[universal] - Removing obsolete NVS (GHSA-r4q5-vmmm-2653) and patching pip for Python 3.13.8 (GHSA-jp4c-xjxw-mgf9)

cgmanifest.json

@@ -1510,16 +1510,6 @@
                 }
             }
         },
-        {
-            "Component": {
-                "Type": "git",
-                "Git": {
-                    "Name": "nvs",
-                    "repositoryUrl": "https://github.com/jasongin/nvs",
-                    "commitHash": "6b20e9f750ea371bd347e5dbac8406d677292b60"
-                }
-            }
-        },
         {
             "Component": {
                 "Type": "other",

src/universal/.devcontainer/devcontainer.json

@@ -21,7 +21,6 @@
             "version": "24",
             "additionalVersions": "22"
         },
-        "./local-features/nvs": "latest",
         "ghcr.io/devcontainers/features/python:1": {
             "version": "3.14.2",
             "additionalVersions": "3.13.8",
@@ -84,7 +83,6 @@
         "ghcr.io/devcontainers/features/dotnet",
         "ghcr.io/devcontainers/features/hugo",
         "ghcr.io/devcontainers/features/node",
-        "./local-features/nvs",
         "ghcr.io/devcontainers/features/conda",
         "./local-features/patch-conda",
         "ghcr.io/devcontainers/features/python",

src/universal/.devcontainer/local-features/patch-python/install.sh

@@ -5,6 +5,7 @@
 #-------------------------------------------------------------------------------------------------------------
 
 USERNAME=${USERNAME:-"codespace"}
+PATCH_PYTHON_PIP_UPGRADE_PATH=${PATCH_PYTHON_PIP_UPGRADE_PATH:-"/usr/local/python/3.13.8/bin/python"}
 
 set -eux
 
@@ -38,3 +39,9 @@ update_package() {
     sudo_if "$PYTHON_PATH -m pip install --upgrade --no-cache-dir $PACKAGE==$VERSION"
     sudo_if "$PYTHON_PATH -m pip show --no-python-version-warning $PACKAGE"
 }
+
+# Updating pip version for python 3.13.8. Must be removed when pinned version 3.13.8 is updated to a different python version.
+# https://github.com/advisories/GHSA-jp4c-xjxw-mgf9
+if [ -x "$PATCH_PYTHON_PIP_UPGRADE_PATH" ]; then
+    sudo_if "$PATCH_PYTHON_PIP_UPGRADE_PATH -m pip install --upgrade pip"
+fi

src/universal/.devcontainer/local-features/setup-user/devcontainer-feature.json

@@ -15,7 +15,6 @@
         "ORYX_ENV_TYPE": "vsonline-present",
         "PYTHONIOENCODING": "UTF-8",
         "NPM_GLOBAL": "/home/codespace/.npm-global",
-        "NVS_HOME": "/home/codespace/.nvs",
         "RVM_PATH": "/usr/local/rvm",
         "RAILS_DEVELOPMENT_HOSTS": ".githubpreview.dev,.preview.app.github.dev,.app.github.dev",
         "GOROOT": "/usr/local/go",

src/universal/README.md

@@ -27,9 +27,9 @@ The container includes the `zsh` (and Oh My Zsh!) and `fish` shells that you can
 You can decide how often you want updates by referencing a [semantic version](https://semver.org/) of each image.
 For example:
 
-- `mcr.microsoft.com/devcontainers/universal:6-noble`
-- `mcr.microsoft.com/devcontainers/universal:6.0-noble`
-- `mcr.microsoft.com/devcontainers/universal:6.0.8-noble`
+- `mcr.microsoft.com/devcontainers/universal:7-noble`
+- `mcr.microsoft.com/devcontainers/universal:7.0-noble`
+- `mcr.microsoft.com/devcontainers/universal:7.0.0-noble`
 
 See [history](history) for information on the contents of each version and [here for a complete list of available tags](https://mcr.microsoft.com/v2/devcontainers/universal/tags/list).
 

src/universal/manifest.json

@@ -1,5 +1,5 @@
 {
-	"version": "6.0.8",
+	"version": "7.0.0",
 	"build": {
 		"latest": true,
 		"rootDistro": "debian",
@@ -87,7 +87,6 @@
 		"git": {
 			"Oh My Zsh!": "/home/codespace/.oh-my-zsh",
 			"nvm": "/usr/local/share/nvm",
-			"nvs": "/usr/local/nvs",
 			"rbenv": "/usr/local/share/rbenv",
 			"ruby-build": "/usr/local/share/ruby-build"
 		},

src/universal/test-project/test-utils.sh

@@ -229,6 +229,19 @@ checkPythonPackageVersion()
     check-version-ge "${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
 }
 
+checkPythonPipVersion()
+{
+    PYTHON_PATH=$1
+    REQUIRED_VERSION=$2
+
+    if [ ! -x "${PYTHON_PATH}" ]; then
+        return 0
+    fi
+
+    current_version=$(${PYTHON_PATH} -m pip --version | awk '{print $2}')
+    [ "$(printf '%s\n%s\n' "${REQUIRED_VERSION}" "${current_version}" | sort -V | tail -1)" = "${current_version}" ]
+}
+
 checkCondaPackageVersion()
 {
     PACKAGE=$1

src/universal/test-project/test.sh

@@ -82,7 +82,6 @@ checkDirectoryOwnership "codespace user has ownership over extension directory"
 # Node.js
 check "node" node --version
 check "nvm" bash -c ". /usr/local/share/nvm/nvm.sh && nvm --version"
-check "nvs" bash -c ". /usr/local/nvs/nvs.sh && nvs --version"
 check "yarn" yarn --version
 check "npm" npm --version
 count=$(ls /usr/local/share/nvm/versions/node | wc -l)
@@ -136,9 +135,10 @@ check "default-node-version" bash -c "node --version | grep 24."
 check "default-node-location" bash -c "which node | grep /home/codespace/nvm/current/bin"
 check "oryx-build-node-project" bash -c "oryx build ./sample/node"
 check "oryx-configured-current-node-version" bash -c "ls -la /home/codespace/nvm/current | grep /opt/nodejs"
-check "nvm-install-node" bash -c ". /usr/local/share/nvm/nvm.sh && nvm install 8.0.0"
-check "nvm-works-in-node-project" bash -c "node --version | grep v8.0.0"
-check "default-node-location-remained-same" bash -c "which node | grep /home/codespace/nvm/current/bin"
+check "nvm-switches-to-additional-node-version" bash -c ". /usr/local/share/nvm/nvm.sh && nvm use 22 && node --version | grep v22."
+check "node-location-after-switching-to-22" bash -c "which node | grep /home/codespace/nvm/current/bin"
+check "nvm-switches-back-to-default-node-version" bash -c ". /usr/local/share/nvm/nvm.sh && nvm use default && node --version | grep v24."
+check "node-location-after-switching-back-to-default" bash -c "which node | grep /home/codespace/nvm/current/bin"
 
 # Ensures sdkman works in a Java Project
 check "default-java-version" bash -c "java --version"
@@ -170,6 +170,7 @@ check "php-version-on-path-is-8.1.30" php --version | grep 8.1.30
 # Test patches
 
 ls -la /home/codespace
+check "python-3.13.8-pip-version" checkPythonPipVersion "/usr/local/python/3.13.8/bin/python" "26.1.0"
 
 ## Python - current
 checkPythonPackageVersion "python" "requests" "2.31.0"