Merge branch 'main' into main

Author: RaMaTHA

.eslintignore

@@ -17,21 +17,15 @@ updates:
         patterns:
           - "*"
     ignore:
-      - dependency-name: "@stylistic/eslint-plugin"
-        update-types: ["version-update:semver-major"] # stylistic 3 to avoid esm
       - dependency-name: "@types/chai"
         update-types: ["version-update:semver-major"] # chai 4 to avoid esm
       - dependency-name: "@types/node"
-        update-types: ["version-update:semver-major"] # Keep Node 18 compatibility
-      - dependency-name: "@types/tar"
-        update-types: ["version-update:semver-major"] # tar 6 for source compatibility
+        update-types: ["version-update:semver-major"] # Keep Node 20 compatibility
       - dependency-name: "chai"
         update-types: ["version-update:semver-major"] # chai 4 to avoid esm
-      - dependency-name: "eslint"
-        update-types: ["version-update:semver-major"] # eslint 8 for `--rulesdir`
-      - dependency-name: "rimraf"
-        update-types: ["version-update:semver-major"] # rimraf 5 for Node 18 compatibility
-      - dependency-name: "tar"
-        update-types: ["version-update:semver-major"] # tar 6 for source compatibility
+      - dependency-name: "yargs"
+        update-types: ["version-update:semver-major"] # yargs 17 for esbuild CJS bundling
+      - dependency-name: "node-pty"
+        update-types: ["version-update:semver-minor"] # node-pty 1.1 has broken spawn-helper permissions (microsoft/node-pty#866)
     schedule:
       interval: "weekly"

.eslintrc.js

@@ -8,6 +8,10 @@ on:
     branches:
       - '**'
 
+permissions:
+  contents: read
+  packages: read
+
 jobs:
   cli:
     name: CLI
@@ -16,7 +20,7 @@ jobs:
     - uses: actions/checkout@v6
     - uses: actions/setup-node@v5
       with:
-        node-version: '18.x'
+        node-version: '20.x'
         registry-url: 'https://npm.pkg.github.com'
         scope: '@microsoft'
     - name: Install Dependencies
@@ -33,7 +37,7 @@ jobs:
         echo "TGZ=devcontainers-cli-${VERSION}.tgz" | tee -a $GITHUB_ENV
         echo "TGZ_UPLOAD=devcontainers-cli-${VERSION}-${GITHUB_SHA:0:8}.tgz" | tee -a $GITHUB_ENV
     - name: Store TGZ
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ env.TGZ_UPLOAD }}
         path: ${{ env.TGZ }}
@@ -66,9 +70,23 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v5
       with:
-        node-version: '18.x'
+        node-version: '20.x'
         registry-url: 'https://npm.pkg.github.com'
         scope: '@microsoft'
+    - name: Disable containerd image store
+      run: |
+        # Workaround for https://github.com/moby/moby/issues/52050
+        DAEMON_JSON="/etc/docker/daemon.json"
+        if [ -f "$DAEMON_JSON" ]; then
+          sudo jq '. + {"features": {"containerd-snapshotter": false}}' "$DAEMON_JSON" \
+            | sudo tee "${DAEMON_JSON}.tmp" > /dev/null
+          sudo mv "${DAEMON_JSON}.tmp" "$DAEMON_JSON"
+        else
+          echo '{"features": {"containerd-snapshotter": false}}' \
+            | sudo tee "$DAEMON_JSON" > /dev/null
+        fi
+        cat "$DAEMON_JSON"
+        sudo systemctl restart docker
     - name: Tools Info
       run: |
         docker info
@@ -99,7 +117,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v5
       with:
-        node-version: '18.x'
+        node-version: '20.x'
         registry-url: 'https://npm.pkg.github.com'
         scope: '@microsoft'
     - name: Install Dependencies
@@ -120,9 +138,21 @@ jobs:
         FEATURES_TEST__AZURE_REGISTRY_SCOPED_CREDENTIAL: ${{ secrets.FEATURES_TEST__AZURE_REGISTRY_SCOPED_CREDENTIAL }}
 
 
+  install-script:
+    name: Install Script
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v6
+    - name: Run install.sh tests
+      run: sh scripts/install.test.sh
+
   tests:
     name: Tests
-    needs: [tests-matrix, features-registry-compatibility]
+    needs: [tests-matrix, features-registry-compatibility, install-script]
     runs-on: ubuntu-latest
     steps:
     - name: Done

.github/dependabot.yml

@@ -5,6 +5,10 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   main:
     runs-on: ubuntu-latest
@@ -14,7 +18,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v5
       with:
-        node-version: '18.x'
+        node-version: '20.x'
         registry-url: 'https://registry.npmjs.org'
         scope: '@devcontainers'
     - name: Verify Versions

.github/workflows/dev-containers.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ['main']
 
+permissions:
+  contents: read
+
 jobs:
   test-docker-v20:
     name: Docker v20.10 Compatibility
@@ -16,7 +19,7 @@ jobs:
 
     - uses: actions/setup-node@v5
       with:
-        node-version: '18.x'
+        node-version: '20.x'
 
     - name: Install Docker v20.10
       run: |
@@ -33,7 +36,14 @@ jobs:
           "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
           $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
         sudo apt-get update
-        sudo apt-get install -y docker-ce=5:20.10.* docker-ce-cli=5:20.10.* containerd.io
+        # Pin buildx < 0.31.0 to avoid API version 1.52 incompatibility with Docker 20.10 (max API 1.41)
+        # See https://github.com/docker/buildx/issues/3654
+        BUILDX_VERSION=$(apt-cache madison docker-buildx-plugin | awk '{print $3}' | grep -v '^0\.3[1-9]\.' | head -1)
+        echo "Installing docker-buildx-plugin=$BUILDX_VERSION"
+        # Pin compose plugin to v2.x to avoid API incompatibility with Docker 20.10
+        COMPOSE_VERSION=$(apt-cache madison docker-compose-plugin | awk '{print $3}' | grep '^2\.' | head -1)
+        echo "Installing docker-compose-plugin=$COMPOSE_VERSION"
+        sudo apt-get install -y docker-ce=5:20.10.* docker-ce-cli=5:20.10.* containerd.io docker-buildx-plugin="$BUILDX_VERSION" docker-compose-plugin="$COMPOSE_VERSION"
         sudo systemctl restart docker
     
     - name: Verify Docker version, Install and Test

.github/workflows/publish-dev-containers.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ['main']
 
+permissions:
+  contents: read
+
 jobs:
   test-docker-v29:
     name: Docker v29.0.0 Compatibility
@@ -16,7 +19,7 @@ jobs:
 
     - uses: actions/setup-node@v5
       with:
-        node-version: '18.x'
+        node-version: '20.x'
 
     - name: Install Docker v29.0.0
       run: |

.github/workflows/test-docker-v20.yml

@@ -3,6 +3,10 @@ on:
   issues:
     types: [edited]
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   main:
     runs-on: ubuntu-latest

.github/workflows/test-docker-v29.yml

@@ -11,6 +11,10 @@ on:
   pull_request:
     branches:
       - '**'
+
+permissions:
+  contents: read
+
 jobs:
  tests-matrix:
     name: Tests Matrix (Windows)
@@ -50,7 +54,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v5
       with:
-        node-version: '18.x'
+        node-version: '20.x'
         registry-url: 'https://npm.pkg.github.com'
         scope: '@microsoft'
     - name: Install Dependencies

.github/workflows/test-plan-item-validator.yml

@@ -2,6 +2,30 @@
 
 Notable changes.
 
+## March 2026
+
+### [0.84.1]
+- Bump tar from 7.5.10 to 7.5.11 due to [CVE-2026-31802](https://github.com/advisories/GHSA-9ppj-qmqm-q256). (https://github.com/devcontainers/cli/pull/1174)
+
+### [0.84.0]
+- Dependencies update. (https://github.com/devcontainers/cli/pull/1167)
+
+## February 2026
+
+### [0.83.3]
+- Bump tar from 7.5.7 to 7.5.8. (https://github.com/devcontainers/cli/pull/1160)
+
+### [0.83.2]
+- Improved logging for image inspect errors. (https://github.com/devcontainers/cli/pull/1152)
+
+### [0.83.1]
+- Bump tar from 7.5.6 to 7.5.7. (https://github.com/devcontainers/cli/pull/1140)
+
+### [0.83.0]
+- Add install script. (https://github.com/devcontainers/cli/pull/1142)
+- Remove request body limit. (https://github.com/devcontainers/cli/pull/1141)
+- Add BUILDKIT_INLINE_CACHE for container Feature path. (https://github.com/devcontainers/cli/pull/1135)
+
 ## January 2026
 
 ### [0.82.0]