  "uuid": "7.0.3",
  "minimatch": "5.1.9"
}

---

Risk Assessment (Low / Medium / High)

Low — No production logic changed. Only npm dependency resolution is affected: minimatch is used by mocha (test runner) and glob (file matching); pinning to 5.1.9 stays within the same major version with identical API.

---

Change Behind Feature Flag (Yes / No)

No — dependency version pin, no runtime feature flag applicable.

---

Tech Design / Approach

• Used npm overrides (npm 8+) to force all transitive consumers of minimatch to resolve 5.1.9
• Chose pinned "5.1.9" (latest 5.x patch) rather than a range to prevent future lock drift back to a vulnerable version
• mocha requires ^5.1.6 and glob requires ^5.0.1; both are satisfied by 5.1.9

---

Documentation Changes Required (Yes/No)

No

---

Unit Tests Added or Updated (Yes / No)

No — dependency-only change; existing tests cover task behavior.

---

Additional Testing Performed

Verified via automated scan of all package-lock.json files that no resolved minimatch version is 5.1.6 after changes.

---

Logging Added/Updated (Yes/No)

No

---

Telemetry Added/Updated (Yes/No)

No

---

Rollback Scenario and Process (Yes/No)

Yes — revert PR to restore prior lock files. No runtime state affected.

---

Dependency Impact Assessed and Regression Tested (Yes/No)

Yes — minimatch 5.1.9 is a patch release over 5.1.6 with no API changes. All consumers (mocha, glob, azure-pipelines-task-lib) are unaffected.

---

Checklist

• Related issue linked (if applicable)
• Task version was bumped — see versioning guide
• Verified the task behaves as expected

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• whatsprintis.it
  • Triggering command: /usr/bin/curl curl -s REDACTED pelines-tasks/_g-c peli�� .path // empty pelines-tasks/_generated/CargoAuthenticateV0_Wif/package.json nfig/composer/vendor/bin/grep "minimatch" e.json k/_temp/ghcca-no--noprofile grep -l "minimatch" s-tasks/azure-pipelines-tasks/.g-d de/node/bin/bash s-tasks/azure-pibash s-tasks/azure-pi--norc s-tasks/azure-pi--noprofile s-tasks/azure-pipelines-tasks/ci-c (dns block)
  • Triggering command: /usr/bin/curl curl -v REDACTED grep -l "minimatch" s-tasks/azure-pipelines-tasks/Tasks/GradleV2/package.json /usr/bin/grep "minimatch" /package.json (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

[Component Governance Alert] - CVE-2026-27903 in minimatch 5.1.6. Severity: High

Work Item Details

Note: Please focus on the descriptions and information that provide context about the task requirements, functionality, and implementation details. Dates, priorities, and administrative metadata are less relevant for coding tasks.

Description

See more details about this alert in Component Governance.

No field updates will be made to this work item after its initial creation. This includes:
• State changes: If an alert is fixed in CG, the state will not be updated on the work item. You must close the work item manually.
• Severity changes: If an alert changes in severity, the work item will only reflect the severity at the time of the work item’s creation.
• Service mapping changes: If the repository that generated this work item is moved to another service, tags that indicate ServiceID will not be updated.
• Any other change to the alert in CG

If you're having trouble with an S360 item associated with this work item, read the S360 troubleshooting guide.

For additional information and to understand why this work item was assigned to you, see our work item documentation.

This work item was created for an alert in the following repository: microsoft/azure-pipelines-tasks

Tags

auto-cgtriaged; Azure DevOps; CG; CG Burndown; Component Governance; microsoft/azure-pipelines-tasks

Repro Steps

See more details about this alert in Component Governance.

No field updates will be made to this work item after its initial creation. This includes:
• State changes: If an alert is fixed in CG, the state will not be updated on the work item. You must close the work item manually.
• Severity changes: If an alert changes in severity, the work item will only reflect the severity at the time of the work item’s creation.
• Service mapping changes: If the repository that generated this work item is moved to another service, tags that indicate ServiceID will not be updated.
• Any other change to the alert in CG

If you're having trouble with an S360 item associated with this work item, read the S360 troubleshooting guide.

For additional information and to understand why this work item was assigned to you, see our work item documentation.

This work item was created for an alert in the following repository: microsoft/azure-pipelines-tasks

Comments

GitHub Copilot Coding Agent (Tue, 05 May 2026 15:42:27 GMT): Thank you @ @<Raju Ellendula (LTIMindtree Limited)> for asking me to work on this! I started on the work item, linked !#22133 and I'll update it as I form a plan and make progress.

GitHub Copilot Coding Agent (Tue, 05 May 2026 08:31:53 GMT): @ @<Raju Ellendula (LTIMindtree Limited)> GitHub pull request !#22124 is ready for you to review.

GitHub Copilot Coding Agent (Tue, 05 May 2026 08:27:27 GMT): @ @<Raju Ellendula (LTIMindtree Limited)> GitHub pull request !#22123 is ready for you to review.

GitHub Copilot Coding Agent (Tue, 05 May 2026 08:26:13 GMT): Thank you @ @<Raju Ellendula (LTIMindtree Limited)> for asking me to work on this! I started on the work item, linked !#22124 and I'll update it as I form a plan and make progress.

GitHub Copilot Coding Agent (Tue, 05 May 2026 08:11:30 GMT): Thank you @ @<Raju Ellendula (LTIMindtree Limited)> for asking me to work on this! I started on the work item, linked !#22123 and I'll update it as I form a plan and make progress.

GitHub Copilot Coding Agent (Tue, 05 May 2026 08:05:50 GMT): @ @<Raju Ellendula (LTIMindtree Limited)> GitHub pull request !#22122 is ready for you to review.

GitHub Copilot Coding Agent (Tue, 05 May 2026 08:00:17 GMT): Thank you @ @<Raju Ellendula (LTIMindtree Limited)> for asking me to work on this! I started on the work item, linked !#22122 and I'll update it as I form a plan and make progress.

GitHub Copilot Coding Agent (Tue, 05 May 2026 07:53:15 GMT): @ @<Raju Ellendula (LTIMindtree Limited)> GitHub pull request !#22...

Work item: AB#2362016
Created via Azure DevOps

[azure-pipelines]

Azure Pipelines:
3 pipeline(s) require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
3 pipeline(s) require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
3 pipeline(s) require an authorized user to comment /azp run to run.