feat(deps): consolidate 16 open dependency pull requests, install gh, disable debuginfod

[gabrielfrasantos]

🚀 Hey, I have created a Pull Request

Description of changes

Two things:

1. Consolidates 16 open dependency pull requests into a single branch so they can be reviewed and merged together instead of one at a time.
2. Resolves #104 and a hadolint finding.

Closes #104.

---

Part 1 — dependency consolidation

Each source PR is brought in as a merge commit, so original authorship and commit messages are preserved.

Included

PR	Change
#118	cpp: sonarsource.sonarlint-vscode in devcontainer-metadata.json
#117	base: gnupg2 2.4.8-4ubuntu3 → 2.4.8-4ubuntu3.1
#116	oxsecurity/megalinter/flavors/dotnet 9.5.0 → 10.0.0
#115	actions/stale 10.3.0 → 11.0.0
#114	actions/cache 5.0.5 → 6.1.0
#113	actions/setup-node 6.4.0 → 7.0.0
#112	github-actions group, 11 updates across 22 workflows
#111	conan 2.30.0 → 2.31.2
#110	cmake 4.3.4 → 4.4.2
#109	@types/node 25.6.0 → 26.3.0
#108	@playwright/test 1.61.1 → 1.62.1
#107	devcontainers/features/desktop-lite 1.2.9 → 1.2.10
#106	devcontainers/features/github-cli 1.1.0 → 1.1.2
#100	rust: extensions in devcontainer.json
#99	cpp: extensions in devcontainer.json
#98	rust: rust-lang.rust-analyzer in devcontainer-metadata.json

Not included

• chore(main): release 7.4.0 #102 (chore(main): release 7.3.1) — release-please regenerates this PR from the commit history. Folding it into a feature branch would produce a stale changelog and version bump, so it is intentionally left alone and should be handled by release-please after this merges.

Conflicts resolved

Four pairs of PRs touched the same lines. In every case both bumps were kept:

• .devcontainer/cpp/devcontainer.json (feat: bump ghcr.io/devcontainers/features/github-cli from 1.1.0 to 1.1.2 #106 / feat: bump ghcr.io/devcontainers/features/desktop-lite from 1.2.9 to 1.2.10 #107) → desktop-lite 1.2.10 + github-cli 1.1.2. devcontainer-lock.json auto-merged with both matching digests.
• .devcontainer/cpp/requirements.in (feat: bump cmake from 4.4.2 to 4.4.3 in /.devcontainer #110 / feat: bump conan from 2.31.2 to 2.32.0 in /.devcontainer #111) → cmake==4.4.2 + conan==2.31.2. requirements.txt auto-merged to exactly these two pins.
• package.json / package-lock.json (test(deps): bump @playwright/test from 1.61.1 to 1.62.1 in the npm group #108 / test(deps): bump @types/node from 26.3.0 to 26.4.0 #109) → @playwright/test ^1.62.1 + @types/node ^26.3.0. Declared ranges and resolved lock versions verified consistent.
• Workflow action pins (ci(deps): bump the github-actions group with 11 updates #112 vs ci(deps): bump actions/setup-node from 6.4.0 to 7.0.0 #113–ci(deps): bump oxsecurity/megalinter/flavors/dotnet from 9.5.0 to 10.0.0 #116) merged cleanly; the individual major bumps sit on top of the group PR's minor/patch bumps.

Why these PRs were red

Two independent causes, neither of which is a defect in the PRs themselves:

1. 🧹 Lint & Format — every PR. MegaLinter's v8r step failed with:

   .github/workflows/wc-publish-templates.yml#/on/workflow_call must be object
   .github/workflows/wc-publish-templates.yml#/on must match exactly one schema in oneOf
   

   v8r fetches the GitHub workflow schema live from SchemaStore. That schema briefly stopped accepting a valueless workflow_call:, which is why every PR opened after Sep 1 failed identically while main (same file, unchanged) had passed on Aug 31. The current published schema accepts it again — workflow_call is now oneOf: [{"type": "null"}, {"type": "object", ...}] — so no source change is needed and none was made here.

2. Build jobs — dependabot PRs only. The docker.io login step fails with unknown: malformed HTTP Authorization header because username: dependabot[bot] and the registry password resolves empty: PRs raised by Dependabot do not receive regular repository secrets. This branch is not a Dependabot branch, so those jobs get real credentials here.

---

Part 2 — issue #104 and hadolint

gh CLI in the base image

Added "gh": "2.46.0-4" to .devcontainer/base/apt-requirements.json. Both cpp and rust build FROM ${BASE_IMAGE}, so every flavor inherits it. Universe is already relied upon by this list (gnuplot-qt, qt6-base-dev), and 2.46.0-4 is the version in Ubuntu 26.04 universe on both amd64 and arm64. The update-apt-packages workflow will advance the pin as Ubuntu refreshes it; a jq round-trip of the edited file is byte-identical, so that automation will not reformat it.

Note

#104 proposed adding the official GitHub CLI apt repository instead, on the grounds that the Ubuntu package is stale — and it is: Ubuntu 26.04 still ships exactly 2.46.0-4, the same version the issue names, against roughly 2.97 upstream. Installing from the Ubuntu archive was chosen deliberately to keep the base image free of third-party apt sources and consistent with the existing version-pinning scheme. Worth revisiting if a current gh matters more than that.

Note

cpp/devcontainer.json also pulls in the ghcr.io/devcontainers/features/github-cli feature, which installs a newer gh when the devcontainer is built. That feature is now partly redundant, though it still gives cpp devcontainer users a more current binary than the image ships. Left in place.

DEBUGINFOD_URLS

Set to an empty string via containerEnv, so GDB 17.1+ does not stall reaching debuginfod servers on every debug session. Added in two places:

• .devcontainer/cpp/devcontainer-metadata.json — becomes the image's devcontainer.metadata label, so downstream projects consuming the published cpp image inherit it.
• .devcontainer/cpp/devcontainer.json — this repository's own container builds locally from the Dockerfile and so carries no label.

Only the cpp flavor ships gdb, so rust is untouched.

hadolint SC3037

Replaced two echo -e calls in .devcontainer/cpp/Dockerfile with printf.

The trigger is #116 in this same PR: MegaLinter v10 ships hadolint 2.15.0, which reports what 2.13/2.14 did not. Reproduced locally against the pre-change file:

Dockerfile:108 SC3037 warning: In POSIX sh, echo flags are undefined.
Dockerfile:178 SC3037 warning: In POSIX sh, echo flags are undefined.

— the same two lines reported in CI. After the change, hadolint 2.15.0 is clean on all three Dockerfiles. Both replacements were verified to produce byte-identical output to the originals.

✔️ Checklist

• I have followed the contribution guidelines for this repository
• I have added tests for new behavior, and have not broken any existing tests — no behavior change beyond the added gh package and the DEBUGINFOD_URLS env var; covered by the existing integration and acceptance suites
• I have added or updated relevant documentation — not applicable
• I have verified that all added components are accounted for in the SBOM — gh is a version-pinned entry in apt-requirements.json and so is picked up by the existing syft/grype scanning; other entries updated in devcontainer-lock.json, requirements.txt and package-lock.json

Note

requirements.txt was produced by git's merge of two independent pip-compile --generate-hashes outputs rather than by re-running pip-compile. The pins and hash blocks are consistent, but regenerating it is worth doing if you want the lock to be byte-for-byte reproducible.

Note

Titled feat because the set includes changes Dependabot raised as feat: (conan, cmake, devcontainer features) plus the new gh package, so a squash-merge still yields the right release-please bump.

🤖 Generated with Claude Code

https://claude.ai/code/session_016zidWuKvQmXJrRGfYzaN76

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	24		0		0	0.5s
✅ ACTION	zizmor	24	0	0		0	5.61s
✅ DOCKERFILE	hadolint	3		0		0	0.37s
✅ JSON	npm-package-json-lint	yes		no		no	0.76s
✅ JSON	prettier	22	3	0		0	0.6s
✅ JSON	v8r	22		0		0	10.54s
✅ MARKDOWN	markdownlint	12	0	0		0	1.13s
✅ MARKDOWN	markdown-table-formatter	12	1	0		0	0.31s
✅ REPOSITORY	betterleaks	yes		no		no	1.21s
✅ REPOSITORY	checkov	yes		no		no	23.39s
✅ REPOSITORY	git_diff	yes		no		no	0.02s
✅ REPOSITORY	grype	yes		no		no	79.3s
✅ REPOSITORY	osv-scanner	yes		no		no	1.72s
✅ REPOSITORY	secretlint	yes		no		no	2.68s
✅ REPOSITORY	syft	yes		no		no	6.05s
✅ REPOSITORY	trivy	yes		no		no	12.05s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.43s
✅ REPOSITORY	trufflehog	yes		no		no	4.34s
⚠️ SPELL	lychee	86		1		0	9.97s
✅ YAML	prettier	32	0	0		0	2.59s
✅ YAML	v8r	32		0		0	10.9s
✅ YAML	yamllint	32		0		0	1.28s

Detailed Issues

⚠️ SPELL / lychee - 1 error

📝 Summary
---------------------
🔍 Total..........133
🔗 Unique.........112
✅ Successful.....127
⏳ Timeouts.........0
🔀 Redirected......13
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1

Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 30:7) | Rejected status code: 403 Forbidden

Hint: Followed 13 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

• oxsecurity/megalinter/flavors/salesforce@v10.0.0 (57 linters)
• oxsecurity/megalinter/flavors/javascript@v10.0.0 (62 linters)

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

[Copilot]

🔵 Needs a closer look

It aggregates many dependency and CI workflow bumps (including major-version action updates), so it needs human confirmation via CI results and targeted smoke checks.

Pull request overview

This PR consolidates 16 dependency-update pull requests into a single branch, updating the devcontainer configurations, CI workflows, and test tooling to newer versions while preserving original history via merge commits.

Changes:

• Bump test tooling dependencies (Playwright and Node typings) in package.json / package-lock.json.
• Update multiple GitHub Actions pins across reusable workflows and repo workflows (e.g., harden-runner, cache, stale, docker actions, MegaLinter, CodeQL SARIF upload).
• Refresh devcontainer dependencies and locks (VS Code extensions, devcontainer features, Python requirements, base apt package versions).

File summaries

File	Description
package.json	Bumps @playwright/test and @types/node devDependencies.
package-lock.json	Updates resolved versions for Playwright, Node types, and related transitive deps (incl. Node engine requirement).
.github/workflows/wc-sanitize-image-name.yml	Updates step-security/harden-runner pin.
.github/workflows/wc-publish-templates.yml	Updates harden-runner and docker/login-action pins.
.github/workflows/wc-integration-test.yml	Updates harden-runner pins and bumps actions/cache to v6.1.0.
.github/workflows/wc-integration-test-podman.yml	Updates harden-runner pin.
.github/workflows/wc-integration-test-docker.yml	Updates harden-runner pin.
.github/workflows/wc-document-generation.yml	Updates harden-runner pin.
.github/workflows/wc-dependency-review.yml	Updates harden-runner pin.
.github/workflows/wc-build-push.yml	Updates pins for harden-runner, docker build tooling, metadata, attest, and sticky comment action.
.github/workflows/wc-acceptance-test.yml	Updates harden-runner and bumps actions/setup-node to v7.
.github/workflows/vulnerability-scan.yml	Updates harden-runner, container scan action, and CodeQL SARIF upload action pins.
.github/workflows/update-dependencies.yml	Updates harden-runner pins.
.github/workflows/release-please.yml	Updates harden-runner pin.
.github/workflows/release-build.yml	Updates harden-runner pins.
.github/workflows/pr-report.yml	Updates harden-runner pin.
.github/workflows/pr-image-cleanup.yml	Updates harden-runner pins.
.github/workflows/pr-conventional-title.yml	Updates harden-runner and sticky comment action pins.
.github/workflows/ossf-scorecard.yml	Updates harden-runner, scorecard action, and CodeQL SARIF upload action pins.
.github/workflows/linting-formatting.yml	Updates harden-runner, zizmor action, MegaLinter flavor, and CodeQL SARIF upload action pins.
.github/workflows/issue-creation-tool-versions.yml	Updates harden-runner pin.
.github/workflows/issue-cleanup.yml	Updates harden-runner pin and bumps actions/stale to v11.
.github/workflows/image-cleanup.yml	Updates harden-runner pin.
.github/workflows/continuous-integration.yml	Updates harden-runner pin.
.devcontainer/rust/devcontainer.json	Bumps VS Code extension versions (PR extension, rust-analyzer, SonarLint).
.devcontainer/rust/devcontainer-metadata.json	Bumps rust-analyzer version in metadata.
.devcontainer/cpp/requirements.txt	Updates pinned Python tool versions and hashes for cmake and conan.
.devcontainer/cpp/requirements.in	Updates the input pins for cmake and conan.
.devcontainer/cpp/devcontainer.json	Updates devcontainer feature versions and VS Code extension versions.
.devcontainer/cpp/devcontainer-metadata.json	Bumps SonarLint version in metadata.
.devcontainer/cpp/devcontainer-lock.json	Updates locked digests for updated devcontainer features.
.devcontainer/base/apt-requirements.json	Updates gnupg2 package version pin.

Review details

• Files reviewed: 31/32 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

📦 Container Size Analysis

Note

Comparing docker.io/gabrielfrasantos/embedded-devcontainer-base:edge ➔ docker.io/gabrielfrasantos/embedded-devcontainer-base:pr-119

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	0 B	1.03 GB	+1.03 GB (+∞)	🔼
linux/arm64	0 B	1.03 GB	+1.03 GB (+∞)	🔼

[github-actions]

📦 Container Size Analysis

Note

Comparing docker.io/gabrielfrasantos/embedded-devcontainer-rust:edge ➔ docker.io/gabrielfrasantos/embedded-devcontainer-rust:pr-119

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	0 B	1.46 GB	+1.46 GB (+∞)	🔼
linux/arm64	0 B	1.4 GB	+1.4 GB (+∞)	🔼

[github-actions]

📦 Container Size Analysis

Note

Comparing docker.io/gabrielfrasantos/embedded-devcontainer-cpp:edge ➔ docker.io/gabrielfrasantos/embedded-devcontainer-cpp:pr-119

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	732.36 MB	1.54 GB	+803.33 MB (+109.69%)	🔼
linux/arm64	0 B	1.51 GB	+1.51 GB (+∞)	🔼

[github-actions]

Test Results

 12 files   12 suites   16m 8s ⏱️
 36 tests  36 ✅ 0 💤 0 ❌
152 runs  152 ✅ 0 💤 0 ❌

Results for commit 5f3d9e9.

♻️ This comment has been updated with latest results.

[github-actions]

Pull Request Report (#119)

Static measures

Description	Value
Number of added lines	132
Number of deleted lines	123
Number of changed files	34
Number of commits	34
Number of reviews	2
Number of comments (w/o review comments)	5
Number of reviews that contains a comment to resolve	2
Number of reviews that requested a change from the author	0
Number of reviews that approved the Pull Request	0
Get the total number of participants of a Pull Request	5

Time related measures

Description	Value
PR lead time (from creation to close of PR)	5.3 Hours
Time that was spend on the branch before the PR was created	6.4 Days
Time that was spend on the branch before the PR was merged	6.7 Days
Time to merge after last review	4.7 Hours

Status check related measures

Description	Value
Total runtime for last status check run (Workflow for PR)	1.4 Hours
Total time spend in last status check run on PR	2.2 Hours