decolint on GitHub

pin-feature-version

disallow a Feature reference without an explicit version or with the “latest” version

Category
reproducibility
Applies to
devcontainer
Platforms
all

Why

A Feature reference with no version resolves to “latest”, so the container installs whatever the Feature’s author published most recently — the tooling it sets up can change under the project without the devcontainer.json changing at all. Features are published under their full version as well as “major.minor” and “major” tags, so a reference can be pinned as tightly as the project wants.

Bad

{
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "features": {
    "ghcr.io/devcontainers/features/go": {}
  }
}

Good

{
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "features": {
    "ghcr.io/devcontainers/features/go:1.3.2": {}
  }
}

References