Update-PackageJson Script is Failing Due to Vulnerability

[jorgerangel-msft]

Validating dependencies with npm install...
Write-Error: /mnt/vss/_work/_temp/06fa685f-4b01-42aa-b993-105da7022a8c.ps1:3
Line |
   3 |  . '/mnt/vss/_work/1/s/packages/http-client-csharp/eng/scripts/Update- …
     |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Script failed with error: npm install failed after injecting
     | dependencies: npm warn deprecated glob@11.1.0: Old versions of glob are
     | not supported, and contain widely publicized security vulnerabilities,
     | which have been fixed in the current version. Please update. Support for
     | old versions may be purchased (at exorbitant rates) by contacting
     | i@izs.me npm warn deprecated glob@10.5.0: Old versions of glob are not
     | supported, and contain widely publicized security vulnerabilities, which
     | have been fixed in the current version. Please update. Support for old
     | versions may be purchased (at exorbitant rates) by contacting i@izs.me
     | npm error code E401 npm error Unable to authenticate, your
     | authentication token seems to be invalid. npm error To correct this
     | please try logging in again with: npm error   npm login npm error A
     | complete log of this run can be found in:
     | /mnt/vss/_work/_temp/npm-cache/_logs/2026-05-13T19_18_10_547Z-debug-0.log

We may have to update the glob package

[github-actions]

🎯 Issue Triage

The Update-PackageJson PowerShell script in the C# client emitter is failing due to deprecated glob package versions (10.x/11.x) triggering an npm E401 authentication error after the deprecation warnings.

Category: Bug
Area: emitter:client:csharp

⚠️ No reproduction provided. A minimal repro would help diagnose this issue.

🔍 Analysis

• The script packages/http-client-csharp/eng/scripts/Update-PackageJson.ps1 runs npm install as part of dependency injection/validation.
• glob@10.5.0 and glob@11.1.0 are flagged as deprecated with security vulnerabilities; npm emits deprecation warnings for both.
• The actual failure is npm error code E401 (authentication failure), which may be triggered or unmasked by the deprecated package resolution attempting to fetch a newer version or a private registry.
• The root cause may be that deprecated glob versions trigger npm to attempt resolution against a registry that requires auth, or the CI environment's npm token has expired/is misconfigured.
• The mention of "we may have to update the glob package" suggests the fix likely involves bumping glob to a non-deprecated version in the affected package.json.

📝 Suggested next steps

• Identify which package.json file(s) under packages/http-client-csharp/ depend on glob@10.x or glob@11.x
• Update glob to the latest non-deprecated version (e.g., glob@11.x current stable, or whichever version npm no longer flags)
• Verify if the E401 error is a separate CI credential issue unrelated to the glob deprecation
• Re-run the Update-PackageJson script in CI to confirm the fix

Generated by Agentic Triage