chore(deps, cpp): update ms-vscode.cmake-tools, ms-vscode.cpptools, sonarsource.sonarlint-vscode in devcontainer-metadata.json by embedded-releaser-app[bot] · Pull Request #123 · embedded-pro/embedded-devcontainer

embedded-releaser-app · 2026-09-13T07:35:40Z

Note

Before merging this PR, please conduct a manual test checking basic functionality of the updated plug-ins. There are limited automated tests for the VS Code Extension updates.

Updates sonarsource.sonarlint-vscode from 5.9.1 to 6.0.1

Release notes

For full release notes, see JIRA

For full release notes, see JIRA

For full release notes, see JIRA

Updates ms-vscode.cpptools from 1.33.8 to 1.34.4

Release notes

Instructions

The extension can be obtained by one of the methods below:

Install the "C/C++" or "C/C++ Extension Pack" extension published by Microsoft from the Extensions view in VS Code.

Download a vsix that matches your OS from the Assets section below (and install it via the method mentioned above). The previous download methods have the vsix signatures verified by the Marketplace, but for this method, you can do the verification by downloading the matching manifest and signature.p7s file and running npx [at]vscode/vsce@latest verify-signature -i <.vsix> -m <.signature.manifest> -s <.signature.p7s> vscode-vsce#1044.

Requirements

VS Code 1.77.0 or later (March 2023).

Windows 10+ (x64, arm64), macOS 10.13+, Linux (Ubuntu 16+, etc.).

Debugging is not supported on CentOS 7 or RHEL 7. The last supported version was 1.22.11: #13219.

The last supported version for Windows 7 and 8 was 1.30.5.

Changes

Enhancements

Add folding support for C++ public, private, and protected access sections. #14645

Thanks for the contribution. @8prashant (Prashant Kumar Rai) PR #14675

Add the processFilter launch option to filter or automatically select processes for remote cppdbg attach configurations. #14682

Thanks for the contribution. @afreof (Adrian Freihofer) PR #14684

Improve workspace indexing performance and reduce memory usage by deduplicating browse paths from compile_commands.json, excluding unrelated files from the browse database, and avoiding unnecessary tag parsing of non-included extensionless files. #14693

Improve C/C++ file classification by supporting extensionless headers and additional extensions such as .hip throughout extension features. PR #14711

Update the bundled clang-tidy and clang-format from 22.1.3 to 23.1.0, including available clang-tidy check suggestions and documentation. PR #14713

Reduce language server memory usage and RPC overhead for large messages and browse database snapshots.

Add IntelliSense support for C23 _BitInt, C++26 pack indexing, and C++26 structured binding packs.

Bug Fixes

Fix 'C/C++: Edit Configurations (UI)' not fully respecting custom theme colors. #11263

Thanks for the contribution. @8prashant (Prashant Kumar Rai) PR #14692

Fix formatting not inserting the final newline requested by InsertNewlineAtEOF. #12680

Fix inactive code being dimmed from the wrong column when a preprocessor directive is preceded by a comment. #12882

Thanks for the contribution. @8prashant (Prashant Kumar Rai) PR #14666

Fix 'Run/Debug C/C++ File' buttons being hidden when C_Cpp.intelliSenseEngine is set to disabled. #13001

Thanks for the contribution. @8prashant (Prashant Kumar Rai) PR #14719

Fix nested quoted #include directives failing to resolve source-relative headers when -iquote paths are used. #13606

Fix false IntelliSense errors for EnTT multi-component views caused by heterogeneous auto non-type template parameter packs. #14456

Fix false IntelliSense errors for GNU ARM stack-pointer clobbers, including CMSIS __set_PSP and __set_MSP. #14486

Fix incorrect semantic highlighting for explicit function template specializations. #14491

Fix IntelliSense using c17 instead of GCC's default GNU C language standard. #14560

Fix enum member completion in a switch label before the trailing :. #14605

Fix extension crashes caused by events communicating with the language client before it is ready. PR #14617

Fix configuration path diagnostics for paths containing regular expression metacharacters and for incorrect source ranges. PR #14674, PR #14679

Prevent browse database crashes on filesystems that do not support SQLite WAL shared memory, and warn when no compatible database location is available. PR #14683

Fix runaway CPU and memory usage in workspaces with cyclic document symbol data or multiple symbolic links that point to ancestor directories, and prevent cpptools from remaining active after VS Code exits. #14689

Fix false IntelliSense errors for constrained hidden friend function templates that use requires expressions. #14696

Fix include completion and symbol navigation using stale recursive include data after files are replaced by directories or symbolic link roots change.

Fix unnecessary IntelliSense reparsing after unrelated settings changes and incorrect language updates after files.associations changes.

Fix 'Find All References' misclassifying references in inactive preprocessor regions after falling back to header-only IntelliSense.

Fix several language server crashes during startup, shutdown, diagnostic processing, and concurrent code model updates.

Fix various IntelliSense completion, navigation, false error, code analysis, formatting, and colorization issues.

Fix custom C/C++ files.associations entries with certain non-ASCII characters being ignored on Windows.

Fix a potential language server deadlock caused by inconsistent lock ordering.

Harden temporary file storage on Linux and macOS.

Various localization updates.

Update dependencies.

Updates ms-vscode.cmake-tools from 1.23.52 to 1.24.42

Release notes

Features:

Add support for the FASTBuild generator (CMake 4.2+). #4690

Add support for ${workspaceFolder}, ${workspaceFolder:name} variables and relative paths in cmake.exclude setting for multi-root workspaces. #4689

Add onConfigureResult event to the CMake Tools API that fires after every configure attempt (success or failure), allowing dependent extensions to detect and react to configure failures. #4021

Add cmake.preConfigureTask setting to execute a named VS Code task before every CMake configure. #2449 #4960 @erdemiru

Improvements:

Add ${testName} variable support for cmake.ctestArgs and cmake.ctestDefaultArgs, enabling per-test argument expansion (e.g., unique log file paths per test). #4416

Stop the CMake output channel from taking over the panel (hiding the terminal you're working in) during automatic configures (e.g. configure-on-open and automatic reconfigure) and programmatic builds or tests invoked through the CMake Tools API (e.g. by Copilot via the C/C++ DevTools companion). Failures are still always shown, explicit user-initiated builds/configures are unchanged, and cmake.revealLogOnAutomaticTrigger restores the old behavior. #4988

Add cmake.showTimestampsInOutput setting to display timestamps and log levels in the CMake output channel, useful for tracking build durations. #4057

When CMake is invoked prior to running tests, build targets required for the test rather than everything. #4515 @epistax

Allow building object library targets from the project outline. #4797

Add inline "Run" and "Debug" CodeLens buttons in source editors for tests discovered by CTest, allowing tests to be executed directly from their source locations. #4451

Improve responsiveness to CMake path changes made by vendor extensions during configure-on-open retry. #4908 Contributed by STMicroelectronics

Improve ergonomics of the test explorer UI by removing the project source directory, improving horizontal scrolling experience. #4562 @miss-programgamer

Pass mandatory compiler arguments from CMAKE_<LANG>_COMPILER to cpptools so it can properly determine system include paths and built-in preprocessor macro definitions. Requires CMake 4.3 or newer. #4627 @cwalther

Add support for a vsInstanceVersion vendor field in CMakePresets.json so Ninja configure presets can target a specific installed Visual Studio instance (by version) when bootstrapping the developer environment, instead of always using the latest. #4698

Use the CMake bundled with the Visual Studio instance selected by the vsInstanceVersion vendor field when resolving cmake.exe, instead of always falling back to the latest installed Visual Studio's CMake. Only applies on Windows for presets that pin an instance and when no explicit cmake.cmakePath or preset cmakeExecutable is set; otherwise CMake resolution is unchanged. #5052

Make the CMake Cache Editor ("Edit Cache (UI)") aware of cache variables defined by the active CMake configure preset: a new "Source" column shows where each variable comes from (project/user preset vs. the CMake cache) and whether it still matches the preset, and edits to preset-backed variables are now persisted as an override in CMakeUserPresets.json (and reconfigured with it) instead of being silently reverted by the preset on the next configure. #4884 @BilboBeutlin89

Load the bundled language-service data (command, variable, module, and policy descriptions) on first hover/completion instead of during activation, so activation no longer blocks on reading those assets. #5035

Replace the datalist/input control with a select control for enum-valued cache entries in the CMake Cache Editor, so allowed values are chosen from a proper dropdown instead of a free-text field. #4973

Bug Fixes:

Fix "Scan recursively for kits in specific directories" aborting with an unhandled EACCES/EPERM error (and adding no kits) when the chosen folder contains a subdirectory the current user cannot read (for example a root-only /opt/rh/.../root/root on a WSL/Linux host). Unreadable directories and un-stat-able entries are now skipped so the rest of the scan still completes. #5020

Fix the last compiler diagnostic of an IAR build being dropped from the Problems panel. The IAR output parser only emitted a diagnostic once a following line arrived, so the final one of each build (with no trailing line) was never flushed; parsers are now flushed when the build output ends. #5030

Fix a cmake build/configure task (a tasks.json entry with "type": "cmake") always operating on the first CMake project in a workspace folder that hosts several projects (for example multiple cmake.sourceDirectory entries) instead of the selected active folder. Such a task now honors the active project when it belongs to the task's workspace folder, and only falls back to the folder's project otherwise. #4512

Fix launch configurations that use ${cmake.testProgram} (and the related ${cmake.testArgs}, ${cmake.testWorkingDirectory} and ${cmake.testEnvironment} placeholders) failing with program '${cmake.testProgram}' does not exist when started from the Run and Debug view (F5) instead of the Test Explorer. Such a launch now prompts you to pick one of the discovered CTest tests and resolves the placeholders for it, so the same configuration works from both entry points. #4574

Fix disabled tests (for example GoogleTest DISABLED_ tests, which CTest reports as "Not Run (Disabled)") being shown in the Test Explorer as failed ("failed with completion status 'Disabled'") and dragging their group's status down. Such tests are intentionally not executed, so they are now reported as skipped and no longer taint the run result. #4267

Fix CMake syntax highlighting treating escaped $< sequences in quoted regex strings as generator expressions. #5028

Fix the Test Explorer reporting a test that crashed or timed out (for example one killed by a segmentation fault) as "failed with exit code 0". CTest records the cause in its Exit Code measurement (such as SEGFAULT or Timeout) while Exit Value stays 0, so the failure message now names that status instead of the misleading exit value. #5043

Fix the cmake version/capabilities probe, configure, build, and CMake script debugger intermittently failing (for example No version is set for shim: cmake) for users whose cmake comes from a directory-based version manager (mise, asdf, vfox, …). These CMake subprocesses now run in the project directory instead of inheriting the extension host's working directory, so the version-manager shim on PATH resolves the correct cmake for the project regardless of how the editor was launched. #5005 @danieleformichelli

Fix the auto-detected source directory notification showing a literal Change\u2026 on its button instead of Change... in packaged (Marketplace) builds. The label used a \u2026 JavaScript unicode escape, which vscode-nls-dev extracted verbatim into the localization bundle; it now uses plain .... #5003

Fix a test run that matched no tests being reported as success. When specific tests are requested (e.g. programmatically via the API/Copilot) but none match a discovered test — for example an agent passing a partial or non-existent test name — CTest exits 0 ("No tests were found!!!"), which callers could misread as "all tests passed". Such runs now return a failure with a clear message when tests exist but the requested ones weren't found. #4915

Stop showing "Adding a file without a valid code model" / "Deleting a file without a valid code model" warning notifications when a source file is automatically added or deleted and there is no valid CMake code model (for example when using clangd with the C/C++ IntelliSense engine disabled, or before the project has been configured). The automatic list-file update now stays silent in this case; the warning is only shown when the update is explicitly invoked via the "CMake: Add new source file" / "CMake: Remove deleted source file" commands. #5009

Fix running a single test from the inline Test CodeLens or the project outline building the default (or all) target instead of the test's own executable; single-test runs now build only that test's target.

Fix a single test's "Run" action in a multi-project workspace running all tests for that project instead of just the selected test, caused by test information from the most recently refreshed project overwriting the shared state used to compute the test filter. #4911

Fix test results showing a bare "The test case did not report any output." when a test did not actually run (for example when its executable was not built, so CTest reported it as "Not Run" or matched nothing). The test is now marked with an actionable message explaining that the executable may not have been built. CTest result parsing was also hardened so that compressed test output is decoded and a single test with missing or empty measurements no longer discards the results of the whole run. #4451

Fix test runs launched from the Test Explorer or the inline Test CodeLens appearing to run forever (the progress spinner never cleared) when a step in the run failed. The test run is now always finalized, even when building or running the tests throws, so the spinner stops and the failure is reported. Also, a single-test run no longer accidentally executes the entire suite when the full list of tests is not yet known. #4451

Fix a regression (since 1.23) where configure could appear to never finish — the progress indicator kept spinning and a second configure was rejected with "Configuration is already in progress" — after CMake had actually completed. Configure-time compiler version telemetry now reads the compiler id/version from the CMake File-API toolchains data instead of launching the compiler, so configure no longer depends on an extra compiler subprocess that could leave a descendant (e.g. mspdbsrv.exe/VCTIP.exe on Windows) holding its output pipes open. #4647

Fix CMake Tools not activating for projects whose CMakeLists.txt lives in a subdirectory (e.g. source/CMakeLists.txt) rather than the workspace root. Such projects now activate on open: a single nested CMakeLists.txt is detected and adopted automatically (with a notification to change the choice or opt out), and a picker is offered when there are multiple candidates. The new cmake.autoDetectSourceDirectory setting (default true) controls this behavior.

Fix switching the active editor to a file in a different root in a multi-root workspace clearing all C/C++ IntelliSense translation units (including for files still open in other panes). Changing the active project no longer tells cpptools that every file's configuration changed, so it no longer discards and rebuilds translation units for unrelated files. #4964

Fix the automatic "Select a Kit" prompt in a multi-root workspace being titled for, and applied to, the folder of the active editor instead of the folder whose configure-on-open actually triggered it. The kit is now selected for the correct project, so the intended folder gets configured and the prompt stops re-appearing on every window reload. #5011

Fix cmake.configureOnOpen performing a clean reconfigure (deleting CMakeCache.txt) instead of an incremental configure when using __unspec__ kit with CMake >= 3.15 and no explicit generator setting. #4956

Fix ${command:cmake.launchTargetPath} and related substitution commands (cmake.launchTargetDirectory, cmake.launchTargetFilename, cmake.launchTargetName, cmake.getLaunchTargetPath, etc.) showing an error instead of prompting kit or preset selection when none is active. These commands now behave consistently with the build/configure commands by displaying the quick pick dialog.

Fix intermittent Failed to parse cmake-tools-kits.json error caused by reading the kits file during a non-atomic write. readKitsFile now returns undefined when the file is empty or unparseable, and callers retain the previous kits in memory instead of clearing them. The file watcher will re-read once the write completes. #4833

Fix CMake: Compile Active File by unescaping compile_commands.json command strings into raw argv before spawning the compiler, so defines such as -DCMAKE_INTDIR=\"RelWithDebInfo\" are passed correctly. Originally surfaced on Ninja Multi-Config (Windows); also covers shell-escaped databases from bear, intercept-build, etc. #4935

Fix mirrored cursor in CMake control structure snippets. Completing a scoped command (e.g., function, if, foreach) no longer duplicates typed text into the end-statement. #4480

Fix CPack package preset inheritance so child variables maps now keep parent-defined -D values when the child adds its own package variables. #4924

Fix Windows presets auto-detection so Ninja configure presets without explicit compiler cache variables can still bootstrap the Visual Studio developer environment when appropriate.

Fix cmake-kits.json cmakeSettings rejecting boolean values. The JSON schema and the Kit.cmakeSettings TypeScript type now accept boolean (and number) again, so "BUILD_TESTING": true produces -DBUILD_TESTING:BOOL=TRUE and is shown as a checkbox in the CMake Cache Editor. #4927

Fix cmakeSettings (in cmake-kits.json) and cmake.configureSettings (workspace settings, including the settings block in CMake variants files) injecting \; into string values such as CMAKE_PREFIX_PATH. String values are now passed through verbatim so ; keeps its natural CMake list-separator semantics — matching how CMake Presets cacheVariables already behaves — completing the fix originally requested in #4503. #4934

Fix CMAKE_MAKE_PROGRAM and other cache variables using stale values when presets are edited without restarting VS Code. The onCodeModelChanged subscription is now established in startNewCMakeDriver so it applies to both initial creation and driver reloads. #4864

Fix Windows backslash handling in token splitting to preserve trailing backslashes before whitespace. This caused "Compile Active File" with MSVC + Ninja Multi-Config to merge adjacent flags (e.g., /Fd<dir>\ /FS) into a single malformed argument. #4902

Skip the automatic post-build CTest discovery when cmake.ctest.testExplorerIntegrationEnabled is false. #4909

Fix kit detection returning "unknown vendor" when using clang-cl compiler. #4638

Fix CMakeToolsApi.getProject() treating file URIs as source directories, which could log "sourceDirectory" is not a directory during normal API usage from dependent extensions. #4951

Fix CMake command-name completion no longer auto-triggering while typing, a regression since 1.23.51. A command word is tokenized as a string until () is added, and the completion provider relies on editor.quickSuggestions (which is off in strings by default), so suggestions stopped appearing. The extension now enables quick suggestions in strings for CMake files via configurationDefaults, restoring the previous behavior (overridable per user). #4959

Fix the Problems panel failing to open a file ("file was not found") for GCC C++ template errors. The GNU ld output parser no longer mis-captures a compiler file:line:column: required from here backtrace line as a diagnostic whose resource was file:line (with the source line appended to the path). #4954

Fix GNU LD diagnostic regex incorrectly matching CMake status lines (e.g., Zephyr build output) as linker errors in the Problems panel. #4910

Fix CTest discovery in the Test Explorer not applying environment variables from the selected test preset. #4313

Show the CMake Tools activity-bar view immediately with an "initializing" placeholder instead of hiding the entire sidebar until CMake, kit, preset, and Visual Studio developer-environment probing completes. On machines where those probes are intermittently slow (e.g. aggressive antivirus scanning of spawned processes, or extension-host file-handle exhaustion), the sidebar no longer disappears for minutes during activation. Project commands, menus, and status items remain gated on full readiness, so nothing runs against a partially-initialized project. #5027

Refresh the open CMake Cache Editor when configuration changes cache values externally. #3635

Avoid building the project multiple times when a single launch.json configuration uses several ${command:cmake.launchTargetPath}-style substitutions (e.g. cmake.launchTargetDirectory plus cmake.launchTargetPath). All such substitutions in one launch now share a single build; a later launch still rebuilds as needed. #5051

Preserve CMakeCache.txt on folder open with CMake Presets when the active configure preset specifies no generator, so cmake.configureOnOpen performs an incremental configure instead of deleting the cache and reconfiguring from scratch. #5049

Stop checking user kits for missing compilers on every activation, and no longer treat transient filesystem errors (such as file-handle exhaustion) as a missing compiler, which could prompt to remove valid kits. Stale kits are still detected during a kit/compiler scan. #5035

Avoid configuring a project twice during configure-on-open when a configure preset (or kit) has to be selected first. The selection no longer performs its own automatic reconfigure when the configure that requested the selection is about to run. #5050

Fix clicking "Run Test" (or build/launch) with an unsaved CMakeLists.txt failing with "Configuration is already in progress" and requiring a second click. The automatic reconfigure triggered by saving the file no longer races the command's own configure. #4794

Stop passing CMake configure diagnostic flags that CMake 4.4 deprecated (--no-warn-unused-cli, --warn-uninitialized, -Wdev/-Wno-dev, -Werror=dev/-Wno-error=dev), which caused a deprecation warning on every configure. On CMake 4.4 and newer these are emitted using the modern category-based spellings (-Wno-unused-cli, -Wuninitialized, -Wauthor/-Wno-author, -Werror=author/-Wno-error=author); older CMake versions continue to receive the legacy flags. #4999

Fix cmake.copyCompileCommands failing with "EISDIR: illegal operation on a directory" when set to a directory path, and emptying compile_commands.json when set to the source file itself. A directory destination now receives the file copied into it, and a destination that resolves to the source file is skipped. #4062

github-actions · 2026-09-13T07:38:59Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	24		0	0	0.42s
✅ ACTION	zizmor	24	0	0	0	5.68s
✅ DOCKERFILE	hadolint	3		0	0	0.31s
✅ JSON	npm-package-json-lint	yes		no	no	0.42s
✅ JSON	prettier	22	3	0	0	0.54s
✅ JSON	v8r	22		0	0	10.64s
✅ MARKDOWN	markdownlint	12	0	0	0	2.56s
✅ MARKDOWN	markdown-table-formatter	12	1	0	0	0.23s
✅ REPOSITORY	betterleaks	yes		no	no	2.77s
✅ REPOSITORY	checkov	yes		no	no	25.4s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
❌ REPOSITORY	grype	yes		2	1	101.27s
❌ REPOSITORY	osv-scanner	yes		7	no	1.24s
✅ REPOSITORY	secretlint	yes		no	no	1.84s
✅ REPOSITORY	syft	yes		no	no	2.69s
❌ REPOSITORY	trivy	yes		2	1	15.18s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.26s
✅ REPOSITORY	trufflehog	yes		no	no	3.5s
⚠️ SPELL	lychee	86		2	0	10.22s
✅ YAML	prettier	32	0	0	0	0.85s
✅ YAML	v8r	32		0	0	11.04s
✅ YAML	yamllint	32		0	0	1.26s

Detailed Issues

❌ REPOSITORY / grype - 2 errors

error: A high vulnerability in python package: urllib3, version 2.7.0 was found at: /.devcontainer/cpp/requirements.txt

error: A high vulnerability in python package: urllib3, version 2.7.0 was found at: /.devcontainer/cpp/requirements.txt

warning: A medium vulnerability in python package: urllib3, version 2.7.0 was found at: /.devcontainer/cpp/requirements.txt

warning: 1 warnings emitted
error: 2 errors emitted

❌ REPOSITORY / osv-scanner - 7 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 73 packages
Scanned .devcontainer/cpp/requirements.txt file and found 20 packages
Scanned test/rust/workspace/clippy/Cargo.lock file and found 1 package
Scanned test/rust/workspace/cortex-mf/Cargo.lock file and found 30 packages
Scanned test/rust/workspace/cargo/Cargo.lock file and found 1 package
Scanned test/rust/workspace/test/Cargo.lock file and found 1 package
Scanned test/rust/workspace/cortex-m/Cargo.lock file and found 30 packages
End status: 61 dirs visited, 220 inodes visited, 7 Extract calls, 16.003662ms elapsed, 16.003814ms wall time
Loaded filter from: test/rust/workspace/cortex-m/osv-scanner.toml
Loaded filter from: test/rust/workspace/cortex-mf/osv-scanner.toml
RUSTSEC-2026-0110 has been filtered out because: bare-metal is deprecated/unmaintained upstream with no fixed version; pulled in transitively by cortex-m in this test fixture crate
RUSTSEC-2026-0110 has been filtered out because: bare-metal is deprecated/unmaintained upstream with no fixed version; pulled in transitively by cortex-m in this test fixture crate
Filtered 2 vulnerabilities from output

Total 3 packages affected by 7 known vulnerabilities (0 Critical, 5 High, 2 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
6 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------------------+---------+---------------+------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE                             |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+------------------------------------+
| https://osv.dev/PYSEC-2026-4175     | 7.6  | PyPI      | urllib3               | 2.7.0   | 2.8.0         | .devcontainer/cpp/requirements.txt |
| https://osv.dev/GHSA-8988-9cw3-xx77 |      |           |                       |         |               |                                    |
| https://osv.dev/PYSEC-2026-4176     | 6.9  | PyPI      | urllib3               | 2.7.0   | 2.8.0         | .devcontainer/cpp/requirements.txt |
| https://osv.dev/GHSA-gh4c-6fx4-qh6g |      |           |                       |         |               |                                    |
| https://osv.dev/PYSEC-2026-4177     | 8.9  | PyPI      | urllib3               | 2.7.0   | 2.8.0         | .devcontainer/cpp/requirements.txt |
| https://osv.dev/GHSA-vxq7-64xx-v4gw |      |           |                       |         |               |                                    |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.10        | package-lock.json                  |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.12        | package-lock.json                  |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev) | 5.0.9   | 5.0.11        | package-lock.json                  |
| https://osv.dev/GHSA-vfj7-8cjw-p6xm | 8.7  | npm       | braces (dev)          | 3.0.3   | --            | package-lock.json                  |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+------------------------------------+

❌ REPOSITORY / trivy - 2 errors

error: Package: urllib3
Installed Version: 2.7.0
Vulnerability CVE-2026-97687
Severity: HIGH
Fixed Version: 2.8.0
Link: [CVE-2026-97687](https://avd.aquasec.com/nvd/cve-2026-97687)
    ┌─ .devcontainer/cpp/requirements.txt:518:1
    │
518 │ urllib3==2.7.0 \
    │ ^
    │
    = urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
    = urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.

error: Package: urllib3
Installed Version: 2.7.0
Vulnerability CVE-2026-97689
Severity: HIGH
Fixed Version: 2.8.0
Link: [CVE-2026-97689](https://avd.aquasec.com/nvd/cve-2026-97689)
    ┌─ .devcontainer/cpp/requirements.txt:518:1
    │
518 │ urllib3==2.7.0 \
    │ ^
    │
    = urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser
    = urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.

warning: Package: urllib3
Installed Version: 2.7.0
Vulnerability CVE-2026-97688
Severity: MEDIUM
Fixed Version: 2.8.0
Link: [CVE-2026-97688](https://avd.aquasec.com/nvd/cve-2026-97688)
    ┌─ .devcontainer/cpp/requirements.txt:518:1
    │
518 │ urllib3==2.7.0 \
    │ ^
    │
    = urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding
    = urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.

warning: 1 warnings emitted
error: 2 errors emitted

⚠️ SPELL / lychee - 2 errors

📝 Summary
---------------------
🔍 Total..........133
🔗 Unique.........112
✅ Successful.....126
⏳ Timeouts.........0
🔀 Redirected......13
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........2
⛔ Unsupported......2

Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 30:7) | Rejected status code: 403 Forbidden

Errors in README.md
[ERROR] https://securityscorecards.dev/viewer/?uri=github.com/embedded-pro/embedded-devcontainer (at 6:603) | Network error: Connection reset by peer (os error 104)

Hint: Followed 13 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

oxsecurity/megalinter/flavors/salesforce@v10.0.0 (57 linters)
oxsecurity/megalinter/flavors/javascript@v10.0.0 (62 linters)

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

github-actions · 2026-09-20T08:08:41Z

📦 Container Size Analysis

Note

Comparing docker.io/gabrielfrasantos/embedded-devcontainer-base:edge ➔ docker.io/gabrielfrasantos/embedded-devcontainer-base:pr-123

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	0 B	1.03 GB	+1.03 GB (+∞)	🔼
linux/arm64	0 B	1.03 GB	+1.03 GB (+∞)	🔼

…nt-vscode in devcontainer-metadata.json

github-actions · 2026-10-04T08:54:42Z

📦 Container Size Analysis

Note

Comparing docker.io/gabrielfrasantos/embedded-devcontainer-rust:edge ➔ docker.io/gabrielfrasantos/embedded-devcontainer-rust:pr-123

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	0 B	1.46 GB	+1.46 GB (+∞)	🔼
linux/arm64	0 B	1.39 GB	+1.39 GB (+∞)	🔼

github-actions · 2026-10-04T08:56:51Z

📦 Container Size Analysis

Note

Comparing docker.io/gabrielfrasantos/embedded-devcontainer-cpp:edge ➔ docker.io/gabrielfrasantos/embedded-devcontainer-cpp:pr-123

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	732.36 MB	1.54 GB	+803.48 MB (+109.71%)	🔼
linux/arm64	0 B	1.51 GB	+1.51 GB (+∞)	🔼

embedded-releaser-app Bot added dependencies Pull requests that update a dependency file vscode-extensions labels Sep 13, 2026

embedded-releaser-app Bot force-pushed the feature/embedded-devcontainer-cpp/update-vscode-extensions-devcontainer-metadata.json branch from 642bfd2 to a674aa3 Compare September 20, 2026 07:52

embedded-releaser-app Bot changed the title ~~chore(deps, cpp): update ms-vscode.cmake-tools, ms-vscode.cpptools in devcontainer-metadata.json~~ chore(deps, cpp): update ms-vscode.cmake-tools, ms-vscode.cpptools, sonarsource.sonarlint-vscode in devcontainer-metadata.json Sep 20, 2026

Update ms-vscode.cmake-tools, ms-vscode.cpptools, sonarsource.sonarli…

749dff5

…nt-vscode in devcontainer-metadata.json

embedded-releaser-app Bot force-pushed the feature/embedded-devcontainer-cpp/update-vscode-extensions-devcontainer-metadata.json branch from a674aa3 to 749dff5 Compare October 4, 2026 08:38

Navigation Menu

Repository navigation

chore(deps, cpp): update ms-vscode.cmake-tools, ms-vscode.cpptools, sonarsource.sonarlint-vscode in devcontainer-metadata.json - #123

chore(deps, cpp): update ms-vscode.cmake-tools, ms-vscode.cpptools, sonarsource.sonarlint-vscode in devcontainer-metadata.json#123
embedded-releaser-app[bot] wants to merge 1 commit into
mainfrom
feature/embedded-devcontainer-cpp/update-vscode-extensions-devcontainer-metadata.json

embedded-releaser-app Bot commented Sep 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 20, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

embedded-releaser-app Bot commented Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Instructions

Requirements

Changes

Enhancements

Bug Fixes

Uh oh!

github-actions Bot commented Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

github-actions Bot commented Sep 20, 2026

📦 Container Size Analysis

📈 Size Comparison Table

Uh oh!

github-actions Bot commented Oct 4, 2026

📦 Container Size Analysis

📈 Size Comparison Table

Uh oh!

github-actions Bot commented Oct 4, 2026

📦 Container Size Analysis

📈 Size Comparison Table

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

embedded-releaser-app Bot commented Sep 13, 2026 •

edited

Loading

github-actions Bot commented Sep 13, 2026 •

edited

Loading