Cannot install v6 on TFS 2017 Update 3

[wiseman13]

I am trying to install the OWASP Dependency Check extension from the Visual Studio Marketplace for our on prem version of TFS 2017. The version of the plugin is 6.1.0.1 and I get the following message in the event log after trying to install. If I download the vsix and try to upload manually I get the same error.

Team Foundation Server version: 15.117.27414.0

System.ArgumentException: The asset type
'Tasks/dependency-check-build-task/node_modules/@types/concat-stream/index.d.ts'
is invalid. Asset types may only contain 'A' through 'Z', 'a' through 'z', '0'
through '9', '.' and '-'. The asset type can't have more than one consecutive
'.'. at
Microsoft.VisualStudio.Services.Gallery.WebApi.GalleryUtil.CheckAssetType(String
assetType) at
Microsoft.VisualStudio.Services.Gallery.Server.PublishedExtensionService.FixUpFieldsAndValidateCommon(IVssRequestContext
requestContext, IEnumerable1 assets, IEnumerable1 installationTargets,
InstallationTarget[]& installationTargetArray, PublishedExtensionFlags&
flags, Boolean& shouldNotify, Boolean&
isUpdateVstsExtensionInstallationTarget, Boolean isFirstParty) at
Microsoft.VisualStudio.Services.Gallery.Server.PublishedExtensionService.CreateExtensionCommon(IVssRequestContext
requestContext, Stream extensionPackageStream, String requestingPublisherName,
IEnumerable`1 uploadedAssets, Boolean immediateVersionValidation) at
Microsoft.VisualStudio.Services.Gallery.Server.PublishedExtensionService.CreateExtension(IVssRequestContext
requestContext, Stream extensionPackageStream, String requestingPublisherName)
at
Microsoft.VisualStudio.Services.Gallery.Extensions.OnPremPublishedExtensionService.PublishExtensionFromHosted(IVssRequestContext
requestContext, String publisherName, String extensionName, Boolean
onlyUpdateForNewVersion, Boolean blockPreviewToPaidUpgrade)

[wiseman13]

Just a quick update that I m still looking into this, but have not found any other details that would help me resolve it.

[Saturate]

For me it seems like the issue is that we have a package from @types/concat-stream and the @ is not allowed.

It's an issue that we are packaging things only used during build time, this should not be there during run time.

@pippolino Would it make sense for you to look into this while doing the pipeline changes?

[pippolino]

@Saturate I would like to check the libraries used because some may not be necessary.

For the moment I would like touch as little as possible to have a working version with the yaml pipeline and then I will start checking the other aspects.