[universal] - Removing obsolete NVS to mitigate follow-redirects vulnerability issue GHSA-r4q5-vmmm-2653

[Kaniska244]

Summary

This PR removes the obsolete NVS (Node Version Switcher) local feature from the universal image to mitigate the follow-redirects vulnerability GHSA-r4q5-vmmm-2653.

NVS is no longer required in the universal image. Node.js version management is already fully handled by nvm (Node Version Manager), which remains installed and configured. Removing NVS eliminates the transitive dependency on the vulnerable follow-redirects package.

Motivation

• Security: The NVS tool (cloned from jasongin/nvs) pulls in the follow-redirects package, which is affected by GHSA-r4q5-vmmm-2653.
• Redundancy: NVS functionality overlaps with nvm, which is already present and is the primary Node version manager in this image.

Changes

File	Change
cgmanifest.json	Removed the nvs component registration (jasongin/nvs) from the component governance manifest.
src/universal/.devcontainer/devcontainer.json	Removed the ./local-features/nvs feature reference and its entry from the overrides list.
src/universal/.devcontainer/local-features/nvs/devcontainer-feature.json	Deleted — NVS feature definition.
src/universal/.devcontainer/local-features/nvs/install.sh	Deleted — NVS install script (cloned jasongin/nvs and pulled in the vulnerable dependency).
src/universal/.devcontainer/local-features/setup-user/devcontainer-feature.json	Removed the NVS_HOME environment variable.
src/universal/manifest.json	Bumped version 6.0.8 → 7.0.0; removed the nvs entry from the git tools map.
src/universal/README.md	Updated example image tag 6.0.8 → 7.0.0.
src/universal/test-project/test.sh	Removed the nvs version check; replaced the old nvm install 8.0.0 test with tests that switch between the default (24) and additional (22) Node versions using nvm.

Testing

Updated test-project/test.sh:

• Removed the NVS-specific check (nvs --version).
• Replaced the outdated nvm install 8.0.0 test with checks that verify nvm can switch to an additional pre-installed Node version (22) and back to the default (24), confirming Node version management still works correctly without NVS.

Impact / Notes

• Breaking change: The image version is bumped from 6.0.8 to 7.0.0, reflecting the removal of the nvs tool.
• Users relying on the nvs command or the NVS_HOME environment variable in the universal image should migrate to nvm.
• No changes to the default Node.js version behavior.

[Copilot]

Pull request overview

This PR removes the obsolete NVS (Node Version Switcher) devcontainer feature from the Universal image to mitigate the follow-redirects vulnerability advisory GHSA-r4q5-vmmm-2653, and updates versioning/docs/tests accordingly.

Changes:

• Remove the local nvs feature from the Universal devcontainer configuration and related environment variables.
• Update the Universal image manifest and README to version 6.0.9.
• Adjust Universal smoke tests to stop validating nvs and to validate nvm switching behavior instead.

Show a summary per file

File	Description
src/universal/test-project/test.sh	Removes nvs validation and updates nvm switching checks.
src/universal/README.md	Updates the example semantic-version tag to 6.0.9-noble.
src/universal/manifest.json	Bumps version to 6.0.9 and removes nvs from listed git-installed components.
src/universal/.devcontainer/local-features/setup-user/devcontainer-feature.json	Removes the NVS_HOME container environment variable.
src/universal/.devcontainer/local-features/nvs/install.sh	Deletes the NVS feature install script.
src/universal/.devcontainer/local-features/nvs/devcontainer-feature.json	Deletes the NVS feature definition.
src/universal/.devcontainer/devcontainer.json	Removes ./local-features/nvs from features and install order.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 2
• Review effort level: Low