From 4746d8ab46a365c39c67ea2e9d88e04d1ec33c59 Mon Sep 17 00:00:00 2001 From: devcontainers-contrib Date: Mon, 16 Jun 2025 18:55:15 -0700 Subject: [PATCH 1/2] Update README.md Signed-off-by: devcontainers-contrib --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 4b130e0ce..ed90a46c2 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,8 @@ # Extra Dev Container Features +> [!CAUTION] +> This fork was created because the previous owner of devcontainers-contrib deleted the account. This accountonce hosted the [original features repository.](https://web.archive.org/web/20230321202408/https://github.com/devcontainers-contrib/features) Many devcontainers include a vulnerable path to a devcontainers-contrib feature container. This account presents a [supply chain risk](https://www.microsoft.com/en-us/securityengineering/opensource/ossthreats) and will be squatted to prevent malicious actors from claiming it and publishing substituted containers. If you are associated with Microsoft, devcontainers, or devcontainers-extra please contact the finder of this issue [@NathanCYee](https://github.com/NathanCYee) to resolve this safely. + 🐳 Extra add-in features for [devcontainers](https://code.visualstudio.com/docs/devcontainers/containers) and [GitHub Codespaces](https://github.com/features/codespaces) From 66b847809a109a4e499430f8c86988336f0b4d33 Mon Sep 17 00:00:00 2001 From: Brigit Murtaugh Date: Mon, 7 Jul 2025 08:43:29 -0700 Subject: [PATCH 2/2] Update README.md Signed-off-by: Brigit Murtaugh --- README.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ed90a46c2..88a52597a 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,13 @@ # Extra Dev Container Features -> [!CAUTION] -> This fork was created because the previous owner of devcontainers-contrib deleted the account. This accountonce hosted the [original features repository.](https://web.archive.org/web/20230321202408/https://github.com/devcontainers-contrib/features) Many devcontainers include a vulnerable path to a devcontainers-contrib feature container. This account presents a [supply chain risk](https://www.microsoft.com/en-us/securityengineering/opensource/ossthreats) and will be squatted to prevent malicious actors from claiming it and publishing substituted containers. If you are associated with Microsoft, devcontainers, or devcontainers-extra please contact the finder of this issue [@NathanCYee](https://github.com/NathanCYee) to resolve this safely. +> [!IMPORTANT] +> This fork was created because the original `devcontainers-contrib` creator deleted the account. This repo was generously created and hosted by [@NathanCYee](https://github.com/NathanCYee) in the dev container community to avoid any accidental or malicious rehosting of these Features, and [`devcontainers-extra`](https://github.com/devcontainers-extra/features) was also generously created and continues to be hosted by the community to continue publishing these Features as well. +> +> As maintainers of the official Dev Containers Spec became aware of [this issue](https://github.com/microsoft/vscode-remote-release/issues/11046), additional steps have now been taken: +> * [Update the dev container CLI](https://github.com/devcontainers/cli/pull/1044) to automatically redirect from `devcontainers-contrib` to `devcontainers-extra` +> * Show a warning in VS Code and GitHub Codespaces about the state of `devcontainers-contrib` and redirection to `devcontainers-extra` (to ensure users are aware and `devcontainers-extra` gets proper credit) +> +> If you experience any additional issues, please notify the Dev Containers Spec maintainers via an issue in the [dev container CLI repo](https://github.com/devcontainers/cli). 🐳 Extra add-in features for [devcontainers](https://code.visualstudio.com/docs/devcontainers/containers) and