[rosstaco]

Summary

v1.1.0 of package-source-overrides. It adds package managers that ignore the existing npm and pip config (uv, Yarn Berry, Corepack). It also fixes two problems found in testing where public feeds stayed in use, and corrects the install-order docs, particularly for VS Code's dev.containers.defaultFeatures.

Fixes (each verified)

• NuGet scope: "system" left nuget.org enabled. The .NET SDK's default user config adds nuget.org back. nuget.org is now listed under <disabledPackageSources>. On mcr.microsoft.com/dotnet/sdk:8.0, dotnet nuget list source now shows nuget.org [Disabled].
• pnpm ignores NPM_CONFIG_GLOBALCONFIG (/etc/npmrc), confirmed with pnpm 12.7. The per-user ~/.npmrc is now written for every scope.
• Docs: install order. Within each install round, the spec sorts Features alphabetically by registry path, so ghcr.io/devcontainers/* installs before this Feature. The old "no installsAfter means it installs early" claim was wrong. Results from devcontainer read-configuration --include-features-configuration --additional-features:
  • In global defaults alone: dotnet, node, python, then this Feature last.
  • Global defaults plus common-utils: common-utils, this Feature, then dotnet, node, python. The official Features declare installsAfter: common-utils.
  • The docs now cover overrideFeatureInstallOrder (per repo), the common-utils pairing for defaultFeatures (machine-wide), and base images.
• Late-install warning. The Feature warns if npm, pip, uv, dotnet, etc. already exist when it runs.

Additions

• uv: writes /etc/uv/uv.toml and ~/.config/uv/uv.toml ([[index]] with default = true) from pipIndexUrl. uv ignores pip.conf and PIP_INDEX_URL. The new uvPythonInstallMirror option sets python-install-mirror, and allow-insecure-host is set when strictSsl is false. Checked with uv 0.9.30: no parse errors, and both the proxy index and the Python mirror are used.
• Yarn Berry: writes npmRegistryServer to ~/.yarnrc.yml, plus enableStrictSsl and unsafeHttpWhitelist for http:// registries. Checked with Yarn 4.18.1.
• Corepack: sets COREPACK_NPM_REGISTRY through /etc/profile.d for runtime use. Confirmed that Corepack ignores .npmrc and requests <registry>/pnpm/<version>.
• bashEnvHook (opt-in): uses BASH_ENV to pass environment-variable-only overrides to the install scripts of Features that run later. An existing BASH_ENV is chained. BASH_ENV itself is always set because containerEnv is static, but bash silently ignores the file when it doesn't exist.
• URL options are validated, NuGet values are XML-escaped, and nugetSourceName=nuget.org is rejected.

Testing

• shellcheck passes on install.sh and all test scripts.
• devcontainer features test on mcr.microsoft.com/devcontainers/base:ubuntu: the default test plus 7 scenarios (2 new: scope-system, bash-env-hook), 69 checks passed, 0 failed.
• The generated configs were checked against the real tools: uv, dotnet, Yarn Berry, and Corepack.