eclipse-openvsx/openvsx v1.3.0

on GitHub

This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

Server

Added

• Add fine-grained admin permissions (#2269)
• Configurable extension size limits with namespace overrides, bounded by ovsx.publishing.max-override-size (#2287, #2303)
• Backfill download events from access logs (#2228)
• Prompt anonymous visitors to log in on the reviews tab (#2148)
• Add a Caches page to the admin dashboard (#2203)
• Time-series download analytics, kept off extension pages until an admin switches them on, so a registry can backfill its download history first (#2134, #2340)
• Give download analytics its own time-series database; the registry starts and keeps serving while it is unreachable, and log files are kept until their events are stored (#2133, #2336)
• Scope personal access tokens to a namespace or an extension, and add publishing-only tokens (#2296)
• Publish a SettingsChangedEvent after the site settings change (#2316)
• Serve runtime settings a deployment registers as its own WritableSetting beans on /admin/settings, and on /api/-/settings when they are a PublicSetting, as camelCase properties named after their row keys (#2340)
• Expose the download size of each target platform as downloadSizes on the extension API response (#2168)
• Add a consistency check that finds and repairs extensions whose stored average rating or review count differs from their active reviews, see #2327 (#2328)
• Add GET /admin/analytics/status, which reports whether download analytics is enabled and reachable and how many log files wait for it, for the admin dashboard (#2337)
• Record the CI run behind a trusted-publishing upload when the token carries it: GitHub's job_workflow_ref, run_id and workflow_sha, GitLab's pipeline_id, job_id and sha (#2283)

Changed

• Upgrade: migration V1_78 makes extension_version.published_by_id NOT NULL and stops the server from starting if a row is still NULL. Versions published before 1.2.0 without a recorded token have no publisher to backfill, so check SELECT count(*) FROM extension_version WHERE published_by_id IS NULL returns 0 before upgrading (#2276)
• /vscode/gallery/extensionquery loads only the versions it returns instead of every active version of each matched extension, pre-releases included (#2161)
• Accept the personal access token via an Authorization: Bearer header (#2209)

Fixed

• Refuse the trusted publishing endpoints that create or delete a trusted publisher or issue a publish token while the registry is read-only (#2339)
• Match secret detection rules case-sensitively unless the rule has an inline (?i), which stops mixed-case words such as Asiakasdokumentaatio being flagged as AWS keys, see #2329 (#2330)
• Keep polling async scanners through transient errors, confirm an error status on a second poll before failing a scan, and treat every non-2xx scanner response as an error (#2307)
• Compare trusted-publishing claims case-insensitively, like the rest of its checks (#2282)
• Un-deprecate extensions removed from the extension-control file (#2261)
• Report a namespace rename on the registry changes feed (#2246)
• Resolve extension resources for the target platform VS Code asks for (#2183)
• Scope the legacy token lookup to version-0 rows (#2247)
• Prevent duplicate active reviews from concurrent requests (#2245)
• Make extension control fail-safe and bound its HTTP timeouts (#2242)
• Delete upstream-proxied spool file even if the client aborts (#2241)
• Repair and stop re-corrupting extensions' stale last-updated date (#2231)
• Evict the local caches by key prefix too, instead of guessing (#2222)
• Evict caches once the transaction has committed (#2220)
• Clear extension caches by pattern where Redis can, as intended (#2219)
• Fix infinite recursion in entity equals/hashCode, namespace logo uploads to local storage, a malformed customer CIDR aborting the IP address cache rebuild, and the missing-files job on versions without a download file (#2189)

Dependencies

• Bump jOOQ from 3.19.37 to 3.19.39 (#2187, #2255)
• Update other dependencies to newer patch versions (#2255)
• Bump tika to 3.3.2 (#2240)
• Remove unused jaxb-api and jaxb-impl dependencies (#2317)

Web UI

Added

• Show the download size of each target platform's package next to its name on the extension detail page, from the new downloadSizes field of Extension (#367)
• Add an "Errors" tab to the scan admin page, where an admin can activate extension versions whose scan ended in an error that retrying cannot resolve. The Allowed Files and Blocked Files tabs move to positions 5 and 6, and their tab URL parameter values are unchanged (#2315)
• Add fine-grained admin permissions: a user can hold individual admin capabilities instead of the all-or-nothing admin role, and reaches the dashboard with only the pages those capabilities cover (#2269)
• Add an "Access Control" admin dashboard page, where a user's role and permissions are assigned together and applied on Save; both move here from Publisher admin (#2269)
• Export hasPermission and hasAnyAdminAccess, so a deployment with its own menu content can gate an admin entry the way the built-in menu does (#2269)
• Export useInView (with ViewportObserverContext to drive it in tests), useRegistryValue and useReportedQuery, so custom pages can defer work until visible, read server config and report query errors the way the built-in pages do (#2333)
• A contributed adminPages entry can declare the permission it needs; without one it stays admin-only, as it was while the whole dashboard required that role (#2269)
• Add a "Caches" page to the admin dashboard, with per-cache hit/eviction stats and a way to clear one or all without restarting the server (#2203)
• Add a "Download Analytics" page to the admin dashboard's Maintenance section, showing whether the analytics database is reachable, since when and why not, and how many log files wait for it (#2337)
• Add a weekly downloads card to the extension detail page, with a hoverable sparkline of the year's weekly totals (#2135)
• Add a configurable site banner to the admin dashboard's Settings page, with a Markdown message, severity, a live preview of what visitors will see and an opt-out for showing it again to everyone who dismissed it, served from /api/-/settings (#2256)
• Prompt anonymous visitors to log in on an extension's reviews tab, where "Write a Review" was previously blank (#2148)
• Add a default max extension size field to the admin dashboard's Settings page, backed by a new max-extension-size runtime setting; falls back to the server's configured ovsx.publishing.max-content-size until an admin sets it explicitly, and cannot be raised past the server's ovsx.publishing.max-override-size ceiling (#2129)
• Add a "Size overrides" page to the admin dashboard for managing per-namespace and per-extension upload size limits, each capped at the same ovsx.publishing.max-override-size ceiling (#2129)
• Add an Analytics section to the admin dashboard's Settings page, where an admin switches the weekly downloads card on extension pages on once the server has download analytics configured (#2340)
• Let a deployment add switches to the Settings page through PageSettings.elements.adminSettingsSections (#2340)
• Let a personal access token be restricted to a namespace or a single extension, and to publishing only, when it is generated, choosing the namespace from the ones the user is a member of and the extension from its active extensions, and show that in the token list (#957)
• Export ListLoadError, the inline warning with a Retry button the search results show when a page fails to load, for lists in custom pages (#2334)

Changed

• Breaking: AdminService.updateUserRole is replaced by updateUserAccess(provider, login, { role, permissions }), which writes a user's role and permissions as one state in one request against the new PUT /admin/user/{provider}/{login}/access endpoint (#2269)
• Removing an extension review follows the manage_extensions permission rather than the admin role, which admins hold either way (#2269)
• Return to the page a login started from, instead of always landing on the front page (#2148)
• Load an extension's icon only when it comes near the viewport, instead of every icon on the page at once (#2213)
• Group the admin dashboard's sidebar into Content, Search, Maintenance, Administration, Rate Limiting, and Analytics sections instead of one flat list. The first section starts expanded, as does whichever section holds the current page, whether opened directly or navigated to (#2278)
• Redesign the 404 page to match the new web UI, with a search field prefilled with the last segment of the requested path (#2299)
• Breaking: rename useRegisterPageSearchBar to useSearchBar(ref) (the ref is now required), which also takes / focus requests and gives focus back to the nav field when the bar leaves view (#2299)

Fixed

• Stop search results from re-requesting a page that failed to load in a loop, reopening the error dialog each time; a failed page, the first one included, now shows an inline notice with a Retry button instead of the dialog (#2334)
• Fix sendNonRetriableRequest and sendStrictRequest still retrying network errors and aborted requests three times (#2237)
• The publish page no longer refuses a package larger than the registry's default limit without asking the server. A namespace with a size override may publish more than the default allows, so the upload is now only blocked above the registry's ceiling — the largest any namespace could publish. A package that looks too big is shown in the queue while that ceiling is re-read, rather than the page staying empty until the answer arrives (#2129)
• The admin dashboard's Settings page sends only the settings that were changed, so saving no longer reverts a setting another admin changed while the page was open (#2129)
• The namespace details form no longer enables Save after a social handle is typed and then cleared, and now enables it when only the LinkedIn account type changes (#2314)

Removed

• Breaking: stop exporting SearchActionContext, filterFromParams, filterToParams, SEARCH_DEBOUNCE_MS and ExtensionHeaderInfo, internals the package root exposed by accident; useSearch reads and applies the search filter (#2333)

Dependencies

• Bump vitest from 4.1.11 to 5.0.3 (#2291)
• Bump vite from 8.2.1 to 8.3.2 (#2292)
• Bump ip-address from 10.4.0 to 10.7.2 (#2262)
• Bump undici from 8.9.0 to 8.11.2 (#2270)
• Bump markdown-it from 14.2.0 to 14.3.2 (#2272)
• Bump brace-expansion from 1.1.18 to 1.1.21, 2.1.7, 5.0.12
• Bump dompurify from 3.4.13 to 3.4.16 (#2280)
• Bump fast-uri from 3.1.7 to 3.1.8 (#2273)
• Pin the transitive node-gyp resolution to ^13.1.0 (from 12.2.0), which fsevents' optional dependency had resolved to latest (#2293)
• Bump source-map-js from 1.2.1 to 1.2.2 (#2311)
• Bump proxy-addr from 2.0.7 to 2.0.8 (#2312)
• Remove lodash and @types/lodash (#2314)
• Remove clipboard-copy in favor of the built-in navigator.clipboard.writeText (#2318)
• Remove react-infinite-scroller and @types/react-infinite-scroller; search results load the next page through an IntersectionObserver sentinel instead of a window scroll listener (#2321)