fix: bump outdated feature references (node & docker in docker) - #1957
Merged
Sam Byng (sam-byng) merged 5 commits intoAug 11, 2026
Conversation
Venkumahanti Subhankar (V-Subhankar-infy)
requested a review
from a team
as a code owner
August 10, 2026 11:23
Copilot started reviewing on behalf of
Venkumahanti Subhankar (V-Subhankar-infy)
August 10, 2026 11:23
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Updates this repo’s devcontainer configs to stop pinning outdated major versions of upstream features (primarily ghcr.io/devcontainers/features/node and workspace docker-in-docker), and bumps affected image versions / docs accordingly.
Changes:
- Bumped
ghcr.io/devcontainers/features/nodereferences from:1→:2across the affected image.devcontainer/devcontainer.jsonfiles and regenerated the corresponding lockfiles. - Bumped each affected image’s
manifest.jsonminor version and updated README examples where referenced. - Updated the root workspace
.devcontainer/devcontainer.jsonto usedocker-in-docker:4.
Reviewed changes
Copilot reviewed 41 out of 41 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| src/anaconda/README.md | Updates documented semantic-version tag example and node feature reference |
| src/anaconda/manifest.json | Minor version bump for the anaconda image |
| src/anaconda/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/anaconda/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/dotnet/README.md | Updates documented semantic-version tag examples for current image version |
| src/dotnet/manifest.json | Minor version bump for the dotnet image |
| src/dotnet/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/dotnet/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/go/README.md | Updates documented semantic-version tag example and node feature reference |
| src/go/manifest.json | Minor version bump for the go image |
| src/go/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/go/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/java/README.md | Updates documented semantic-version tag example and node feature reference |
| src/java/manifest.json | Minor version bump for the java image |
| src/java/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/java/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/java-8/README.md | Updates documented semantic-version tag example to current image version |
| src/java-8/manifest.json | Minor version bump for the java-8 image |
| src/java-8/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/java-8/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/javascript-node/README.md | Updates documented semantic-version tag example to current image version |
| src/javascript-node/manifest.json | Minor version bump for the javascript-node image |
| src/javascript-node/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/javascript-node/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/jekyll/README.md | Updates documented semantic-version tag example and node feature reference |
| src/jekyll/manifest.json | Minor version bump for the jekyll image |
| src/jekyll/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/jekyll/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/miniconda/README.md | Updates documented semantic-version tag example and node feature reference |
| src/miniconda/manifest.json | Minor version bump for the miniconda image |
| src/miniconda/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/miniconda/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/php/README.md | Updates documented semantic-version tag example and node feature reference |
| src/php/manifest.json | Minor version bump for the php image |
| src/php/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/php/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| src/python/README.md | Updates documented semantic-version tag example and node feature reference |
| src/python/manifest.json | Minor version bump for the python image |
| src/python/.devcontainer/devcontainer.json | Bumps node feature major (node:1 → node:2) |
| src/python/.devcontainer/devcontainer-lock.json | Regenerated lockfile reflecting node:2 resolution |
| .devcontainer/devcontainer.json | Bumps docker-in-docker feature major (:2 → :4) for the workspace devcontainer |
Suppressed comments (1)
src/dotnet/README.md:40
- The README’s semantic-version examples still reference the previous minor tag (
2.1-9.0) even though this PR bumps the image version to2.2.0. To keep the documented tags aligned with the current manifest version, update the minor example to2.2-9.0.
- `mcr.microsoft.com/devcontainers/dotnet:2.1-9.0`
- `mcr.microsoft.com/devcontainers/dotnet:2.2.0-9.0`
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Venkumahanti Subhankar (V-Subhankar-infy)
marked this pull request as draft
August 10, 2026 11:30
Venkumahanti Subhankar (V-Subhankar-infy)
marked this pull request as ready for review
August 10, 2026 12:20
Venkumahanti Subhankar (V-Subhankar-infy)
requested a lite review from Copilot
August 10, 2026 12:20
Copilot started reviewing on behalf of
Venkumahanti Subhankar (V-Subhankar-infy)
August 10, 2026 12:20
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 46 out of 46 changed files in this pull request and generated no new comments.
Suppressed comments (5)
src/ruby/README.md:64
- Same issue here: the fenced block is labeled
json, but the example starts at the"features"property and is not valid JSON on its own. Wrapping it in an outer object makes it directly usable indevcontainer.json.
src/ruby/README.md:35 - The semver tag examples mention
*-bullseyefor the Ruby 4.x variants, butsrc/ruby/manifest.jsononly defines 4.0 variants fortrixieandbookworm(no4.0-bullseye). This makes the README examples for4-4[-bullseye],4.0-4[-bullseye], and4.0.0-4[-bullseye]incorrect.
src/ruby/README.md:45 - This sentence says the container includes
nvm, but the example immediately below uses the Node feature. To avoid confusing readers, align the wording with the feature-based example (or update the example to matchnvm).
src/ruby/README.md:52 - The snippet is fenced as
jsonbut the contents are not valid JSON as written (it starts at the"features"property without an enclosing object). Wrap it in an outer object so it can be copied directly into adevcontainer.json.
This issue also appears on line 60 of the same file.
src/ruby/.devcontainer/devcontainer.json:15
- The PR description says
ruby:1→:2changes are excluded pending a separate decision, but this PR updatesghcr.io/devcontainers/features/ruby:1to:2here (and also bumpssrc/ruby/manifest.jsonto 4.0.0 with README notes about migrating from rvm). Either update the PR description/"Affected Images" section to include Ruby, or split/revert the Ruby-related changes into a separate PR to match the stated scope.
Venkumahanti Subhankar (V-Subhankar-infy)
marked this pull request as draft
August 10, 2026 13:06
Venkumahanti Subhankar (V-Subhankar-infy)
marked this pull request as ready for review
August 11, 2026 06:15
Sam Byng (sam-byng)
merged commit Aug 11, 2026
987c6fc
into
devcontainers:main
12 of 13 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps outdated
ghcr.io/devcontainers/features/*major version pins across 11 images. Partially Resolves #1944.Current Issue
Multiple images pin
ghcr.io/devcontainers/features/node:1when:2is the current major. The root.devcontainerpinsdocker-in-docker:2when:4is current.src/rubypinsruby:1when:2is current. These stale pins persist becausedevcontainer upgradeonly refreshes lockfiles within the pinned major — it does not bump the major version indevcontainer.json. No automation exists to detect this drift.universalis excluded from this PR — it shares theruby:1anddocker-in-docker:3pins but requires separate coordination due to its complexity.Changes
Per image:
.devcontainer/devcontainer.json.devcontainer/devcontainer-lock.jsonviadevcontainer upgradeREADME.md(where documented)manifest.json+ corresponding README version tagsRoot
.devcontainer/devcontainer.json:docker-in-docker:2→:4(no manifest for workspace config).Ruby-specific (breaking):
ruby:1→:2dropsrvmby default (usesruby-buildinstead)check "rvm"→check "ruby-build""versionManager": "rvm"3.0.9→4.0.0)Anaconda fix (pre-existing bug):
jupyterlab=4.4.8andnotebook=7.5.6were pinned inapply_security_patches.shandtest.shbut neither version was ever published on PyPI or condajupyterlab=4.5.3andnotebook=7.5.7(first available conda versions above the invalid pins)Affected Images
Impact
nodefeature set to"version": "none"— no runtime behavior change from node bump.docker-in-docker:4is backward compatible with:2/:3.rvmno longer pre-installed. Users can opt-in via"versionManager": "rvm"in their devcontainer.json. Migration documented in README.jupyterlab=4.4.8,notebook=7.5.6never existed). Now pins to real versions available on conda.universalintentionally excluded — to be addressed separately.