[universal] - Removing obsolete NVS (GHSA-r4q5-vmmm-2653) and patching pip for Python 3.13.8 (GHSA-jp4c-xjxw-mgf9)#1928
Open
Kaniska244 wants to merge 6 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR removes the obsolete NVS (Node Version Switcher) devcontainer feature from the Universal image to mitigate the follow-redirects vulnerability advisory GHSA-r4q5-vmmm-2653, and updates versioning/docs/tests accordingly.
Changes:
- Remove the local
nvsfeature from the Universal devcontainer configuration and related environment variables. - Update the Universal image manifest and README to version
6.0.9. - Adjust Universal smoke tests to stop validating
nvsand to validatenvmswitching behavior instead.
Show a summary per file
| File | Description |
|---|---|
| src/universal/test-project/test.sh | Removes nvs validation and updates nvm switching checks. |
| src/universal/README.md | Updates the example semantic-version tag to 6.0.9-noble. |
| src/universal/manifest.json | Bumps version to 6.0.9 and removes nvs from listed git-installed components. |
| src/universal/.devcontainer/local-features/setup-user/devcontainer-feature.json | Removes the NVS_HOME container environment variable. |
| src/universal/.devcontainer/local-features/nvs/install.sh | Deletes the NVS feature install script. |
| src/universal/.devcontainer/local-features/nvs/devcontainer-feature.json | Deletes the NVS feature definition. |
| src/universal/.devcontainer/devcontainer.json | Removes ./local-features/nvs from features and install order. |
Review details
- Files reviewed: 7/7 changed files
- Comments generated: 2
- Review effort level: Low
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Kaniska244
changed the title
follow-redirects vulnerability issue GHSA-r4q5-vmmm-2653GHSA-r4q5-vmmm-2653) and patching pip for Python 3.13.8 (GHSA-jp4c-xjxw-mgf9)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR removes the obsolete NVS (Node Version Switcher) local feature from the
universalimage to mitigate thefollow-redirectsvulnerabilityGHSA-r4q5-vmmm-2653. It also patches thepipversion bundled with the pinned Python3.13.8to addressGHSA-jp4c-xjxw-mgf9.NVS is no longer required in the
universalimage — Node.js version management is already fully handled bynvm(Node Version Manager), which remains installed and configured. Removing NVS eliminates the transitive dependency on the vulnerablefollow-redirectspackage.Motivation
jasongin/nvs) pulls in thefollow-redirectspackage, which is affected byGHSA-r4q5-vmmm-2653.pipversion shipped with pinned Python3.13.8is affected byGHSA-jp4c-xjxw-mgf9and needs to be upgraded.nvm, which is already present and is the primary Node version manager in this image.Changes
NVS removal
cgmanifest.jsonnvscomponent registration (jasongin/nvs) from the component governance manifest.src/universal/.devcontainer/devcontainer.json./local-features/nvsfeature reference and its entry from the overrides list.src/universal/.devcontainer/local-features/nvs/devcontainer-feature.jsonsrc/universal/.devcontainer/local-features/nvs/install.shjasongin/nvsand pulled in the vulnerable dependency).src/universal/.devcontainer/local-features/setup-user/devcontainer-feature.jsonNVS_HOMEenvironment variable.src/universal/manifest.json6.0.8→7.0.0; removed thenvsentry from the git tools map.src/universal/README.md6.x→7.0.0.pip security patch (
GHSA-jp4c-xjxw-mgf9)src/universal/.devcontainer/local-features/patch-python/install.shpipupgrade for the pinned Python3.13.8(gated onPATCH_PYTHON_PIP_UPGRADE_PATH). Includes a note to remove this once3.13.8is bumped.src/universal/test-project/test-utils.shcheckPythonPipVersionhelper to assert the installedpipversion meets a minimum requirement.Tests
src/universal/test-project/test.shnvsversion check; replaced the oldnvm install 8.0.0test with checks that switch between the default (24) and additional (22) Node versions usingnvm; added apipversion check (>= 26.1.0) for Python3.13.8.Testing
nvs --version) and verifiednvmcan switch to an additional pre-installed Node version (22) and back to the default (24), confirming version management still works without NVS.checkPythonPipVersionand a test asserting the3.13.8pipversion is>= 26.1.0.Impact / Notes
6.0.8to7.0.0, reflecting the removal of thenvstool.nvscommand or theNVS_HOMEenvironment variable in theuniversalimage should migrate tonvm.patch-python/install.shis a temporary workaround and should be removed once the pinned Python3.13.8is updated to a newer version.