Azure Pipelines Agent v4.269.0 (Node 24) breaks MicrosoftSecurityDevOps@1 v1.18.1: crypto.createCipher is not a function

[AymenGlaied]

Since upgrading the Azure Pipelines Agent to v4.269.0 (Node 24), pipelines that are decorated to run Microsoft Security DevOps (MSDO) fail with:

TypeError: crypto.createCipher is not a function
at _exposeTaskLibSecret (azure-pipelines-task-lib/internal.js:923:29)
...

Root cause:

• Node.js removed crypto.createCipher() in v22 (DEP0106). This is why Node 24 throws "is not a function".
• The MSDO Azure DevOps task (MicrosoftSecurityDevOps@1, v1.18.1) still calls this removed API via azure-pipelines-task-lib.

Impact:

• Organization-wide impact if the task is injected via a pipeline decorator (no pipeline-level control to pin a different injected task version).

Environment:

• Azure Pipelines Agent: v4.269.0
• Node runtime: v24.x (agent default)
• MSDO task: MicrosoftSecurityDevOps@1 v1.18.1

[DimaBir]

Thanks for reporting this issue.

Root cause identified: The azure-pipelines-task-lib dependency at version ^4.13.0 (resolves to 4.17.3) uses the deprecated crypto.createCipher() API in its _exposeTaskLibSecret() function. This API was removed in Node.js v22 (DEP0106), causing the TypeError: crypto.createCipher is not a function error when running under Node 24.

Fix: The upstream fix was merged in azure-pipelines-task-lib PR #1147, replacing createCipher with createCipheriv. This fix shipped in azure-pipelines-task-lib v5.2.4+. We are bumping our dependency from ^4.13.0 to ^5.2.4 to pick up this fix.

[DimaBir]

@AymenGlaied, merged. Thank you!