v0.4.18

[Álvaro Rausell Guiard (AlvaroRausell)]

What's Changed

Development changes

• Bump up javascript-node image version #1492 by sireeshajonnalagadda

Patches and Security Fixes

• updating setuptools from 75.6.0 to 78.1.1 #1455 by sireeshajonnalagadda

• [miniconda] - requests - GHSA-9hjg-9r4m-mvj7 - urllib3 - GHSA-pq67-6m6q-mj2v #1474 by sireeshajonnalagadda
• Support for Alpine 3.22 #1473 by sireeshajonnalagadda
• Support: typescript-node 24 #1447 by マルコメ (@Marukome0743)
• chore: support go 1.25 #1502 by Yang Gao (@criyle)
• [anaconda]- fixing multiple vulnerabilities #1507 by sireeshajonnalagadda
• Fix for vulnerability issue CVE-2024-46901 #1506 by @Kaniska244
• [universal] - Fixing multiple vulnerability issues #1509 by @Kaniska244
• Updated fix for vulnerability issue CVE-2024-46901 #1518 by @Kaniska244

Add support for Debian Trixie

• Debian: Support debian 13 (trixie) #1501 by Dan Lapid (@danlapid)

• adding support for debian13 (trixie) for rust image #1500 by sireeshajonnalagadda

• [php] - Add support for debian trixie(13) #1512 by @Kaniska244

• go: support go 1.25 on Debian trixie #1511 by Yang Gao (@criyle)

• [python] - Add support for debian trixie(13) #1513 by @Kaniska244

• [javascript-node] - Add support for debian trixie(13) #1515 by @Kaniska244

• [ruby] - Add support for debian trixie(13) #1522 by @Kaniska244

New Contributors

• Yang Gao (@criyle) made their first contribution in chore: support go 1.25 #1502
• Dan Lapid (@danlapid) made their first contribution in Debian: Support debian 13 (trixie) #1501

Full Changelog: v0.4.17...v0.4.18

---

This discussion was created from the release v0.4.18.

[Aran Wilkinson (aranw)]

I noticed some Go Docker images tagged as go:2.0.2-1.25-trixie and I'm a bit puzzled by the versioning scheme here.

What exactly is the 2.0.2 bit? It's clearly not the Go version since that's 1.25 bit confusing I think to put the 2.0.2 before the 1.25, so I'm curious what this number actually refers to.

Couple of questions that would be really helpful if someone could clarify:

What's the difference between go:2.0.2-1.25-trixie and go:1.25-trixie?

Is there any documentation that explains what these tags mean? I've also noticed images with dev- prefixes and couldn't figure out what that's for either.

Would help me understand which tags to actually use for different scenarios. Cheers!

[Kaniska (v-Kaniska244)]

Hello Aran Wilkinson (@aranw) ,

We would request you to refer to the readme. Although the latest image version isn't documented there, it gives the information in general you are looking for. Also at dev container side we are looking to simplify the image naming convention further in future to stream line the different naming patterns.

Kindly let me know in case of any further concern.

With Regards,
Kaniska

[Aran Wilkinson (aranw)]

So is 2.0.2 a semantic version of the Go image itself and only that image? Or the devcontainer/images repo? I ask because the current release of devcontainers/images is v0.4.18 as per this discussion

I'd also like to point out there is no reference to dev- on the linked page

My assumption is that dev- is just built by main. This is purely a guess on my part and only real evidence of that I found was found here but that was last updated 6 months ago

I'm unsure if this image has a special build process, special flags applied or is it identical to the normal tagged images just built from main?

[Kaniska (v-Kaniska244)]

Hello Aran Wilkinson (@aranw) ,

Each dev container image has a version associated with it which is mentioned in a image specific manifest.json, for example in case of golang dev container image its mentioned here.

The dev releases are more like preview images for the next upcoming release and these dev images are published every week. So these are always more updated compared to the images published as part of the last official release which is currently v0.4.18 published yesterday.
The image naming convention which I was referring to earlier are those published as part of official dev container releases every month or every second month.

All the dev container images published in MCR registry, are built from the main branch.

Kindly let me know in case of further concern.

[Álvaro Rausell Guiard (AlvaroRausell)]

Aran Wilkinson (@aranw) Thank you for your comment. For full transparency: I started taking over this part of the org relatively recently, and it is not my day-to-day focus. Because of this, there is a limited set of things I have been able to figure out and/or change in this time. However, I agree with your point. versioning isn't always clear, and some aspects of it have confused me even this week. I want to change it, but I need some time to think about the best strategy and, most importantly, how to move forwards without breaking people using past versions. If you have any proposals that would make things better, I am all ears!

[Álvaro Rausell Guiard (AlvaroRausell)]

And to add to @Kaniska244 's answer. There are a few concepts at play in that image version:

• The image version (2.0.2)
• The version of go that it packages (1.25)
• The distro it is running on top of (trixie)
• The images release version (v0.4.18)
• dev- images. These exist so that us maintainers can test image upgrades prior to releasing them. There is nothing built to them that would keep you from using them, but they are untested and might cause problems in your setup.
  That last one has no impact other than to provide a point-in-time statement of what the images are in that release. It is not referred to by anything, other than this Discussion post and docs updates, to link things together in GitHub.

Hope this all helps, but happy to chat more if I missed something :)