[universal] - Removing obsolete NVS (GHSA-r4q5-vmmm-2653) and patching pip for Python 3.13.8 (GHSA-jp4c-xjxw-mgf9)#1928
Open
Kaniska244 wants to merge 9 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR removes the obsolete NVS (Node Version Switcher) devcontainer feature from the Universal image to mitigate the follow-redirects vulnerability advisory GHSA-r4q5-vmmm-2653, and updates versioning/docs/tests accordingly.
Changes:
- Remove the local
nvsfeature from the Universal devcontainer configuration and related environment variables. - Update the Universal image manifest and README to version
6.0.9. - Adjust Universal smoke tests to stop validating
nvsand to validatenvmswitching behavior instead.
Show a summary per file
| File | Description |
|---|---|
| src/universal/test-project/test.sh | Removes nvs validation and updates nvm switching checks. |
| src/universal/README.md | Updates the example semantic-version tag to 6.0.9-noble. |
| src/universal/manifest.json | Bumps version to 6.0.9 and removes nvs from listed git-installed components. |
| src/universal/.devcontainer/local-features/setup-user/devcontainer-feature.json | Removes the NVS_HOME container environment variable. |
| src/universal/.devcontainer/local-features/nvs/install.sh | Deletes the NVS feature install script. |
| src/universal/.devcontainer/local-features/nvs/devcontainer-feature.json | Deletes the NVS feature definition. |
| src/universal/.devcontainer/devcontainer.json | Removes ./local-features/nvs from features and install order. |
Review details
- Files reviewed: 7/7 changed files
- Comments generated: 2
- Review effort level: Low
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Kaniska244
changed the title
follow-redirects vulnerability issue GHSA-r4q5-vmmm-2653GHSA-r4q5-vmmm-2653) and patching pip for Python 3.13.8 (GHSA-jp4c-xjxw-mgf9)
abdurriq
reviewed
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR removes the obsolete NVS (Node Version Switcher) local feature from the
universalimage to mitigate thefollow-redirectsvulnerabilityGHSA-r4q5-vmmm-2653. It also patches thepipversion bundled with the pinned Python3.13.8(and cleans vulnerable cached pip packages under Conda) to addressGHSA-jp4c-xjxw-mgf9.NVS is no longer required in the
universalimage — Node.js version management is already fully handled bynvm(Node Version Manager), which remains installed and configured. Removing NVS eliminates the transitive dependency on the vulnerablefollow-redirectspackage.Motivation
jasongin/nvs) pulls in thefollow-redirectspackage, which is affected byGHSA-r4q5-vmmm-2653.pipversion shipped with pinned Python3.13.8, as well as cached pip packages under/opt/conda/pkgs, are affected byGHSA-jp4c-xjxw-mgf9(pip < 26.1) and need to be upgraded/removed.nvm, which is already present and is the primary Node version manager in this image.Changes
NVS removal
cgmanifest.jsonnvscomponent registration (jasongin/nvs) from the component governance manifest.src/universal/.devcontainer/devcontainer.json./local-features/nvsfeature reference and its entry from the overrides list.src/universal/.devcontainer/local-features/nvs/devcontainer-feature.jsonsrc/universal/.devcontainer/local-features/nvs/install.shjasongin/nvsand pulled in the vulnerable dependency).src/universal/.devcontainer/local-features/setup-user/devcontainer-feature.jsonNVS_HOMEenvironment variable.src/universal/manifest.json6.0.8→6.1.0; removed thenvsentry from the git tools map.src/universal/README.md6.1/6.1.0.pip security patch (
GHSA-jp4c-xjxw-mgf9)src/universal/.devcontainer/local-features/patch-python/install.shpipupgrade for the pinned Python3.13.8, gated onPATCH_PYTHON_PIP_UPGRADE_PATH(defaults to/usr/local/python/3.13.8/bin/python). Includes a note to remove this once3.13.8is bumped.src/universal/.devcontainer/local-features/patch-conda/install.sh/opt/conda/pkgsolder than26.1(vulnerable), after upgrading the activepip.Tests
src/universal/test-project/test-utils.shcheckPythonPipVersionhelper to assert the installedpipversion meets a minimum requirement, and acheckNoVulnerablePipCachehelper to assert no cached pip package under a directory is below a minimum version.src/universal/test-project/test.shnvsversion check; replaced the oldnvm install 8.0.0test with checks that switch between the default (24) and additional (22) Node versions usingnvm; added apipversion check (>= 26.1.0) for Python3.13.8and a check that/opt/conda/pkgscontains no vulnerable pip cache (>= 26.1).Testing
nvs --version) and verifiednvmcan switch to an additional pre-installed Node version (22) and back to the default (24), confirming version management still works without NVS.checkPythonPipVersion/checkNoVulnerablePipCacheand tests asserting the3.13.8pipversion is>= 26.1.0and that no vulnerable pip cache remains in/opt/conda/pkgs.Impact / Notes
6.0.8to6.1.0.nvscommand or theNVS_HOMEenvironment variable in theuniversalimage should migrate tonvm.patch-python/install.shis a temporary workaround and should be removed once the pinned Python3.13.8is updated to a newer version.