Publish per-version changelogs for the Dev Containers extension — closed-source releases are currently unauditable

Problem

The Dev Containers extension (ms-vscode-remote.remote-containers, ~30M installs) ships releases with no per-version change documentation:

• The Marketplace listing has no Changelog tab (the /changelog URL returns 404).
• This repository has no GitHub Releases for extension versions.
• The monthly Remote Development release notes only cover noteworthy features, skip months entirely (gap between v1_107.md and v1_122.md), and v1_122.md contains no Dev Containers section at all — although 0.459.0, 0.459.1, 0.460.0 and 0.461.0 all shipped in that window.
• Patch releases like 0.459.0 → 0.459.1 (published 2026-06-05) clearly contain a fix, but there is no way for users to learn what changed.
• Pre-releases (e.g. 0.461.0) have no notes of any kind.

Since the extension is closed-source, there is no commit log to fall back on. A version number that increments is the only signal users get.

Why this matters now

VS Code extension updates are an actively exploited supply-chain attack vector. In May 2026, GitHub itself was breached via a poisoned VS Code extension (Nx Console v18.95.0, published to the Marketplace on 2026-05-18), resulting in the exfiltration of ~3,800 internal repositories (GitHub statement via BleepingComputer, Sophos analysis).

Organizations responding to that incident are now expected to audit installed extensions and review updates before rollout (Sophos' explicit recommendation). For Dev Containers — an extension that by design executes containers, mounts workspaces, and handles credentials — that audit is currently impossible: closed source, no changelog, no release notes.

Microsoft's own publishing documentation recommends practices (pre-release versioning conventions, Marketplace changelogs) that this first-party flagship extension does not follow.

Request

1. Publish a CHANGELOG.md entry or GitHub Release per stable version in this repository (issue references suffice — full prose not required).
2. Populate the Marketplace Changelog tab from it.
3. At minimum: document what patch releases (e.g. 0.459.1) fix, so security teams can distinguish "routine fix" from "security-relevant update".