chore(deps): bump conan from 2.20.1 to 2.28.1 in /.devcontainer

[dependabot]

Bumps conan from 2.20.1 to 2.28.1.

Release notes

Sourced from conan's releases.

2.28.1 (30-Apr-2026)

• Bugfix: Fix regression for downloads without sha256. (conan-io/conan#19934)

2.28.0 (28-Apr-2026)

• Feature: conan upload --allow-disabled to allow uploading to a disabled remote. (conan-io/conan#19916)
• Feature: Allow using patch-ng 1.19 to incorporate fixes (conan-io/conan#19913)
• Feature: Use a OR policy between core:policies and recipe required_conan_version. (conan-io/conan#19907). Docs: 📃
• Feature: conan config install-pkg --insecure new feature. Also supported for conanconfig.yml files (conan-io/conan#19900). Docs: 📃
• Feature: Introduce policies in core:policies conf to control Conan behaviour. (conan-io/conan#19892). Docs: 📃
• Feature: Colorize output of conan config list and conan config show (conan-io/conan#19889)
• Feature: Add ability to show transitive requires in conan graph info ... -f=html output (conan-io/conan#19884)
• Feature: Add ability to show node subgraph in conan graph info ... -f=html output (conan-io/conan#19884)
• Feature: Add ability to filter by file extensions in conan report diff ... -f=html output (conan-io/conan#19884)
• Feature: New compiler flags flags_map() Python plugin to be able to translate, remove or handle compiler flags coming from compatible binaries built with a different compiler trying to inject compiler flags for that compiler. (conan-io/conan#19879). Docs: 📃
• Feature: tools.build:install_strip now accepts a list of possible build systems (conan-io/conan#19874). Docs: 📃
• Feature: Add new "certified" variant to settings VxWorks and new "safe" variant to Neutrino (conan-io/conan#19861)
• Feature: Allow patterns for recipe names in --update flag (conan-io/conan#19856)
• Feature: Add --strict flag to conan remote auth. (conan-io/conan#19848). Docs: 📃
• Feature: Avoid detecting default package manager when overridden from profile (conan-io/conan#19847)
• Feature: Add new experimental contextual output for conan export command (conan-io/conan#19836)
• Feature: Added default package manager for CachyOS. (conan-io/conan#19788)
• Feature: Introduce new consistent=True requirement trait to be able to have diamond structures for visible=False requirements. (conan-io/conan#19286). Docs: 📃
• Fix: Test publishing Conan wheels to test PyPi. (conan-io/conan#19906)
• Fix: Ignore local package lockfiles in conan workspace install/build and use consistently a global lockfile if provided or found by default. (conan-io/conan#19896)
• Fix: Force --order-by in conan graph build-order. Old deprecated behaviour can be restored until Conan 2.32 with the deprecated_build_order_args policy (conan-io/conan#19892). Docs: 📃
• Fix: Remove support for empty version ranges. Old deprecated behaviour can be restored until Conan 2.32 with the deprecated_empty_version_range policy (conan-io/conan#19892). Docs: 📃
• Fix: Remove deprecated system_tools profile section (conan-io/conan#19877)
• Fix: Remove deprecated detect_compiler method in detect api (conan-io/conan#19877)
• Fix: Remove deprecated deploy folder in conan home (conan-io/conan#19877)
• Fix: Remove deprecated methods from PackagesList (conan-io/conan#19877)
• Fix: Remove deprecated cmake_set_interface_link_directories property (conan-io/conan#19877)
• Fix: Remove deprecated Node::dependencies method (conan-io/conan#19877)
• Fix: Warn when credentials environment variables are set but not used because the server accepted anonymous access and point users to add --force to force authentication. (conan-io/conan#19872)
• Fix: Documenting CommandAPI and better docs for ProfilesAPI (conan-io/conan#19871)
• Fix: Fix output of options with "error" in its name in conan list command. (conan-io/conan#19867)
• Fix: Forward underlying system package manager error messages (conan-io/conan#19858)
• Fix: Deprecate build_requires, use tool_requires instead (conan-io/conan#19849). Docs: 📃
• Fix: Inline transitive dependencies to avoid Xcode recursion crashes. (conan-io/conan#19844). Docs: 📃
• Fix: finalize() output folder should be printed only once (conan-io/conan#19834)
• Fix: Change default core.download:retry_wait from 0 to 1 second. Document retry conf defaults for conan config list (conan-io/conan#19830)
• Fix: Use user locale in conan list ... -f=html output. (conan-io/conan#19828)
• Fix: Avoid subtle errors with casing errors like requires("myPkg/[*]") using version ranges. (conan-io/conan#19799)
• Fix: Add support for Xcode 26.4 with Apple Clang 21. (conan-io/conan#19795)
• Fix: Add -ur/-ubr/-upr for conan lock upgrade as short forms for --update-requires, etc. (conan-io/conan#19791)
• Fix: Propagate build requirement run trait to upstream shared dependency. (conan-io/conan#19751)
• Fix: Make components from same package full link in CMakeConfigDeps. (conan-io/conan#19641)
• Bugfix: Solve crash of conan workspace install/build --lockfile=mylock --lockfile-partial (conan-io/conan#19896)
• Bugfix: conan install --lockfile=xxxx will raise if the lockfile contains config_requires and the current installed configuration packages do not align with it (conan-io/conan#19875). Docs: 📃
• Bugfix: Change propagation on bindirs for VirtualBuildEnv respecting requirement run trait, based on the new required_conan_version=">=2.28" recipe version or global.conf using core:policies=["required_conan_version>=2.28"] (conan-io/conan#19849). Docs: 📃
• Bugfix: Solve incorrect .ps1 file generation when unsetting the conf with -c tools.env.virtualenv:powershell=!. (conan-io/conan#19820)

... (truncated)

Commits

• d6abf87 Fix regression for downloads without sha256 (#19934)
• 77a2ac4 Conan 2.28.1
• 058dfec conan 2.28.0
• 717f1c1 Remove deprecated_conanfile_path_methods (#19919)
• 69d0e84 Use a OR policy between core:required_conan_version and recipe ``required...
• 4fb7de4 Inline transitive dependencies to avoid Xcode recursion crashes (#19844)
• 48dca6c Proposing new flags plugin for compatibility (#19879)
• 0b8d92e allow upload to disabled remotes (#19916)
• 84ccc2a experiment with visible=False trait equivalence (#19286)
• fe43ada Allow using patch-ng 1.19 as a dependency (#19913)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 1e6e3bf.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	19		0	0	0.6s
✅ DOCKERFILE	hadolint	2		0	0	0.8s
✅ GHERKIN	gherkin-lint	6		0	0	2.54s
✅ JSON	npm-package-json-lint	yes		no	no	0.53s
✅ JSON	prettier	16	2	0	0	0.58s
✅ JSON	v8r	16		0	0	8.53s
⚠️ MARKDOWN	markdownlint	9	0	1	0	0.98s
✅ MARKDOWN	markdown-table-formatter	9	1	0	0	0.33s
✅ REPOSITORY	gitleaks	yes		no	no	1.41s
✅ REPOSITORY	git_diff	yes		no	no	0.02s
❌ REPOSITORY	grype	yes		1	2	42.03s
✅ REPOSITORY	secretlint	yes		no	no	0.98s
✅ REPOSITORY	syft	yes		no	no	1.94s
❌ REPOSITORY	trivy	yes		1	2	6.64s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.29s
✅ REPOSITORY	trufflehog	yes		no	no	2.4s
✅ SPELL	lychee	70		0	0	43.39s
✅ YAML	prettier	25	0	0	0	1.03s
✅ YAML	v8r	25		0	0	9.21s
✅ YAML	yamllint	25		0	0	0.84s

Detailed Issues

❌ REPOSITORY / grype - 1 error

error: A high vulnerability in python package: lxml, version 4.9.3 was found at: /.devcontainer/cpp/requirements.txt

warning: A medium vulnerability in python package: requests, version 2.32.4 was found at: /.devcontainer/cpp/requirements.txt

note: A low vulnerability in python package: pygments, version 2.17.2 was found at: /.devcontainer/cpp/requirements.txt

warning: 1 warnings emitted
error: 1 errors emitted

❌ REPOSITORY / trivy - 1 error

error: Package: lxml
Installed Version: 4.9.3
Vulnerability CVE-2026-41066
Severity: HIGH
Fixed Version: 6.1.0
Link: [CVE-2026-41066](https://avd.aquasec.com/nvd/cve-2026-41066)
    ┌─ .devcontainer/cpp/requirements.txt:173:1
    │
173 │ lxml==4.9.3 \
    │ ^
    │
    = lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read
    = lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

note: Package: pygments
Installed Version: 2.17.2
Vulnerability CVE-2026-4539
Severity: LOW
Fixed Version: 2.20.0
Link: [CVE-2026-4539](https://avd.aquasec.com/nvd/cve-2026-4539)
    ┌─ .devcontainer/cpp/requirements.txt:332:1
    │
332 │ pygments==2.17.2 \
    │ ^
    │
    = pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer
    = A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

warning: Package: requests
Installed Version: 2.32.4
Vulnerability CVE-2026-25645
Severity: MEDIUM
Fixed Version: 2.33.0
Link: [CVE-2026-25645](https://avd.aquasec.com/nvd/cve-2026-25645)
    ┌─ .devcontainer/cpp/requirements.txt:395:1
    │
395 │ requests==2.32.4 \
    │ ^
    │
    = requests: Requests: Security bypass due to predictable temporary file creation
    = Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

warning: 1 warnings emitted
error: 1 errors emitted

⚠️ MARKDOWN / markdownlint - 1 error

.github/CONTRIBUTING.md:18:7 MD051/link-fragments Link fragments should be valid [Context: "[Found a security vulnerability?](#found-a-security-vulnerability)"]

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.0.1 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,GHERKIN_GHERKIN_LINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.