Summary
The current Go feature installs nine editor tools from mutable @latest targets during every image build, with no option to pin or skip the tool set. A frozen Dev Container feature lock therefore does not produce a reproducible or vulnerability-clean image.
A build from ghcr.io/devcontainers/features/go@sha256:d85e921f91b41340055bb12b325d9d551170ed04b3b832e33530bf42f167c032 (feature 1.3.4) on 2026-09-19 produced ten fixable HIGH findings across the installed tools:
gopls: golang.org/x/mod below 0.40.0 and golang.org/x/text below 0.39.0gotests, impl, and staticcheck: golang.org/x/mod below 0.40.0revive: golang.org/x/text below 0.39.0
The operating-system and application layers in the same image were clean at HIGH/CRITICAL after package updates.
Reproduction
trivy image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed <image>
The feature installer currently defines GO_TOOLS with @latest for every tool. The tool versions and transitive modules are neither represented in devcontainer-lock.json nor configurable through devcontainer-feature.json.
Expected behavior
Please add reviewed per-tool version options and an option to disable installation of the bundled editor tools. The feature's release gate should also scan the resulting binaries for fixable HIGH/CRITICAL findings. This would let consumers retain a frozen feature lock while choosing a reproducible, vulnerability-clean tool set.
Summary
The current Go feature installs nine editor tools from mutable
@latesttargets during every image build, with no option to pin or skip the tool set. A frozen Dev Container feature lock therefore does not produce a reproducible or vulnerability-clean image.A build from
ghcr.io/devcontainers/features/go@sha256:d85e921f91b41340055bb12b325d9d551170ed04b3b832e33530bf42f167c032(feature 1.3.4) on 2026-09-19 produced ten fixable HIGH findings across the installed tools:gopls:golang.org/x/modbelow 0.40.0 andgolang.org/x/textbelow 0.39.0gotests,impl, andstaticcheck:golang.org/x/modbelow 0.40.0revive:golang.org/x/textbelow 0.39.0The operating-system and application layers in the same image were clean at HIGH/CRITICAL after package updates.
Reproduction
trivy image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed <image>The feature installer currently defines
GO_TOOLSwith@latestfor every tool. The tool versions and transitive modules are neither represented indevcontainer-lock.jsonnor configurable throughdevcontainer-feature.json.Expected behavior
Please add reviewed per-tool version options and an option to disable installation of the bundled editor tools. The feature's release gate should also scan the resulting binaries for fixable HIGH/CRITICAL findings. This would let consumers retain a frozen feature lock while choosing a reproducible, vulnerability-clean tool set.