Port changes from commit bbc5570 - Update vulnerable dependencies and modernize deprecated API usage by Copilot · Pull Request #513 · microsoft/tfs-cli

Copilot · 2025-10-03T07:18:44Z

This PR ports changes from commit bbc5570070f792568d97eedcf5d1b6e0502cad21 which updates vulnerable dependencies and modernizes deprecated Node.js API usage.

🔒 Security & Dependency Updates

Updated the following packages to address security vulnerabilities and improve compatibility:

Package	Old Version	New Version
archiver	2.0.3	7.0.1
glob	7.1.2	11.0.3
shelljs	0.8.5	0.10.0
uuid	3.0.1	13.0.0

Also removed unnecessary type definition packages (@types/glob, @types/uuid) as they are now included in their respective packages.

🔄 Code Modernization

UUID Import Modernization

Updated from deprecated CommonJS-style uuid usage to modern ES6 imports:

// Beforeimportuuid= require("uuid");def.id=uuid.v1();// Afterimport{v1asuuidv1}from"uuid";def.id=uuidv1();

URL Parsing Modernization

Replaced deprecated Node.js url.parse() with the modern URL constructor API:

// Beforeimporturl= require("url");this.parsedUrl=url.parse(this.serviceUrl);constsplitPath=this.parsedUrl.path.split("/");// Afterthis.parsedUrl=newURL(this.serviceUrl);constsplitPath=this.parsedUrl.pathname.split("/");

Added error handling to maintain backward compatibility with invalid URLs that the old url.parse() would accept.

Glob API Update

Updated from callback-based glob API to promise-based API:

// Beforeconstpromises=globs.map(pattern=>newPromise<string[]>((resolve,reject)=>{glob(pattern,(err,matches)=>{if(err)reject(err);elseresolve(matches);});}));// Afterconstpromises=globs.map(pattern=>glob(pattern));

TypeScript Configuration

Updated TypeScript compilation target from ES2018 to ES2019 to support newer JavaScript features.

✅ Validation

All updated dependencies validated against GitHub Advisory Database - No vulnerabilities found
CodeQL security scan completed - No alerts
Code review completed - No issues found
Changes maintain backward compatibility

📝 Additional Changes

Fixed indentation in package.json scripts section (standardized to 4-space indentation)
Cleaned up trailing whitespace in test files
Updated package-lock.json with all transitive dependency updates
Version bump: Updated package version from 0.22.1 to 0.22.2

Files modified: 8 files (package.json, package-lock.json, tsconfig.json, app/exec/build/tasks/create.ts, app/exec/extension/_lib/merger.ts, app/lib/connection.ts, tests/mock-server/utils/RequestParser.ts, tests/build-server-integration-tests.ts)

Original prompt

Port changes from bbc5570 commit from forked repo into the main repo @ @microsoft/tfs-cli. The PR should be created in the main repo and the changes from coomit to be ported over that PR

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

…nize URL parsing Co-authored-by: tarunramsinghani <2929463+tarunramsinghani@users.noreply.github.com>

Co-authored-by: tarunramsinghani <2929463+tarunramsinghani@users.noreply.github.com>

Tarun Ramsinghani (tarunramsinghani) · 2025-10-03T07:50:17Z

/azp run

azure-pipelines · 2025-10-03T07:50:30Z

Azure Pipelines successfully started running 1 pipeline(s).

Tarun Ramsinghani (tarunramsinghani) · 2025-10-03T07:51:42Z

Copilot update the patch version in the package.json

Co-authored-by: tarunramsinghani <2929463+tarunramsinghani@users.noreply.github.com>

Copilot · 2025-10-03T07:54:27Z

Copilot update the patch version in the package.json

Updated the patch version from 0.22.1 to 0.22.2 in both package.json and package-lock.json (commit 8aca3fe)

- Revert mocha from 11.7.3 to 10.2.0 for better Node.js compatibility - Revert rimraf from 6.0.1 to 2.6.1 to maintain backward compatibility - Update Node.js engine requirement to >=16.0.0 for modern API support - Improve error handling in server integration tests - All tests passing with updated dependency versions

Tarun Ramsinghani (tarunramsinghani) · 2025-10-03T11:13:34Z

/azp run

azure-pipelines · 2025-10-03T11:13:45Z

Azure Pipelines successfully started running 1 pipeline(s).

Nathan Hammond (nathanhammond)

We should be more-thorough in our review of Copilot-authored code.

Nathan Hammond (nathanhammond) · 2025-10-31T07:45:12Z

This changed the pattern of the codebase, for no reason.

Nathan Hammond (nathanhammond) · 2025-10-31T07:45:50Z

- });
- }),
- );
+ const promises = globs.map(pattern => glob(pattern));


Good change because of upstream API change.

Nathan Hammond (nathanhammond) · 2025-10-31T08:10:01Z

+ // Parse URL, but handle failures gracefully to mimic url.parse() behavior
+ try {
+ this.parsedUrl = new URL(this.serviceUrl);
+ } catch (error) {
+ // Mimic url.parse() behavior for invalid URLs
+ // url.parse() would return an object with null/empty values instead of throwing
+ this.parsedUrl = {
+ protocol: this.serviceUrl && this.serviceUrl.includes('://') ? this.serviceUrl.split('://')[0] + ':' : '',
+ host: null,
+ hostname: null,
+ pathname: this.serviceUrl && !this.serviceUrl.includes('://') ? this.serviceUrl : '',
+ search: '',
+ hash: ''
+ } as any;
+ }


This method already has error handling and throws. If a user submits an invalid URL like /tfs/orgName we can just throw earlier, with a humanized version of that message. No need to limp it through only to fail it later.
Throwing earlier also fixes a bug on line 35 because of a poorly-ordered if clause.
URL input: /tfs/orgName
31: this.accountUrl = this.parsedUrl.protocol + "//" + this.parsedUrl.host; => null//null
35: this.accountUrl += "/" + "tfs"; => null//null/tfs

Nathan Hammond (nathanhammond) · 2025-10-31T08:22:04Z

+ // Parse URL, but handle failures gracefully to mimic url.parse() behavior
+ try {
+ this.parsedUrl = new URL(this.serviceUrl);
+ } catch (error) {
+ // Mimic url.parse() behavior for invalid URLs
+ // url.parse() would return an object with null/empty values instead of throwing
+ this.parsedUrl = {
+ protocol: this.serviceUrl && this.serviceUrl.includes('://') ? this.serviceUrl.split('://')[0] + ':' : '',
+ host: null,
+ hostname: null,
+ pathname: this.serviceUrl && !this.serviceUrl.includes('://') ? this.serviceUrl : '',
+ search: '',
+ hash: ''
+ } as any;
+ }


Suggested change
// Parse URL, but handle failures gracefully to mimic url.parse() behavior
try{
this.parsedUrl=newURL(this.serviceUrl);
}catch(error){
// Mimic url.parse() behavior for invalid URLs
// url.parse() would return an object with null/empty values instead of throwing
this.parsedUrl={
protocol: this.serviceUrl&&this.serviceUrl.includes('://') ? this.serviceUrl.split('://')[0]+':' : '',
host: null,
hostname: null,
pathname: this.serviceUrl&&!this.serviceUrl.includes('://') ? this.serviceUrl : '',
search: '',
hash: ''
}asany;
}
try{
this.parsedUrl=newURL(this.serviceUrl);
}catch(error){
if(error.code==='ERR_INVALID_URL'){
thrownewError('Please enter a fully-qualified URL.')
}else{
throwerror;
}
}

Nathan Hammond (nathanhammond) · 2025-10-31T08:27:44Z

+ // Parse query parameters using forEach (guaranteed to be available)
+ const query: { [key: string]: string } = {};
+ parsedUrl.searchParams.forEach((value, key) => {
+ query[key] = value;
+ });


Suggested change
// Parse query parameters using forEach (guaranteed to be available)
constquery: {[key: string]: string}={};
parsedUrl.searchParams.forEach((value,key)=>{
query[key]=value;
});
constquery=Object.fromEntries(parsedUrl.searchParams.entries());

Initial plan
92cdc5a

CopilotAI assigned Copilot and Tarun Ramsinghani (tarunramsinghani)Oct 3, 2025

Copilotstarted work on behalf of Tarun Ramsinghani (tarunramsinghani)October 3, 2025 07:19 View session

CopilotAIand others added 2 commits October 3, 2025 07:33

Port code changes from commitbbc5570- update dependencies and moder…
56c6e68
…nize URL parsing Co-authored-by: tarunramsinghani <2929463+tarunramsinghani@users.noreply.github.com>

Update package-lock.json with new dependency versions
e998868
Co-authored-by: tarunramsinghani <2929463+tarunramsinghani@users.noreply.github.com>

CopilotAI changed the title ~~[WIP] Port changes from commit bbc5570 to main repo~~Port changes from commit bbc5570 - Update vulnerable dependencies and modernize deprecated API usageOct 3, 2025

CopilotAI requested a review from Tarun Ramsinghani (tarunramsinghani)October 3, 2025 07:43

Copilotfinished work on behalf of Tarun Ramsinghani (tarunramsinghani)October 3, 2025 07:43

Copilotstarted work on behalf of Tarun Ramsinghani (tarunramsinghani)October 3, 2025 07:52 View session

Update patch version to 0.22.2
8aca3fe
Co-authored-by: tarunramsinghani <2929463+tarunramsinghani@users.noreply.github.com>

Copilotfinished work on behalf of Tarun Ramsinghani (tarunramsinghani)October 3, 2025 07:55

Tarun Ramsinghani (tarunramsinghani) approved these changes Oct 3, 2025
View reviewed changes

Tarun Ramsinghani (tarunramsinghani) marked this pull request as ready for review October 3, 2025 11:13

Tarun Ramsinghani (tarunramsinghani) requested review from a team as code owners October 3, 2025 11:13

sanjuyadav24 approved these changes Oct 3, 2025
View reviewed changes

Tarun Ramsinghani (tarunramsinghani) merged commit ae8b325 into masterOct 3, 2025
7 checks passed

Tarun Ramsinghani (tarunramsinghani) deleted the copilot/port-changes-from-bbc5570 branch October 3, 2025 11:49

Nathan Hammond (nathanhammond) reviewed Oct 31, 2025
View reviewed changes

Nathan Hammond (nathanhammond) pushed a commit to nathanhammond/tfs-cli that referenced this pull request Oct 31, 2025
Fix-forwardmicrosoft#513
810ab3e

Nathan Hammond (nathanhammond) mentioned this pull request Oct 31, 2025
Fix-forward Copilot's #513 #515
Open

Navigation Menu

Uh oh!

Port changes from commit bbc5570 - Update vulnerable dependencies and modernize deprecated API usage - #513

Port changes from commit bbc5570 - Update vulnerable dependencies and modernize deprecated API usage#513
Tarun Ramsinghani (tarunramsinghani) merged 5 commits into
masterfrom
copilot/port-changes-from-bbc5570

CopilotAI commented Oct 3, 2025•
edited by tarunramsinghani
Loading

Uh oh!

Tarun Ramsinghani (tarunramsinghani) commented Oct 3, 2025

Uh oh!

azure-pipelinesBot commented Oct 3, 2025

Uh oh!

Tarun Ramsinghani (tarunramsinghani) commented Oct 3, 2025

Uh oh!

CopilotAI commented Oct 3, 2025

Uh oh!

Tarun Ramsinghani (tarunramsinghani) commented Oct 3, 2025

Uh oh!

azure-pipelinesBot commented Oct 3, 2025

Uh oh!

Uh oh!

Nathan Hammond (nathanhammond) left a comment

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025•
edited
Loading

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025•
edited
Loading

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025•
edited
Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

-// Parse query parameters using forEach (guaranteed to be available)
-constquery: {[key: string]: string}={};
-parsedUrl.searchParams.forEach((value,key)=>{
-query[key]=value;
-});
+constquery=Object.fromEntries(parsedUrl.searchParams.entries());

Uh oh!

Conversation

CopilotAI commented Oct 3, 2025• edited by tarunramsinghani Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Security & Dependency Updates

🔄 Code Modernization

UUID Import Modernization

URL Parsing Modernization

Glob API Update

TypeScript Configuration

✅ Validation

📝 Additional Changes

Uh oh!

Tarun Ramsinghani (tarunramsinghani) commented Oct 3, 2025

Uh oh!

azure-pipelinesBot commented Oct 3, 2025

Uh oh!

Tarun Ramsinghani (tarunramsinghani) commented Oct 3, 2025

Uh oh!

CopilotAI commented Oct 3, 2025

Uh oh!

Tarun Ramsinghani (tarunramsinghani) commented Oct 3, 2025

Uh oh!

azure-pipelinesBot commented Oct 3, 2025

Uh oh!

Uh oh!

Nathan Hammond (nathanhammond) left a comment

Choose a reason for hiding this comment

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Nathan Hammond (nathanhammond)Oct 31, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CopilotAI commented Oct 3, 2025•
edited by tarunramsinghani
Loading

Nathan Hammond (nathanhammond)Oct 31, 2025•
edited
Loading

Nathan Hammond (nathanhammond)Oct 31, 2025•
edited
Loading

Nathan Hammond (nathanhammond)Oct 31, 2025•
edited
Loading