Azure DevOps automatically updated node/npm version - can this be avoided?

user_427684 0
Viewed 2308

On 1st Dec 2021 (a couple of days ago at time of writing) Azure DevOps seemingly automatically upgraded the version of node and npm they were using by default, which broke our build pipelines.

before: 2021-11-30T15:30:01.113Z

enter image description here

after: 2021-12-01T09:00:00.450Z

enter image description here

(no changes were made to these build pipelines in between)

I have manually set the version in a 'Node.js tool installer' step in the pipeline now (as suggested here).

Can this automatic upgrade be avoided or is there a website or email newsletter I am missing that informs Azure DevOps users when Microsoft upgrade versions they are using behind the scenes?

azure-pipelines npm node.js azure-devops
1 Answers

Microsoft will automatically maintain the images for the hosted pipelines. Node 6 is no longer supported by the Node foundation and has known security issues. Microsoft automatically upgrades these kinds of dependencies in these cases to keep the image "secure". There is no opt-out, unless you run self-hosted agents in your own hardware/cloud subscription.

You can track the announcements, work in progress and the releases of the agent images in the virtual-environments repository. The same images are used for Azure Pipelines as for GitHub Actions.

Bigger changes (such as the deprecation of the windows-2016 image are also announced on the Microsoft DevOps Blog.

To force an older version of Node/Npm than the default, you'll need to add the Node Tool Installer task to your workflow and set the version to the one you want:

task: NodeTool@0
  inputs:
    versionSpec: '6.x'

Or:

task: NodeTool@0
  inputs:
    versionSpec: '10.x'

You can always run a custom npm -g npm@^6 to force npm to upgrade/downgrade.

user_7360790
Related