Task 14447552: Fix Component Governance vulnerabilities (#1838)

2022-05-20 11:00:29 -07:00 · 2022-05-20 11:00:29 -07:00 · ed1293904e
--- a/AISKU/package.json
+++ b/AISKU/package.json
@ -41,7 +41,7 @@
        "sinon": "^7.3.1",
        "@microsoft/api-extractor": "^7.18.1",
        "finalhandler": "^1.1.1",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/AISKU/rollup.config.js
+++ b/AISKU/rollup.config.js
@ -45,6 +45,12 @@ const browserRollupConfigFactory = (isProduction, libVersion = '2', format = 'um
      freeze: false,
      sourcemap: true
    },
+    treeshake: {
+      propertyReadSideEffects: false,
+      moduleSideEffects: false,
+      tryCatchDeoptimization: false,
+      correctVarValueBeforeDeclaration: false
+    },
    plugins: [
      dynamicRemove(),
      replace({
@ -94,7 +100,13 @@ const nodeUmdRollupConfigFactory = (isProduction) => {
      name: "Microsoft.ApplicationInsights",
      extend: true,
      freeze: false,
-      sourcemap: true,
+      sourcemap: true    
+    },
+    treeshake: {
+      propertyReadSideEffects: false,
+      moduleSideEffects: false,
+      tryCatchDeoptimization: false,
+      correctVarValueBeforeDeclaration: false
    },
    plugins: [
      dynamicRemove(),
--- a/AISKULight/package.json
+++ b/AISKULight/package.json
@ -28,7 +28,7 @@
        "@microsoft/applicationinsights-rollup-plugin-uglify3-js": "1.0.0",
        "@microsoft/applicationinsights-rollup-es3": "1.1.3",
        "@microsoft/api-extractor": "^7.18.1",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/channels/applicationinsights-channel-js/package.json
+++ b/channels/applicationinsights-channel-js/package.json
@ -26,7 +26,7 @@
        "@microsoft/applicationinsights-rollup-es3": "1.1.3",
        "@microsoft/api-extractor": "^7.18.1",
        "@types/sinon": "4.3.3",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
        "@nevware21/grunt-eslint-ts": "^0.2.2",
--- a/common/Tests/Framework/package.json
+++ b/common/Tests/Framework/package.json
@ -31,7 +31,7 @@
    "devDependencies": {
        "@types/qunit": "^2.5.3",
        "@types/sinon": "4.3.3",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
        "@rollup/plugin-commonjs": "^18.0.0",
--- a/common/config/rush/npm-shrinkwrap.json
+++ b/common/config/rush/npm-shrinkwrap.json
--- a/common/scripts/install-run-rush.js
+++ b/common/scripts/install-run-rush.js
@ -3,7 +3,11 @@
 // See the @microsoft/rush package's LICENSE file for license information.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
@ -36,10 +40,10 @@ const fs = __importStar(require("fs"));
 const install_run_1 = require("./install-run");
 const PACKAGE_NAME = '@microsoft/rush';
 const RUSH_PREVIEW_VERSION = 'RUSH_PREVIEW_VERSION';
-function _getRushVersion() {
+function _getRushVersion(logger) {
    const rushPreviewVersion = process.env[RUSH_PREVIEW_VERSION];
    if (rushPreviewVersion !== undefined) {
-        console.log(`Using Rush version from environment variable ${RUSH_PREVIEW_VERSION}=${rushPreviewVersion}`);
+        logger.info(`Using Rush version from environment variable ${RUSH_PREVIEW_VERSION}=${rushPreviewVersion}`);
        return rushPreviewVersion;
    }
    const rushJsonFolder = (0, install_run_1.findRushJsonFolder)();
@ -66,7 +70,28 @@ function _run() {
    if (!nodePath || !scriptPath) {
        throw new Error('Unexpected exception: could not detect node path or script path');
    }
-    if (process.argv.length < 3) {
+    let commandFound = false;
+    let logger = { info: console.log, error: console.error };
+    for (const arg of packageBinArgs) {
+        if (arg === '-q' || arg === '--quiet') {
+            // The -q/--quiet flag is supported by both `rush` and `rushx`, and will suppress
+            // any normal informational/diagnostic information printed during startup.
+            //
+            // To maintain the same user experience, the install-run* scripts pass along this
+            // flag but also use it to suppress any diagnostic information normally printed
+            // to stdout.
+            logger = {
+                info: () => { },
+                error: console.error
+            };
+        }
+        else if (!arg.startsWith('-') || arg === '-h' || arg === '--help') {
+            // We either found something that looks like a command (i.e. - doesn't start with a "-"),
+            // or we found the -h/--help flag, which can be run without a command
+            commandFound = true;
+        }
+    }
+    if (!commandFound) {
        console.log(`Usage: ${scriptName} <command> [args...]`);
        if (scriptName === 'install-run-rush.js') {
            console.log(`Example: ${scriptName} build --to myproject`);
@ -76,10 +101,10 @@ function _run() {
        }
        process.exit(1);
    }
-    (0, install_run_1.runWithErrorAndStatusCode)(() => {
-        const version = _getRushVersion();
-        console.log(`The rush.json configuration requests Rush version ${version}`);
-        return (0, install_run_1.installAndRun)(PACKAGE_NAME, version, bin, packageBinArgs);
+    (0, install_run_1.runWithErrorAndStatusCode)(logger, () => {
+        const version = _getRushVersion(logger);
+        logger.info(`The rush.json configuration requests Rush version ${version}`);
+        return (0, install_run_1.installAndRun)(logger, PACKAGE_NAME, version, bin, packageBinArgs);
    });
 }
 _run();
--- a/common/scripts/install-run.js
+++ b/common/scripts/install-run.js
@ -3,7 +3,11 @@
 // See the @microsoft/rush package's LICENSE file for license information.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
@ -79,9 +83,9 @@ function _parsePackageSpecifier(rawPackageSpecifier) {
 *
 * IMPORTANT: THIS CODE SHOULD BE KEPT UP TO DATE WITH Utilities.copyAndTrimNpmrcFile()
 */
-function _copyAndTrimNpmrcFile(sourceNpmrcPath, targetNpmrcPath) {
-    console.log(`Transforming ${sourceNpmrcPath}`); // Verbose
-    console.log(`  --> "${targetNpmrcPath}"`);
+function _copyAndTrimNpmrcFile(logger, sourceNpmrcPath, targetNpmrcPath) {
+    logger.info(`Transforming ${sourceNpmrcPath}`); // Verbose
+    logger.info(`  --> "${targetNpmrcPath}"`);
    let npmrcFileLines = fs.readFileSync(sourceNpmrcPath).toString().split('\n');
    npmrcFileLines = npmrcFileLines.map((line) => (line || '').trim());
    const resultLines = [];
@ -125,16 +129,16 @@ function _copyAndTrimNpmrcFile(sourceNpmrcPath, targetNpmrcPath) {
 *
 * IMPORTANT: THIS CODE SHOULD BE KEPT UP TO DATE WITH Utilities._syncNpmrc()
 */
-function _syncNpmrc(sourceNpmrcFolder, targetNpmrcFolder, useNpmrcPublish) {
+function _syncNpmrc(logger, sourceNpmrcFolder, targetNpmrcFolder, useNpmrcPublish) {
    const sourceNpmrcPath = path.join(sourceNpmrcFolder, !useNpmrcPublish ? '.npmrc' : '.npmrc-publish');
    const targetNpmrcPath = path.join(targetNpmrcFolder, '.npmrc');
    try {
        if (fs.existsSync(sourceNpmrcPath)) {
-            _copyAndTrimNpmrcFile(sourceNpmrcPath, targetNpmrcPath);
+            _copyAndTrimNpmrcFile(logger, sourceNpmrcPath, targetNpmrcPath);
        }
        else if (fs.existsSync(targetNpmrcPath)) {
            // If the source .npmrc doesn't exist and there is one in the target, delete the one in the target
-            console.log(`Deleting ${targetNpmrcPath}`); // Verbose
+            logger.info(`Deleting ${targetNpmrcPath}`); // Verbose
            fs.unlinkSync(targetNpmrcPath);
        }
    }
@ -215,7 +219,7 @@ function _getRushTempFolder(rushCommonFolder) {
 /**
 * Resolve a package specifier to a static version
 */
-function _resolvePackageVersion(rushCommonFolder, { name, version }) {
+function _resolvePackageVersion(logger, rushCommonFolder, { name, version }) {
    if (!version) {
        version = '*'; // If no version is specified, use the latest version
    }
@ -229,7 +233,7 @@ function _resolvePackageVersion(rushCommonFolder, { name, version }) {
        try {
            const rushTempFolder = _getRushTempFolder(rushCommonFolder);
            const sourceNpmrcFolder = path.join(rushCommonFolder, 'config', 'rush');
-            _syncNpmrc(sourceNpmrcFolder, rushTempFolder);
+            _syncNpmrc(logger, sourceNpmrcFolder, rushTempFolder);
            const npmPath = getNpmPath();
            // This returns something that looks like:
            //  @microsoft/rush@3.0.0 '3.0.0'
@ -350,9 +354,9 @@ function _createPackageJson(packageInstallFolder, name, version) {
 /**
 * Run "npm install" in the package install folder.
 */
-function _installPackage(packageInstallFolder, name, version) {
+function _installPackage(logger, packageInstallFolder, name, version) {
    try {
-        console.log(`Installing ${name}...`);
+        logger.info(`Installing ${name}...`);
        const npmPath = getNpmPath();
        const result = childProcess.spawnSync(npmPath, ['install'], {
            stdio: 'inherit',
@ -362,7 +366,7 @@ function _installPackage(packageInstallFolder, name, version) {
        if (result.status !== 0) {
            throw new Error('"npm install" encountered an error');
        }
-        console.log(`Successfully installed ${name}@${version}`);
+        logger.info(`Successfully installed ${name}@${version}`);
    }
    catch (e) {
        throw new Error(`Unable to install package: ${e}`);
@ -388,7 +392,7 @@ function _writeFlagFile(packageInstallFolder) {
        throw new Error(`Unable to create installed.flag file in ${packageInstallFolder}`);
    }
 }
-function installAndRun(packageName, packageVersion, packageBinName, packageBinArgs) {
+function installAndRun(logger, packageName, packageVersion, packageBinName, packageBinArgs) {
    const rushJsonFolder = findRushJsonFolder();
    const rushCommonFolder = path.join(rushJsonFolder, 'common');
    const rushTempFolder = _getRushTempFolder(rushCommonFolder);
@ -397,14 +401,14 @@ function installAndRun(packageName, packageVersion, packageBinName, packageBinAr
        // The package isn't already installed
        _cleanInstallFolder(rushTempFolder, packageInstallFolder);
        const sourceNpmrcFolder = path.join(rushCommonFolder, 'config', 'rush');
-        _syncNpmrc(sourceNpmrcFolder, packageInstallFolder);
+        _syncNpmrc(logger, sourceNpmrcFolder, packageInstallFolder);
        _createPackageJson(packageInstallFolder, packageName, packageVersion);
-        _installPackage(packageInstallFolder, packageName, packageVersion);
+        _installPackage(logger, packageInstallFolder, packageName, packageVersion);
        _writeFlagFile(packageInstallFolder);
    }
    const statusMessage = `Invoking "${packageBinName} ${packageBinArgs.join(' ')}"`;
    const statusMessageLine = new Array(statusMessage.length + 1).join('-');
-    console.log(os.EOL + statusMessage + os.EOL + statusMessageLine + os.EOL);
+    logger.info(os.EOL + statusMessage + os.EOL + statusMessageLine + os.EOL);
    const binPath = _getBinPath(packageInstallFolder, packageBinName);
    const binFolderPath = path.resolve(packageInstallFolder, NODE_MODULES_FOLDER_NAME, '.bin');
    // Windows environment variables are case-insensitive.  Instead of using SpawnSyncOptions.env, we need to
@ -436,14 +440,14 @@ function installAndRun(packageName, packageVersion, packageBinName, packageBinAr
    }
 }
 exports.installAndRun = installAndRun;
-function runWithErrorAndStatusCode(fn) {
+function runWithErrorAndStatusCode(logger, fn) {
    process.exitCode = 1;
    try {
        const exitCode = fn();
        process.exitCode = exitCode;
    }
    catch (e) {
-        console.error(os.EOL + os.EOL + e.toString() + os.EOL + os.EOL);
+        logger.error(os.EOL + os.EOL + e.toString() + os.EOL + os.EOL);
    }
 }
 exports.runWithErrorAndStatusCode = runWithErrorAndStatusCode;
@ -462,16 +466,17 @@ function _run() {
        console.log('Example: install-run.js qrcode@1.2.2 qrcode https://rushjs.io');
        process.exit(1);
    }
-    runWithErrorAndStatusCode(() => {
+    const logger = { info: console.log, error: console.error };
+    runWithErrorAndStatusCode(logger, () => {
        const rushJsonFolder = findRushJsonFolder();
        const rushCommonFolder = _ensureAndJoinPath(rushJsonFolder, 'common');
        const packageSpecifier = _parsePackageSpecifier(rawPackageSpecifier);
        const name = packageSpecifier.name;
-        const version = _resolvePackageVersion(rushCommonFolder, packageSpecifier);
+        const version = _resolvePackageVersion(logger, rushCommonFolder, packageSpecifier);
        if (packageSpecifier.version !== version) {
            console.log(`Resolved to ${name}@${version}`);
        }
-        return installAndRun(name, version, packageBinName, packageBinArgs);
+        return installAndRun(logger, name, version, packageBinName, packageBinArgs);
    });
 }
 _run();
--- a/extensions/applicationinsights-analytics-js/package.json
+++ b/extensions/applicationinsights-analytics-js/package.json
@ -39,7 +39,7 @@
        "@rollup/plugin-replace": "^2.3.3",
        "rollup-plugin-cleanup": "^3.2.1",
        "rollup": "^2.32.0",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/extensions/applicationinsights-clickanalytics-js/package.json
+++ b/extensions/applicationinsights-clickanalytics-js/package.json
@ -32,7 +32,7 @@
        "@rollup/plugin-replace": "^2.3.3",
        "rollup-plugin-cleanup": "^3.2.1",
        "rollup": "^2.32.0",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/extensions/applicationinsights-debugplugin-js/package.json
+++ b/extensions/applicationinsights-debugplugin-js/package.json
@ -28,7 +28,7 @@
        "@microsoft/api-extractor": "^7.18.1",
        "typescript": "^4.3.4",
        "tslib": "^2.0.0",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/extensions/applicationinsights-dependencies-js/package.json
+++ b/extensions/applicationinsights-dependencies-js/package.json
@ -29,7 +29,7 @@
        "@microsoft/api-extractor": "^7.18.1",
        "typescript": "^4.3.4",
        "tslib": "^2.0.0",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/extensions/applicationinsights-perfmarkmeasure-js/package.json
+++ b/extensions/applicationinsights-perfmarkmeasure-js/package.json
@ -29,7 +29,7 @@
        "@microsoft/api-extractor": "^7.18.1",
        "typescript": "^4.3.4",
        "tslib": "^2.0.0",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
        "@nevware21/grunt-eslint-ts": "^0.2.2",
--- a/extensions/applicationinsights-properties-js/package.json
+++ b/extensions/applicationinsights-properties-js/package.json
@ -29,7 +29,7 @@
        "@microsoft/api-extractor": "^7.18.1",
        "typescript": "^4.3.4",
        "tslib": "^2.0.0",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/extensions/applicationinsights-react-js/package.json
+++ b/extensions/applicationinsights-react-js/package.json
@ -37,7 +37,7 @@
        "@types/react": "^16.9.11",
        "@types/react-dom": "^16.9.4",
        "csstype": "~2.6.7",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "jest": "^27.3.1",
        "react": "^17.0.2",
--- a/extensions/applicationinsights-react-native/package.json
+++ b/extensions/applicationinsights-react-native/package.json
@ -23,7 +23,7 @@
        "@microsoft/ai-test-framework": "0.0.1",
        "@microsoft/applicationinsights-rollup-es3": "1.1.3",
        "@microsoft/api-extractor": "^7.18.1",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "grunt-contrib-uglify": "^5.0.1",
--- a/package.json
+++ b/package.json
@ -36,7 +36,7 @@
    },
    "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
    "devDependencies": {
-        "@microsoft/rush": "^5.63.0",
+        "@microsoft/rush": "^5.70.0",
        "@nevware21/grunt-eslint-ts": "^0.2.2",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
        "@typescript-eslint/eslint-plugin": "^4.28.0",
@ -50,7 +50,7 @@
        "eslint-plugin-node": "^11.1.0",
        "eslint-plugin-promise": "^5.1.0",
        "eslint-plugin-security": "^1.4.0",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-connect": "^3.0.0",
        "grunt-contrib-qunit": "^5.0.1",
--- a/rush.json
+++ b/rush.json
@ -1,8 +1,8 @@
 {
  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush.schema.json",

-  "npmVersion": "8.5.5",
-  "rushVersion": "5.63.0",
+  "npmVersion": "8.10.0",
+  "rushVersion": "5.70.0",
  "projectFolderMaxDepth": 4,
  "projects": [
    {
--- a/shared/AppInsightsCommon/package.json
+++ b/shared/AppInsightsCommon/package.json
@ -27,7 +27,7 @@
        "@microsoft/applicationinsights-rollup-plugin-uglify3-js": "1.0.0",
        "@microsoft/applicationinsights-rollup-es3": "1.1.3",
        "@microsoft/api-extractor": "^7.18.1",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/shared/AppInsightsCommon/rollup.config.js
+++ b/shared/AppInsightsCommon/rollup.config.js
@ -42,6 +42,12 @@ const browserRollupConfigFactory = isProduction => {
      freeze: false,
      sourcemap: true
    },
+    treeshake: {
+      propertyReadSideEffects: false,
+      moduleSideEffects: false,
+      tryCatchDeoptimization: false,
+      correctVarValueBeforeDeclaration: false
+    },
    plugins: [
      dynamicRemove(),
      replace({
@ -93,6 +99,12 @@ const nodeUmdRollupConfigFactory = (isProduction) => {
      freeze: false,
      sourcemap: true
    },
+    treeshake: {
+      propertyReadSideEffects: false,
+      moduleSideEffects: false,
+      tryCatchDeoptimization: false,
+      correctVarValueBeforeDeclaration: false
+    },
    plugins: [
      dynamicRemove(),
      replace({
--- a/shared/AppInsightsCore/package.json
+++ b/shared/AppInsightsCore/package.json
@ -39,7 +39,7 @@
        "@microsoft/applicationinsights-rollup-plugin-uglify3-js": "1.0.0",
        "@microsoft/applicationinsights-rollup-es3": "1.1.3",
        "@microsoft/api-extractor": "^7.18.1",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/shared/AppInsightsCore/rollup.config.js
+++ b/shared/AppInsightsCore/rollup.config.js
@ -42,6 +42,12 @@ const browserRollupConfigFactory = isProduction => {
      freeze: false,
      sourcemap: true
    },
+    treeshake: {
+      propertyReadSideEffects: false,
+      moduleSideEffects: false,
+      tryCatchDeoptimization: false,
+      correctVarValueBeforeDeclaration: false
+    },
    plugins: [
      dynamicRemove(),
      replace({
@ -93,6 +99,12 @@ const nodeUmdRollupConfigFactory = (isProduction) => {
      freeze: false,
      sourcemap: true
    },
+    treeshake: {
+      propertyReadSideEffects: false,
+      moduleSideEffects: false,
+      tryCatchDeoptimization: false,
+      correctVarValueBeforeDeclaration: false
+    },
    plugins: [
      dynamicRemove(),
      replace({
--- a/shared/AppInsightsCore/tsconfig.json
+++ b/shared/AppInsightsCore/tsconfig.json
@ -9,9 +9,8 @@
    "forceConsistentCasingInFileNames": true,
    "importHelpers": true,
    "noEmitHelpers": true,
-    "skipLibCheck": true,
+    "skipLibCheck": false,
    "alwaysStrict": true,
-    "skipLibCheck": true,
    "skipDefaultLibCheck": true,
    "declaration": true,
    "declarationDir": "shared/AppInsightsCore/types",
--- a/tools/applicationinsights-web-snippet/package.json
+++ b/tools/applicationinsights-web-snippet/package.json
@ -31,7 +31,7 @@
    "@rollup/plugin-replace": "^2.3.3",
    "rollup-plugin-cleanup": "^3.2.1",
    "rollup": "^2.32.0",
-    "grunt": "^1.4.1",
+    "grunt": "^1.5.3",
    "grunt-cli": "^1.4.3",
    "grunt-contrib-qunit": "^5.0.1",
    "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/tools/chrome-debug-extension/package.json
+++ b/tools/chrome-debug-extension/package.json
@ -61,7 +61,7 @@
        "@types/react-dom": "^16.9.4",
        "ansi-regex": ">=5.0.1",
        "autoprefixer": "9.4.5",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "rollup": "^2.32.0",
        "rollup-plugin-cleanup": "^3.2.1",
        "rollup-plugin-copy": "^3.4.0",
--- a/tools/release-tools/package.json
+++ b/tools/release-tools/package.json
@ -22,7 +22,7 @@
        "url": "https://msasg.visualstudio.com/DefaultCollection/Shared%20Data/_git/1DS.JavaScript"
    },
    "devDependencies": {
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "globby": "^11.0.0"
    }
 }
--- a/tools/rollup-es3/package.json
+++ b/tools/rollup-es3/package.json
@ -34,7 +34,7 @@
    "devDependencies": {
        "@microsoft/ai-test-framework": "0.0.1",
        "@microsoft/applicationinsights-rollup-plugin-uglify3-js": "1.0.0",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/tools/rollup-plugin-uglify3-js/package.json
+++ b/tools/rollup-plugin-uglify3-js/package.json
@ -25,7 +25,7 @@
    "license": "MIT",
    "sideEffects": false,
    "devDependencies": {
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",
--- a/tools/shims/package.json
+++ b/tools/shims/package.json
@ -37,7 +37,7 @@
        "@microsoft/ai-test-framework": "0.0.1",
        "@microsoft/applicationinsights-rollup-plugin-uglify3-js": "1.0.0",
        "@microsoft/applicationinsights-rollup-es3" : "1.1.3",
-        "grunt": "^1.4.1",
+        "grunt": "^1.5.3",
        "grunt-cli": "^1.4.3",
        "grunt-contrib-qunit": "^5.0.1",
        "@nevware21/grunt-ts-plugin": "^0.4.3",