From bd3b1c26fb2790b49ce0a7a4977513302b496610 Mon Sep 17 00:00:00 2001 From: Jared Date: Mon, 9 Mar 2026 20:09:13 +1300 Subject: [PATCH 1/3] url.parse() is deemed insecure and has been deprecated. url.parse() calls have been replaced with new URL --- api/TaskAgentApi.ts | 4 ++-- api/VsoClient.ts | 2 +- api/WebApi.ts | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/api/TaskAgentApi.ts b/api/TaskAgentApi.ts index 2f318455..324cb195 100644 --- a/api/TaskAgentApi.ts +++ b/api/TaskAgentApi.ts @@ -226,7 +226,7 @@ export class TaskAgentApi extends taskagentbasem.TaskAgentApiBase implements ITa private _getAccountUrl(collectionUrl: string): string { // converts a collection URL to an account URL // returns null if the conversion can't be made - var purl = url.parse(collectionUrl); + var purl = new URL(collectionUrl); if (!purl.protocol || !purl.host) { return null; } @@ -234,7 +234,7 @@ export class TaskAgentApi extends taskagentbasem.TaskAgentApiBase implements ITa var accountUrl = purl.protocol + '//' + purl.host; // purl.path is something like /DefaultCollection or /tfs/DefaultCollection or /DefaultCollection/ - var splitPath: string[] = purl.path.split('/').slice(1); + var splitPath: string[] = purl.pathname.split('/').slice(1); if (splitPath.length === 0 || (splitPath.length === 1 && splitPath[0] === '')) { return null; } diff --git a/api/VsoClient.ts b/api/VsoClient.ts index 7330faec..b49c02e0 100644 --- a/api/VsoClient.ts +++ b/api/VsoClient.ts @@ -49,7 +49,7 @@ export class VsoClient { constructor(baseUrl: string, restClient: restm.RestClient) { this.baseUrl = baseUrl; - this.basePath = url.parse(baseUrl).pathname; + this.basePath = new URL(baseUrl).pathname; this.restClient = restClient; this._locationsByAreaPromises = {}; this._initializationPromise = Promise.resolve(true); diff --git a/api/WebApi.ts b/api/WebApi.ts index 720873ed..d68fb5ee 100644 --- a/api/WebApi.ts +++ b/api/WebApi.ts @@ -422,7 +422,7 @@ export class WebApi { const noProxyDomains = (process.env.no_proxy || '') .split(',') .map(v => v.toLowerCase()); - const serverUrl = url.parse(_url).host.toLowerCase(); + const serverUrl = new URL(_url).host.toLowerCase(); // return true if the no_proxy includes the host return noProxyDomains.indexOf(serverUrl) !== -1; } From 360bb27341f5b83e5f129296c14a6f7e011b3d7d Mon Sep 17 00:00:00 2001 From: Jared Date: Thu, 12 Mar 2026 00:09:43 +1300 Subject: [PATCH 2/3] remove url import in files that no longer require it --- api/TaskAgentApi.ts | 1 - api/WebApi.ts | 1 - 2 files changed, 2 deletions(-) diff --git a/api/TaskAgentApi.ts b/api/TaskAgentApi.ts index 324cb195..4bdc20b2 100644 --- a/api/TaskAgentApi.ts +++ b/api/TaskAgentApi.ts @@ -1,7 +1,6 @@ import basem = require('./ClientApiBases'); import ifm = require("./interfaces/common/VsoBaseInterfaces"); import taskagentbasem = require('./TaskAgentApiBase'); -import url = require('url'); import vsom = require('./VsoClient'); import TaskAgentInterfaces = require("./interfaces/TaskAgentInterfaces"); import VsoBaseInterfaces = require('./interfaces/common/VsoBaseInterfaces'); diff --git a/api/WebApi.ts b/api/WebApi.ts index d68fb5ee..82b73d4d 100644 --- a/api/WebApi.ts +++ b/api/WebApi.ts @@ -45,7 +45,6 @@ import lim = require("./interfaces/LocationsInterfaces"); import crypto = require('crypto'); import fs = require('fs'); import os = require('os'); -import url = require('url'); import path = require('path'); const isBrowser: boolean = typeof window !== 'undefined'; From b7b77f3901a58d3ded8e3ba82bfd2bbaefebe6e5 Mon Sep 17 00:00:00 2001 From: Jared Date: Sun, 15 Mar 2026 09:50:54 +1300 Subject: [PATCH 3/3] bump for commit. Fix #664 --- ThirdPartyNotice.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/ThirdPartyNotice.txt b/ThirdPartyNotice.txt index d0c2e781..1bc99a7f 100644 --- a/ThirdPartyNotice.txt +++ b/ThirdPartyNotice.txt @@ -683,4 +683,3 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ========================================= END OF wrappy NOTICES, INFORMATION, AND LICENSE -