Devops Task - dependency error (Node version)

[mlaidouni]

Use of the dependency-check-build-task@6 Devops task generates a dependency error:

##[warning]Task 'OWASP Dependency Check' version 6 (dependency-check-build-task@6) is dependent on a Node version (16) that is end-of-life. Contact the extension owner for an updated version of the task. Task maintainers should review Node upgrade guidance: https://aka.ms/node-runner-guidance

[pinkfloydx33]

Started noting this as well. It's not an error yet, but it's certainly noise that people reviewing pipelines are getting concerned about. Any chance the upgrade will come soon?

[CrookedGrandma]

We started getting this as well.

[Saturate]

@pinkfloydx33 If you do a PR, I'll do a release :)

[sicil1ano]

Hi. I just created a PR. I am quite new to contributing to this project. I hope the changes I made there make sense. I am open to feedback of course!

[Saturate]

Changes are merged, just considering if it should be released as a major as we bump some requirements due to minimumAgentVersion

[sicil1ano]

My opinion is that this change can be released by only bumping the minor version. My reasoning is that the minimumAgentVersion changed from 2.0.0 to 2.144.0, which is a minor release.

[pinkfloydx33]

For what it's worth, the current/latest agent version is 4.262.0. I wonder how many 2.x agents actually exist in the wild.❓

Also to consider: if this is released as a major version, then it will require all users of the task to update their CI to point at the new @majorversion, whereas if it's released as a minor, it should "just work", except where pinned to something more specific. In my experience, the former is the more common usage. Those pinning do so for a reason and would be expected to update manually anyways... But those of us that rely on just the major version tag would probably appreciate this rolling out as a minor update, especially since it doesn't remove any features and given the (presumably) low likelihood of a really outdated agent.

[Saturate]

Great points, will release as minor.

[Saturate]

6.3.0 will fix this issue - published it now should be ready soon :)

https://github.com/dependency-check/azuredevops/releases/tag/6.3.0

[pinkfloydx33]

FYI, the warning still persists on 6.3.0 and it's because the deprecated Node version is still a part of the task.

Downloading task: dependency-check-build-task (6.3.0)
##[warning]Task 'OWASP Dependency Check' version 6 (dependency-check-build-task@6) is dependent on a Node version (16) that is end-of-life. Contact the extension owner for an updated version of the task. Task maintainers should review Node upgrade guidance: https://aka.ms/node-runner-guidance

It seems like this will require a new major version and removal of the legacy Node handler. At the very least this issue should be reopened