chore(deps): bump ghcr.io/devcontainers/features/node from 1.6.3 to 2.0.0

[dependabot]

Bumps ghcr.io/devcontainers/features/node from 1.6.3 to 2.0.0.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 1780107.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	19		0	0	0.5s
✅ DOCKERFILE	hadolint	2		0	0	0.87s
✅ GHERKIN	gherkin-lint	6		0	0	2.53s
✅ JSON	npm-package-json-lint	yes		no	no	0.51s
✅ JSON	prettier	16	2	0	0	0.56s
✅ JSON	v8r	16		0	0	8.61s
⚠️ MARKDOWN	markdownlint	9	0	1	0	0.97s
✅ MARKDOWN	markdown-table-formatter	9	1	0	0	0.28s
✅ REPOSITORY	gitleaks	yes		no	no	1.17s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
❌ REPOSITORY	grype	yes		1	2	39.72s
✅ REPOSITORY	secretlint	yes		no	no	0.98s
✅ REPOSITORY	syft	yes		no	no	1.79s
❌ REPOSITORY	trivy	yes		1	2	6.56s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.22s
✅ REPOSITORY	trufflehog	yes		no	no	2.41s
❌ SPELL	lychee	70		1	0	67.3s
✅ YAML	prettier	25	0	0	0	1.14s
✅ YAML	v8r	25		0	0	8.32s
✅ YAML	yamllint	25		0	0	0.93s

Detailed Issues

❌ REPOSITORY / grype - 1 error

error: A high vulnerability in python package: lxml, version 4.9.3 was found at: /.devcontainer/cpp/requirements.txt

warning: A medium vulnerability in python package: requests, version 2.32.4 was found at: /.devcontainer/cpp/requirements.txt

note: A low vulnerability in python package: pygments, version 2.17.2 was found at: /.devcontainer/cpp/requirements.txt

warning: 1 warnings emitted
error: 1 errors emitted

❌ SPELL / lychee - 1 error

[IGNORED] docker://pandoc/extra:3.7.0@sha256:a703d335fa237f8fc3303329d87e2555dca5187930da38bfa9010fa4e690933a | Unsupported: Error creating request client: builder error for url (docker://pandoc/extra:3.7.0@sha256:a703d335fa237f8fc3303329d87e2555dca5187930da38bfa9010fa4e690933a)
[IGNORED] https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/philips-software/embedded-devcontainer | Unsupported: Error creating request client: builder error for url (vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/philips-software/embedded-devcontainer)
[TIMEOUT] https://www.contributor-covenant.org/version/2/0/code_of_conduct.html | Timeout
📝 Summary
---------------------
🔍 Total..........117
✅ Successful.....109
⏳ Timeouts.........1
🔀 Redirected.......0
👻 Excluded.........5
❓ Unknown..........0
🚫 Errors...........0

Errors in .github/CODE_OF_CONDUCT.md
[TIMEOUT] https://www.contributor-covenant.org/version/2/0/code_of_conduct.html | Timeout

❌ REPOSITORY / trivy - 1 error

error: Package: lxml
Installed Version: 4.9.3
Vulnerability CVE-2026-41066
Severity: HIGH
Fixed Version: 6.1.0
Link: [CVE-2026-41066](https://avd.aquasec.com/nvd/cve-2026-41066)
    ┌─ .devcontainer/cpp/requirements.txt:172:1
    │
172 │ lxml==4.9.3 \
    │ ^
    │
    = lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read
    = lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

note: Package: pygments
Installed Version: 2.17.2
Vulnerability CVE-2026-4539
Severity: LOW
Fixed Version: 2.20.0
Link: [CVE-2026-4539](https://avd.aquasec.com/nvd/cve-2026-4539)
    ┌─ .devcontainer/cpp/requirements.txt:331:1
    │
331 │ pygments==2.17.2 \
    │ ^
    │
    = pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer
    = A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

warning: Package: requests
Installed Version: 2.32.4
Vulnerability CVE-2026-25645
Severity: MEDIUM
Fixed Version: 2.33.0
Link: [CVE-2026-25645](https://avd.aquasec.com/nvd/cve-2026-25645)
    ┌─ .devcontainer/cpp/requirements.txt:394:1
    │
394 │ requests==2.32.4 \
    │ ^
    │
    = requests: Requests: Security bypass due to predictable temporary file creation
    = Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

warning: 1 warnings emitted
error: 1 errors emitted

⚠️ MARKDOWN / markdownlint - 1 error

.github/CONTRIBUTING.md:18:7 MD051/link-fragments Link fragments should be valid [Context: "[Found a security vulnerability?](#found-a-security-vulnerability)"]

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.0.1 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,GHERKIN_GHERKIN_LINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.