Conversation
There was a problem hiding this comment.
Pull request overview
Automates the routine refresh of devcontainer image “history” markdowns to reflect newly built image digests and updated tool/runtime versions, and updates cgmanifest.json to match current component versions.
Changes:
- Updated image digests and reported tool/runtime versions across multiple
src/*/history/dev.mdfiles (Node/TypeScript, Python, Go, Java, .NET, etc.). - Updated Go image history to include new 1.26 variants and remove older 1.24 entries.
- Refreshed
cgmanifest.jsoncomponent registrations (e.g., pip/npm/go/cargo versions, git/Oh My Zsh/vcpkg commits) and removed the Yarn registration.
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/universal/history/dev.md | Refreshes Universal image digest/tool versions; includes updated runtime and tool inventory. |
| src/typescript-node/history/dev.md | Updates digests and Node/TypeScript + tool/package versions for each variant. |
| src/rust/history/dev.md | Updates digests and Rust toolchain versions across variants. |
| src/python/history/dev.md | Updates digests and Python versions across variants; refreshes tool inventories. |
| src/php/history/dev.md | Updates digests and PHP/Xdebug/Composer versions across variants. |
| src/miniconda/history/dev.md | Updates digest and conda/Python-related tool versions. |
| src/jekyll/history/dev.md | Updates digests and Ruby/Bundler/tool versions across variants. |
| src/javascript-node/history/dev.md | Updates digests and Node/eslint + tool/package versions across variants. |
| src/java/history/dev.md | Updates digests and Java versions across variants. |
| src/java-8/history/dev.md | Updates digests and Java 8 version reporting for trixie/bookworm variants. |
| src/go/history/dev.md | Adds/updates 1.26 variants, refreshes tool versions, removes 1.24 sections. |
| src/dotnet/history/dev.md | Updates digests and .NET SDK versions across variants. |
| src/cpp/history/dev.md | Updates digests and tool/package inventory across variants. |
| src/base-ubuntu/history/dev.md | Updates digest and Ubuntu base package/tool versions. |
| src/base-debian/history/dev.md | Updates digests and Debian base package/tool versions across variants. |
| src/base-alpine/history/dev.md | Updates digests and Alpine package inventory across variants. |
| src/anaconda/history/dev.md | Updates digest and conda Python/Jupyter package versions. |
| cgmanifest.json | Refreshes component registration versions/commits and removes Yarn registration. |
| { | ||
| "Registrations": [ | ||
| { | ||
| "Component": { | ||
| "Type": "linux", | ||
| "Linux": { | ||
| "Name": "yarn", | ||
| "Version": "1.22.22-1", | ||
| "Distribution": "debian", | ||
| "Release": "12", | ||
| "Pool-URL": "https://dl.yarnpkg.com/debian", | ||
| "Key-URL": "https://dl.yarnpkg.com/debian/pubkey.gpg" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Component": { | ||
| "Type": "Pip", |
There was a problem hiding this comment.
cgmanifest.json no longer registers Yarn as a component, but src/universal/history/dev.md still lists Yarn (via Corepack) in the image contents. For compliance/traceability, these should be consistent.
Either remove Yarn from the Universal history if it’s not actually shipped, or add an appropriate Yarn/Corepack component registration (reflecting how Yarn is delivered) back into the manifest.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
| | Tool | Version | Path | | ||
| |------|---------|------| | ||
| | [git](https://github.com/git/git) | 2.52.0 | | ||
| | [git](https://github.com/git/git) | 2.39.5 | |
There was a problem hiding this comment.
For the rust bookworm variant, the history reports git 2.39.5, but other bookworm-based images in this repo (e.g., src/base-debian/history/dev.md) report git 2.53.0 while still listing the distro git package separately. Please verify the intended git version for this image and ensure the “Other tools and utilities” git version is consistent with the repo-wide convention/output.
| | [git](https://github.com/git/git) | 2.39.5 | | |
| | [git](https://github.com/git/git) | 2.53.0 | |
| "Type": "other", | ||
| "Other": { | ||
| "Name": "git", | ||
| "Version": "2.39.5", |
There was a problem hiding this comment.
cgmanifest.json now includes an additional “git” component at version 2.39.5, while it already registers git 2.53.0 elsewhere. Unless there are distinct images actually shipping different git binaries, this looks like an accidental duplicate/mis-version that can make the SBOM ambiguous. Please confirm the correct git versions per image and de-duplicate or scope these registrations accordingly.
| "Version": "2.39.5", | |
| "Version": "2.53.0", |
| | Tool | Version | Path | | ||
| |------|---------|------| | ||
| | [git](https://github.com/git/git) | 2.52.0 | | ||
| | [git](https://github.com/git/git) | 2.53.0 | |
There was a problem hiding this comment.
The Alpine history reports git as 2.53.0 here, but the “Additional linux tools and packages” section lists the git package as 2.52.0-r0. Please ensure the history-generation reports the version of the git binary actually present in the image (and keep it consistent with the package list).
| | [git](https://github.com/git/git) | 2.53.0 | | |
| | [git](https://github.com/git/git) | 2.52.0 | |
| { | ||
| "Registrations": [ | ||
| { | ||
| "Component": { | ||
| "Type": "linux", | ||
| "Linux": { | ||
| "Name": "yarn", | ||
| "Version": "1.22.22-1", | ||
| "Distribution": "debian", | ||
| "Release": "12", | ||
| "Pool-URL": "https://dl.yarnpkg.com/debian", | ||
| "Key-URL": "https://dl.yarnpkg.com/debian/pubkey.gpg" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Component": { | ||
| "Type": "Pip", |
There was a problem hiding this comment.
cgmanifest.json no longer contains a Yarn component registration, but src/universal/history/dev.md still lists Yarn as included. Please either restore the Yarn registration (if it’s still shipped, e.g. via Corepack) or remove Yarn from the generated history so SBOM and docs stay consistent.
Automated update for image history