[philips-software-forest-releaser]

🤖 I have created a release beep boop

9.0.0 (2026-11-06)

⚠ BREAKING CHANGES

• add code container user to replace root (#1501)

Features

• Add code container user to replace root (#1501) (adf549b)
• Add GitHub cli (#1517) (740a93b)

Bug Fixes

• Enable code as container user for all configurations (#1516) (55dc7e3)

Chores

• deps, cpp: Update mull-22 (#1507) (1bcf69c)
• deps: Bump gcovr from 8.6 to 8.7 in amp-devcontainer-cpp (#1506) (d747cb5)
• Fix sonarqube findings (#1505) (66681b4)
• Install mull from gh releases (#1519) (78c54fd)
• main: Release actions 2.0.0 (#1502) (dce97e0)
• main: Release actions 2.1.0 (#1520) (393bcb3)
• Update node version in actions (#1515) (beb625c)

---

This PR was generated with Release Please. See documentation.

[github-actions]

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-base:edge ➔ ghcr.io/philips-software/amp-devcontainer-base:pr-1503

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	98.97 MB	98.97 MB	+485 B (+0%)	🔼
linux/arm64	96.24 MB	96.24 MB	+592 B (+0%)	🔼

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	23		0		0	0.29s
✅ DOCKERFILE	hadolint	4		0		0	0.55s
✅ JSON	npm-package-json-lint	yes		no		no	0.45s
✅ JSON	prettier	53	14	0		0	2.71s
✅ JSON	v8r	53		0		0	16.93s
✅ MARKDOWN	markdownlint	13	0	0		0	0.9s
✅ MARKDOWN	markdown-table-formatter	13	0	0		0	0.33s
✅ REPOSITORY	betterleaks	yes		no		no	1.12s
✅ REPOSITORY	checkov	yes		no		no	21.78s
✅ REPOSITORY	git_diff	yes		no		no	0.02s
✅ REPOSITORY	grype	yes		no		no	116.26s
⚠️ REPOSITORY	osv-scanner	yes		1		4	1.95s
✅ REPOSITORY	secretlint	yes		no		no	1.4s
✅ REPOSITORY	syft	yes		no		no	4.46s
✅ REPOSITORY	trivy	yes		no		no	14.26s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.51s
✅ REPOSITORY	trufflehog	yes		no		no	4.36s
✅ SPELL	lychee	126		0		0	32.89s
✅ YAML	prettier	36	0	0		0	0.83s
✅ YAML	v8r	36		0		0	12.11s
✅ YAML	yamllint	36		0		0	0.98s

Detailed Issues

⚠️ REPOSITORY / osv-scanner - 1 error

warning: Package 'minimatch@10.2.6' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
 = CVE-2026-118764: minimatch has potential denial of service via globparts amplification
 = minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
   
   researcher: Reid Downing (b1nv0id)
   files: 
   
   - src/index.ts: 690-770
   - src/index.ts: 780-796
   
   issue:
   input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
   
   the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:

parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)

this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.

the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:

for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}

an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.

warning: Package 'minimatch@10.2.4' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.

researcher: Reid Downing (b1nv0id)
files: 

- src/index.ts: 690-770
- src/index.ts: 780-796

issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.

the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:

parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)

this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.

the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:

for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}

an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.

warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.

For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.

warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.

For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.

warning: 4 warnings emitted

See detailed reports in MegaLinter artifacts

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

• oxsecurity/megalinter/flavors/salesforce@v10.1.0 (58 linters)

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

[github-actions]

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-docs:edge ➔ ghcr.io/philips-software/amp-devcontainer-docs:pr-1503

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	230.44 MB	230.44 MB	+693 B (+0%)	🔼
linux/arm64	225.93 MB	225.93 MB	+1.18 kB (+0%)	🔼

[github-actions]

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-rust:edge ➔ ghcr.io/philips-software/amp-devcontainer-rust:pr-1503

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	455.19 MB	455.19 MB	+160 B (+0%)	🔼
linux/arm64	395.54 MB	395.54 MB	+443 B (+0%)	🔼

[github-actions]

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-embedded-rust:edge ➔ ghcr.io/philips-software/amp-devcontainer-embedded-rust:pr-1503

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	521.93 MB	521.93 MB	+1.04 kB (+0%)	🔼
linux/arm64	462.37 MB	462.38 MB	+147 B (+0%)	🔼

[github-actions]

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-embedded-cpp:edge ➔ ghcr.io/philips-software/amp-devcontainer-embedded-cpp:pr-1503

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	629.42 MB	629.43 MB	+2.09 kB (+0%)	🔼
linux/arm64	607.25 MB	607.26 MB	+3.77 kB (+0%)	🔼

[github-actions]

Test Results

 25 files  ±0   25 suites  ±0   9m 34s ⏱️ +10s
 57 tests ±0   57 ✅ ±0  0 💤 ±0  0 ❌ ±0 
297 runs  ±0  297 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 55886bc. ± Comparison against base commit 78c54fd.

♻️ This comment has been updated with latest results.

[github-actions]

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-cpp:edge ➔ ghcr.io/philips-software/amp-devcontainer-cpp:pr-1503

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	427.23 MB	427.23 MB	+1.28 kB (+0%)	🔼
linux/arm64	405.89 MB	405.89 MB	+1.16 kB (+0%)	🔼

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[philips-software-forest-releaser]

🤖 Created releases:

• v9.0.0

🌻

[github-actions]

Pull Request Report (#1503)

Static measures

Description	Value
Number of added lines	61
Number of deleted lines	17
Number of changed files	6
Number of commits	1
Number of reviews	3
Number of comments (w/o review comments)	10
Number of reviews that contains a comment to resolve	1
Number of reviews that requested a change from the author	0
Number of reviews that approved the Pull Request	2
Get the total number of participants of a Pull Request	5

Time related measures

Description	Value
PR lead time (from creation to close of PR)	11.1 Days
Time that was spend on the branch before the PR was created	0 Sec
Time that was spend on the branch before the PR was merged	2.7 Hours
Time to merge after last review	8.8 Min

Status check related measures

Description	Value
Total runtime for last status check run (Workflow for PR)	1.6 Hours
Total time spend in last status check run on PR	2.7 Hours

[github-actions]

🎉 Hooray! The changes in this pull request went live with the release of v9.0.0 🎉