Azure DevOps Blog
DevOps, Git, and Agile updates from the team building Azure DevOps
Latest posts
Team Foundation Server Security Updates
Today, we are releasing updates for a cross site scripting (XSS) vulnerability and an issue where in some instances task groups may incorrectly show variables that are marked as secret. Team Foundation Server 2017 and 2018 are impacted. We have released patches for TFS 2017 Update 3.1 and TFS 2018 Update 1.2. We have also released TFS 2018 Update 3.2, which is a full install that includes these fixes. **TFS 2017 **Customers on TFS 2017 should upgrade to TFS 2017 Update 3.1 and then install the TFS 2017 Update 3.1 patch. This patch includes the previous fix detailed in this blog post. To verify if you have a pat...
Top Stories from the Microsoft DevOps Community – 2019.01.11
Welcome back Microsoft developers and DevOps practitioners; I hope you had a great new year! Me? I took some time off to recharge the batteries and I'm glad I did because — wow — even though it's just the beginning of 2019, there's already some incredible news coming out of the DevOps community.
Azure DevOps Agents on Azure Container Instances (ACI)
This article provides a solution for running Azure DevOps agents (Build/Release agents) on Windows Server Core based containers, hosted on Azure Container Instances (ACI). A solution like this might be useful, when the default Microsoft-hosted agents don't fit your requirements, and you don't prefer using "traditional" IaaS VMs for running your self-hosted agents.
Top Stories from the Microsoft DevOps Community – 2018.12.14
Happy Friday! Now that I live in Jolly Old England, the holiday festivities have begun (if you're not British, you might not know the whole of December is reserved for parties). So this will be the last top stories post for 2018, but don't worry, I'll be back in 2019. In the meantime, here are some great DevOps articles that I found this week.
Top Stories from the Microsoft DevOps Community – 2018.12.07
It's Friday, and I'm just on my way home from Microsoft Connect(); 2018. If you missed the product announcements, discussions and coding sessions, don't worry: Connect is entirely online, so you can catch up right now.
Top Stories from the Microsoft DevOps Community – 2018.11.30
I'm getting ready to head out to Microsoft Connect 2018 next week, but before I go, I wanted to share with you some of the great stories from the Microsoft DevOps community.
Blocking malicious versions of event-stream and flatmap-stream packages
On November 26, 2018, the npm package manager released security advisory 737 regarding the flatmap-stream package. It was determined that this package was malicious, and contained harmful code. In addition, the popular event-stream package was modified to make use of the harmful flatmap-stream package. These malicious packages were apparently attempting to locate bitcoin wallets stored on the computer running the packages and exfiltrate the coins. npm has removed the flatmap-stream package from their registry. Visual Studio Code has also taken steps to block affected extensions. In response to this incident, we...
Blocking malicious event-stream and flatmap-stream packages
We are making a change to Azure DevOps to block the harmful flatmap-stream 0.1.0 package and the versions of event-stream newer than version 3.3.4 which make use of the flatmap-stream package.
What’s new in Azure DevOps Sprint 143 Update
Sprint 143 Update of Azure DevOps is rolling out to all organizations. In this update, draft pull requests is now available in Azure Repos which allows you to easily create work in progress that may not include everyone. We are also releasing new features in Azure Artifacts, including the ability to exclude files in artifact uploads and get provenance information on packages. Watch the following video to learn more about these features.