Repository navigation
Devops Task - dependency error (Node version) #179
Description
Use of the dependency-check-build-task@6 Devops task generates a dependency error:
##[warning]Task 'OWASP Dependency Check' version 6 (dependency-check-build-task@6) is dependent on a Node version (16) that is end-of-life. Contact the extension owner for an updated version of the task. Task maintainers should review Node upgrade guidance: https://aka.ms/node-runner-guidance
Activity
pinkfloydx33 commentedon Jul 28, 2025
Started noting this as well. It's not an error yet, but it's certainly noise that people reviewing pipelines are getting concerned about. Any chance the upgrade will come soon?
CrookedGrandma commentedon Aug 5, 2025
We started getting this as well.
Saturate commentedon Sep 22, 2025
@pinkfloydx33 If you do a PR, I'll do a release :)
sicil1ano commentedon Sep 29, 2025
Hi. I just created a PR. I am quite new to contributing to this project. I hope the changes I made there make sense. I am open to feedback of course!
Saturate commentedon Sep 29, 2025
Changes are merged, just considering if it should be released as a major as we bump some requirements due to
minimumAgentVersionsicil1ano commentedon Sep 30, 2025
My opinion is that this change can be released by only bumping the minor version. My reasoning is that the
minimumAgentVersionchanged from2.0.0to2.144.0, which is a minor release.pinkfloydx33 commentedon Sep 30, 2025
For what it's worth, the current/latest agent version is
4.262.0. I wonder how many 2.x agents actually exist in the wild.❓Also to consider: if this is released as a major version, then it will require all users of the task to update their CI to point at the new
@majorversion, whereas if it's released as a minor, it should "just work", except where pinned to something more specific. In my experience, the former is the more common usage. Those pinning do so for a reason and would be expected to update manually anyways... But those of us that rely on just the major version tag would probably appreciate this rolling out as a minor update, especially since it doesn't remove any features and given the (presumably) low likelihood of a really outdated agent.Saturate commentedon Sep 30, 2025
Great points, will release as minor.
Saturate commentedon Sep 30, 2025
6.3.0 will fix this issue - published it now should be ready soon :)
https://github.com/dependency-check/azuredevops/releases/tag/6.3.0
pinkfloydx33 commentedon Oct 1, 2025
FYI, the warning still persists on 6.3.0 and it's because the deprecated Node version is still a part of the task.
It seems like this will require a new major version and removal of the legacy Node handler. At the very least this issue should be reopened
kipusoep commentedon Mar 14, 2026
Any updates on this?
Saturate commentedon Mar 15, 2026
Yeah, seems I'm the only maintainer active and can't fix the build or publish pipeline myself.
sebastiansterk commentedon Mar 18, 2026
Any update on this?
pablosguajardo commentedon May 26, 2026
It seems development has stalled... It's a minor change. Someone should take the initiative and fork it to continue development. I can help a little. I did the same with this abandoned project: https://github.com/pablosguajardo/owasp-zap-scanner
kckmzx commentedon May 26, 2026
It seems that there is already a plan to move the pipelines to GitHub to regain the rights, from @Saturate. #196
But it’s a bit old...
Saturate commentedon May 26, 2026
Yeah, I've made the initial steps but I need secrets and a approve to do this, can't do it on my own unfortunately.