Looks up the latest stable release for a single software package and returns the exact version string to pin in a Dockerfile. Use when you have a dependency name, its current version, and its source type (go-module, npm-package, github-release, maven-central, debian-snapshot) and need the correct new version string. Do not use for packages marked as unpinned or intentionally @latest.
Verifies a dependency update for supply chain attack indicators before applying version changes. Checks package ownership, release authenticity, known vulnerabilities, and suspicious patterns.
Conventions and patterns for writing Dockerfiles in this repository. Use when creating a new Dockerfile or adding software to an existing one.
Reads one or more Dockerfiles and produces a structured catalog of every pinned dependency version, grouped by source type (go-module, npm-package, github-release, maven-central, debian-snapshot). Use when preparing a version-update workflow, auditing dependency freshness, or identifying which packages in a Dockerfile need a version bump.
Procedures for building and smoke-testing a vscode-devcontainer Dockerfile locally. Use when validating a new or modified Dockerfile before release.