url.parse() is deemed insecure and has been deprecated.

api/TaskAgentApi.ts

@@ -226,15 +226,15 @@ export class TaskAgentApi extends taskagentbasem.TaskAgentApiBase implements ITa
     private _getAccountUrl(collectionUrl: string): string {
         // converts a collection URL to an account URL
         // returns null if the conversion can't be made
-        var purl = url.parse(collectionUrl);
+        var purl = new URL(collectionUrl);
         if (!purl.protocol || !purl.host) {
             return null;
         }
 
         var accountUrl = purl.protocol + '//' + purl.host;
 
         // purl.path is something like /DefaultCollection or /tfs/DefaultCollection or /DefaultCollection/
-        var splitPath: string[] = purl.path.split('/').slice(1);
+        var splitPath: string[] = purl.pathname.split('/').slice(1);
         if (splitPath.length === 0 || (splitPath.length === 1 && splitPath[0] === '')) {
             return null;
         }

api/VsoClient.ts

@@ -49,7 +49,7 @@ export class VsoClient {
 
     constructor(baseUrl: string, restClient: restm.RestClient) {
         this.baseUrl = baseUrl;
-        this.basePath = url.parse(baseUrl).pathname;
+        this.basePath = new URL(baseUrl).pathname;
         this.restClient = restClient;
         this._locationsByAreaPromises = {};
         this._initializationPromise = Promise.resolve(true);

api/WebApi.ts

@@ -422,7 +422,7 @@ export class WebApi {
         const noProxyDomains = (process.env.no_proxy || '')
         .split(',')
         .map(v => v.toLowerCase());
-        const serverUrl = url.parse(_url).host.toLowerCase();
+        const serverUrl = new URL(_url).host.toLowerCase();
         // return true if the no_proxy includes the host
         return noProxyDomains.indexOf(serverUrl) !== -1;
     }