This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

Server

Added

• Add fine-grained admin permissions (#2269)
• Configurable extension size limits with namespace overrides, bounded by ovsx.publishing.max-override-size (#2287, #2303)
• Backfill download events from access logs (#2228)
• Prompt anonymous visitors to log in on the reviews tab (#2148)
• Add a Caches page to the admin dashboard (#2203)
• Time-series download analytics, kept off extension pages until an admin switches them on, so a registry can backfill its download history first (#2134, #2340)
• Give download analytics its own time-series database; the registry starts and keeps serving while it is unreachable, and log files are kept until their events are stored (#2133, #2336)
• Scope personal access tokens to a namespace or an extension, and add publishing-only tokens (#2296)
• Publish a SettingsChangedEvent after the site settings change (#2316)
• Serve runtime settings a deployment registers as its own WritableSetting beans on /admin/settings, and on /api/-/settings when they are a PublicSetting, as camelCase properties named after their row keys (#2340)
• Expose the download size of each target platform as downloadSizes on the extension API response (#2168)
• Add a consistency check that finds and repairs extensions whose stored average rating or review count differs from their active reviews, see #2327 (#2328)
• Add GET /admin/analytics/status, which reports whether download analytics is enabled and reachable and how many log files wait for it, for the admin dashboard (#2337)
• Record the CI run behind a trusted-publishing upload when the token carries it: GitHub's job_workflow_ref, run_id and workflow_sha, GitLab's pipeline_id, job_id and sha (#2283)

Changed

• Upgrade: migration V1_78 makes extension_version.published_by_id NOT NULL and stops the server from starting if a row is still NULL. Versions published before 1.2.0 without a recorded token have no publisher to backfill, so check SELECT count(*) FROM extension_version WHERE published_by_id IS NULL returns 0 before upgrading (#2276)
• /vscode/gallery/extensionquery loads only the versions it returns instead of every active version of each matched extension, pre-releases included (#2161)
• Accept the personal access token via an Authorization: Bearer header (#2209)

Fixed

• Refuse the trusted publishing endpoints that create or delete a trusted publisher or issue a publish token while the registry is read-only (#2339)
• Match secret detection rules case-sensitively unless the rule has an inline (?i), which stops mixed-case words such as Asiakasdokumentaatio being flagged as AWS keys, see #2329 (#2330)
• Keep polling async scanners through transient errors, confirm an error status on a second poll before failing a scan, and treat every non-2xx scanner response as an error (#2307)
• Compare trusted-publishing claims case-insensitively, like the rest of its checks (#2282)
• Un-deprecate extensions removed from the extension-control file (#2261)
• Report a namespace rename on the registry changes feed (#2246)
• Resolve extension resources for the target platform VS Code asks for (#2183)
• Scope the legacy token lookup to version-0 rows (#2247)
• Prevent duplicate active reviews from concurrent requests (#2245)
• Make extension control fail-safe and bound its HTTP timeouts (#2242)
• Delete upstream-proxied spool file even if the client aborts (#2241)
• Repair and stop re-corrupting extensions' stale last-updated date (#2231)
• Evict the local caches by key prefix too, instead of guessing (#2222)
• Evict caches once the transaction has committed (#2220)
• Clear extension caches by pattern where Redis can, as intended (#2219)
• Fix infinite recursion in entity equals/hashCode, namespace logo uploads to local storage, a malformed customer CIDR aborting the IP address cache rebuild, and the missing-files job on versions without a download file (#2189)

Dependencies

• Bump jOOQ from 3.19.37 to 3.19.39 (#2187, #2255)
• Update other dependencies to newer patch versions (#2255)
• Bump tika to 3.3.2 (#2240)
• Remove unused jaxb-api and jaxb-impl dependencies (#2317)

Web UI

Added

• Show the download size of each target platform's package next to its name on the extension detail page, from the new downloadSizes field of Extension (#367)
• Add an "Errors" tab to the scan admin page, where an admin can activate extension versions whose scan ended in an error that retrying cannot resolve. The Allowed Files and Blocked Files tabs move to positions 5 and 6, and their tab URL parameter values are unchanged (#2315)
• Add fine-grained admin permissions: a user can hold individual admin capabilities instead of the all-or-nothing admin role, and reaches the dashboard with only the pages those capabilities cover (#2269)
• Add an "Access Control" admin dashboard page, where a user's role and permissions are assigned together and applied on Save; both move here from Publisher admin (#2269)
• Export hasPermission and hasAnyAdminAccess, so a deployment with its own menu content can gate an admin entry the way the built-in menu does (#2269)
• Export useInView (with ViewportObserverContext to drive it in tests), useRegistryValue and useReportedQuery, so custom pages can defer work until visible, read server config and report query errors the way the built-in pages do (#2333)
• A contributed adminPages entry can declare the permission it needs; without one it stays admin-only, as it was while the whole dashboard required that role (#2269)
• Add a "Caches" page to the admin dashboard, with per-cache hit/eviction stats and a way to clear one or all without restarting the server (#2203)
• Add a "Download Analytics" page to the admin dashboard's Maintenance section, showing whether the analytics database is reachable, since when and why not, and how many log files wait for it (#2337)
• Add a weekly downloads card to the extension detail page, with a hoverable sparkline of the year's weekly totals (#2135)
• Add a configurable site banner to the admin dashboard's Settings page, with a Markdown message, severity, a live preview of what visitors will see and an opt-out for showing it again to everyone who dismissed it, served from /api/-/settings (#2256)
• Prompt anonymous visitors to log in on an extension's reviews tab, where "Write a Review" was previously blank (#2148)
• Add a default max extension size field to the admin dashboard's Settings page, backed by a new max-extension-size runtime setting; falls back to the server's configured ovsx.publishing.max-content-size until an admin sets it explicitly, and cannot be raised past the server's ovsx.publishing.max-override-size ceiling (#2129)
• Add a "Size overrides" page to the admin dashboard for managing per-namespace and per-extension upload size limits...

Added

• Add a /publish page and turn the navbar's Publish button into a drop target: a file drag anywhere in the app turns the button into a drop area, and every .vsix package dropped on it — or on the publish page's own drop area — is queued and uploaded straight away, with no confirmation dialog. The page shows the queue as a line of extension cards — a skeleton while a package uploads, the real card once the registry accepts it, labelled with whatever the registry did with it — and keeps polling anything left under review or still missing its icon
• Export PublishButton, which carries the publish link, its p shortcut and the app's .vsix drop target in one component, so a deployment with its own menu content keeps drag-and-drop publishing
• Add a "Data Consistency" page to the admin dashboard (#1622): a live overview of every registered consistency check's finding count, with actions to refresh it and to fix findings one at a time or all at once
• Show a "Namespace not verified" state on an extension card when it can't be activated because its namespace already exists in a referenced external gallery and hasn't been verified, in both the "My Extensions" and namespace member extension lists. The card keeps its colour and takes a warning-toned frame and icon, since this is the publisher's to fix rather than an extension that is simply switched off
• Show a warning notice with a claim action wherever an unverified namespace is holding something back — the extension settings page when the extension has a namespace ownership conflict, and the namespace settings page for any unverified namespace — making clear the namespace must be claimed (verified) first. The action is the deployment's configured elements.claimNamespace, falling back to the namespace access documentation when none is configured. The admin dashboard's extension and namespace views show the same explanation without the claim action, since claiming is the publisher's action to take, not an admin's on someone else's behalf
• Add a "Search Index" page to the admin dashboard: which engine answers searches, how many extensions the index holds against how many it is built from, and a button to rebuild it where there is an index to rebuild. The two counts sit side by side because an index that has quietly lost entries answers searches perfectly well, just with nothing in them, which is indistinguishable from an empty registry unless both numbers are visible at once
• Mark a version that was published through a trusted publishing workflow with an icon next to "Published by" on the extension detail page, linking to the deployment's trusted publishing documentation. The default deployment points that link at the Trusted Publishing wiki page
• Add a Pill component — the clickable glass pill the category pills are built on, now usable on its own — and extract the MonoSlash, glassSurface and compactControl page primitives out of the search field, the pills and the search header
• Add userLoading to MainContext, so custom pages can tell "not logged in" from "still resolving the user"
• Add a userMenuContent slot to PageSettings.elements: extra entries for the logged-in account menu, rendered above the admin entry. The slot receives a MenuEntry component to build entries with, so each entry is styled by the menu it appears in — the desktop and mobile menus style theirs differently, and a consumer cannot match both on its own
• Add an adminPages slot to PageSettings.elements: extra admin dashboard pages, each declaring a name, icon, optional description and optional category, and each appearing in the side panel, as a card on the dashboard overview and as a route. Contributions are additive — a category name matching a built-in group appends to it, and a page whose path would shadow a built-in one is ignored
• Widen the published API for consumers building their own pages: the request layer (sendRequest, sendNonRetriableRequest, ErrorResponse, controllerFromSignal), MainContext, AppProviders, NotFound, createDefaultTheme with the MONO_FONT/NAVBAR_HEIGHT tokens, the createRoute/createAbsoluteURL/addQuery/formatCompactNumber/toRelativeTime utils, the useDebouncedCallback and useGridCursor hooks, the navbar-chrome, search-focus and page-search-bar hooks, the category icon helpers, ExtensionDetailRoutes, and the itemIcon/MenuItemText building blocks for userMenuContent entries

Changed

• Redesign the user settings: a sidebar (a pill strip below md) navigating profile, access tokens, trusted publishers, extensions and rate limiting, with the user's namespaces listed alongside it and each one deep-linkable at /user-settings/namespaces/:namespace. Every view is rebuilt on the cards, grids, placeholders and theme shape tokens the rest of the site uses, and the namespace detail is now a single component shared with the admin dashboard
• Revoking a single access token asks for confirmation first, like every other destructive action
• Present the unsigned publisher agreement on the access tokens page as a warning notice with a link to sign it, instead of a plain paragraph
• Mark a removed extension version in red across its row — version number, status pill and timeline dot — and disable its delete action. Every version of a rejected extension is marked too, and "Latest" is reserved for extensions the registry actually serves, so one that is inactive or removed has no version marked latest
• Publish from the navbar's Publish button, the p shortcut and the settings Extensions tab through the new publish page, replacing the one-file-at-a-time publish dialog
• Add an outlinedWarning style to MuiButton, so a warning-toned outlined button follows the theme like the secondary and error ones instead of MUI's default half-opacity border
• Breaking: elements.claimNamespace now receives { namespace, extension?, sx? } instead of { extension, sx? }. The namespace settings page offers the same claim action and has no extension to pass, so implementations must read the namespace from namespace rather than extension.namespace
• Publishing goes through TanStack Query: publishExtension and createNamespace are mutation hooks (usePublishExtension, useCreateNamespace), and both service methods lose their AbortController parameter — writes are no longer aborted, and retries are the query client's to own. The user's extension list is a query too (useUserExtensions), read by the settings tab and by the publish queue as it follows a package, so a card appears in the list as soon as the registry has the package
• ExtensionCard accepts an Extension as well as a SearchEntry, and takes optional to, linkState, overlay, footerStart, dimmed, tone and iconPending props so other surfaces can reuse it instead of copying it
• Show an extension card's rating as one star and the score rather than five stars, and no rating at all on an extension nobody has reviewed. Five icons could not shrink, so beside a long download count the count spilled out of the card
• Rename ScrollToTop to ScrollRestoration, matching what it does on back/forward navigation
• Rename the extension tint context to navbar-chrome-context and add a second channel to it: a page with sections pinned under the navbar can extend the navbar's blur fan down to back them (useExtendNavbarBlur)
• Give Popover and Autocomplete popups the same floating-paper treatment as the other menus, and stop Popovers locking body scroll — the lock jumps the scroll position on mobile and shifts the pinned chrome

Fixed

• Fix a React warning ("Received true for a non-boolean attribute notched") from the admin dashboard's publisher role filter, whose custom InputBase doesn't consume the notched prop MUI's Select injects for the (unused) outlined variant
• Fix the admin dashboard Scan tab getting stuck on the loading spinner after switching tabs, even though the new tab's data had already loaded successfully
• Fix the page jumping to the top whenever a menu, select or dialog opens.
• Fix the extension detail page's download menu so each target-platform option is clickable across its whole row, not just its text: the option was an inline link nested inside a non-interactive menu item, rather than the menu item itself being the link
• Fix sendRequest re-enabling fetch-retry's own retries for the request that follows a 429 wait, because the recursive call didn't forward the original retry flag. A sendStrictRequest/sendNonRetriableRequest call that hit a 429 could end up having its follow-up request retried twice - once by fetch-retry and once by the query client
• Fix the create-namespace dialog acting on Enter when its button is disabled: an empty or over-long name was submitted anyway, and a held key sent the request more than once
• Fix isError counting an empty error string as an error, and make it and isSuccess answer a null response body instead of throwing on it (typeof null === 'object'). The registry aggregates per-version outcomes when deleting extension versions, so a delete where every version succeeded answered with an empty error next to the success message - which raised an error dialog with nothing in it

Dependencies

• Remove the react-dropzone dependency; the publish page and the navbar's drop target handle their own drag events, and nothing else imports it
• Remove nine dependencies that nothing imports: clsx, prop-types and punycode from the runtime dependencies, and @types/d3-scale, @types/d3-shape, @types/prop-types, @types/punycode, @types/react-transition-group and ts-node from the development ones. All but @types/punycode and ts-node stay in the tree through MUI or the URL parsers that actually use them, so only those two leave the install
• Bump express from `4.22...

Added

• Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
• Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
• Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
• Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
• Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
• publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
• Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
• Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

• Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

• A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

• Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

• Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

• createNamespace, verifyPat, publish and delete now send the personal access token primarily via an Authorization: Bearer header (or, when OVSX_USERNAME/OVSX_PASSWORD are set, an X-OpenVSX-Token header, since Authorization is then already in use for Basic auth to a fronting proxy), moving away from a token query parameter that gets recorded in server and reverse-proxy access logs. The CLI checks the registry's reported version (/api/version) and only still sends the token as a query parameter, alongside the header, when talking to a registry older than 1.3.0, i.e. one that predates header support - including one whose version can't be determined at all, which is treated as too old rather than assumed to be caught up; on 1.3.0 and later the header is all it sends (#1344)
• publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
• publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
• Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

• Bump fast-uri from 3.1.5 to 3.1.7
• Bump qs from 6.15.2 to 6.16.0
• Bump @humanfs/node from 0.16.6 to 0.16.8
• Bump js-yaml from 4.3.1 to 4.3.2
• Bump nanoid from 3.3.16 to 3.3.18

This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

• fix: configure /openvsx context path for OpenShift deployment and fix test extension publish paths by @svor in #2080
• fix: get rid of most build warnings by @cstamas in #2085
• fix: clear scan admin loading spinner once fresh data lands after a tab switch by @netomi in #2084
• feat: Trusted Publishing support (#1980) by @netomi in #2000
• feat: add a Data Consistency admin page (#1622) by @netomi in #2086
• feat: add unpublish command to cli by @netomi in #2032
• feat: check max extension size in publish before uploading by @netomi in #2087
• feat: user settings overhaul by @gnugomez in #2091
• fix: limit decompressed size when serving vscode/unpkg web resources by @netomi in #2060
• feat: verified check scanner by @cstamas in #2074
• feat: store filesizes for each FileResource by @netomi in #2089
• Delete migration_item rows once their job completes by @netomi in #2092
• Tolerate missing storage objects in the file-size backfill by @netomi in #2094
• Backfill file sizes per extension version instead of per file resource by @netomi in #2095
• Throttle migration item scheduling to avoid crowding out real jobs by @netomi in #2096
• feat: some user-settings ajustments by @gnugomez in #2097
• fix: keep scroll position on scroll lock by @gnugomez in #2101
• refactor: clarify namespace vs. per-publisher verification checks by @netomi in #2103
• fix: guard scan recovery on startup with a Postgres advisory lock by @netomi in #2104
• refactor: remove unused methods from RepositoryService and repository layer by @netomi in #2105
• feat(cli): add verify and verify-signature commands by @netomi in #2107
• feat: detach tokens from extension versions by @cstamas in #2065
• chore: upgrade springdoc-openapi to 3.1.0 for Spring Data 4 compatibility by @netomi in #2112
• test: narrow the Spring context for tests that don't need the full application by @netomi in #2113
• Rework prerelease limit SQL by @cstamas in #2106
• feat: publish extensions overhaul by @gnugomez in #2098
• refactor: handle error results in sendStrictRequest by @gnugomez in #2109
• Trusted publishing changes by @netomi in #2114
• chore: remove unused methods from RepositoryService by @netomi in #2117
• fix: add /publish and /search to default frontend routes by @netomi in #2118
• chore: regenerate jooq classes by @netomi in #2119
• fix: read the real namespace and extension ids out of a lateral join by @netomi in #2120
• feat: add a search index page to the admin dashboard by @netomi in #2121
• fix: do not reference a one-time token from the version it published by @netomi in #2122
• fix: stop adding to the inverse versions collection when publishing by @netomi in #2123
• fix: keep a type on the rate limit headers under OpenAPI 3.1 by @netomi in #2124
• feat: let one trusted publishing token publish every target platform by @netomi in #2125
• fix: stop treating an empty error string as an error result by @gnugomez in #2128
• feat: limit TPT tokens to publishing only by @cstamas in #2127
• chore: replace the redis cluster in docker-compose with valkey by @netomi in #2140
• build: update Spring Boot to 4.0.8 by @netomi in #2141
• fix: keep generated token bodies free of - and _ by @netomi in #2142
• chore: add a Makefile for common development tasks by @netomi in #2144
• chore: remove codeql and sonar workflows by @netomi in #2147
• chore: drop the qs resolution and nine unused dependencies by @netomi in #2146
• feat: widen the webui library surface for consumers building their own pages by @netomi in #2130
• chore: add scripts to scrub and import partial db dumps by @netomi in #2110
• fix: align the Kubernetes ConfigMap with the Spring Boot 4 properties by @netomi in #2158
• refactor: call the access token hash secret a pepper, not a salt by @netomi in #2159
• feat(cli): add a show command by @netomi in #2153
• feat(cli): add search and list commands by @netomi in #2154
• refactor: stop using EntityManager.merge to obtain managed entities by @netomi in #2150
• refactor: replace the remaining EntityManager.merge updates with find by @netomi in #2151
• build(deps): bump js-yaml from 4.3.1 to 4.3.2 by @svor in #2160
• fix: default personal_access_token.version and .type by @netomi in #2166
• feat(cli): forward vsce's --follow-symlinks, and document the pnpm story by @netomi in #2169
• fix: stop signing a package from allocating several times its size by @netomi in #2170
• feat: add an admin statistics dashboard by @netomi in #2156
• fix: serve the public API's CORS headers whatever ovsx.webui.url says by @netomi in #2173
• chore: update spotless by @cstamas in #2176
• fix(webui): stop the download count spilling out of the extension card by @netomi in #2178
• feat: show what a search result's score is made of in the admin dashboard by @netomi in #2179
• feat: keep access tokens valid across a pepper change by @netomi in #2162
• tool: generate configuration properties reference by @cstamas in #2145
• fix: make the documented docker compose command work by @netomi in #2182
• fix(cli): resolve a download once the file is written, not when the response ends by @netomi in #2185
• fix(cli): give up on a request that stops making progress by @netomi in #2186
• fix: apply the search boosts the text query is written to apply by @netomi in #2174
• fix: weigh download counts on a log scale by @netomi in #2175
• docs: say that a comment should not recount the bug it fixed by @netomi in #2180
• fix: enforce the targetPlatform values the API documents by @netomi in #2181
• docs: move the deployment documentation into the repository by @netomi in #2191
• docs: split the configuration reference out of the deployment guide by @netomi in #2192
• build: check that doc/configuration.md documents the properties the server binds by @netomi in https://github....

Added

• Add a /publish page and turn the navbar's Publish button into a drop target: a file drag anywhere in the app turns the button into a drop area, and every .vsix package dropped on it — or on the publish page's own drop area — is queued and uploaded straight away, with no confirmation dialog. The page shows the queue as a line of extension cards — a skeleton while a package uploads, the real card once the registry accepts it, labelled with whatever the registry did with it — and keeps polling anything left under review or still missing its icon
• Export PublishButton, which carries the publish link, its p shortcut and the app's .vsix drop target in one component, so a deployment with its own menu content keeps drag-and-drop publishing
• Add a "Data Consistency" page to the admin dashboard (#1622): a live overview of every registered consistency check's finding count, with actions to refresh it and to fix findings one at a time or all at once
• Show a "Namespace not verified" state on an extension card when it can't be activated because its namespace already exists in a referenced external gallery and hasn't been verified, in both the "My Extensions" and namespace member extension lists. The card keeps its colour and takes a warning-toned frame and icon, since this is the publisher's to fix rather than an extension that is simply switched off
• Show a warning notice with a claim action wherever an unverified namespace is holding something back — the extension settings page when the extension has a namespace ownership conflict, and the namespace settings page for any unverified namespace — making clear the namespace must be claimed (verified) first. The action is the deployment's configured elements.claimNamespace, falling back to the namespace access documentation when none is configured. The admin dashboard's extension and namespace views show the same explanation without the claim action, since claiming is the publisher's action to take, not an admin's on someone else's behalf
• Add a "Search Index" page to the admin dashboard: which engine answers searches, how many extensions the index holds against how many it is built from, and a button to rebuild it where there is an index to rebuild. The two counts sit side by side because an index that has quietly lost entries answers searches perfectly well, just with nothing in them, which is indistinguishable from an empty registry unless both numbers are visible at once
• Mark a version that was published through a trusted publishing workflow with an icon next to "Published by" on the extension detail page, linking to the deployment's trusted publishing documentation. The default deployment points that link at the Trusted Publishing wiki page
• Add a Pill component — the clickable glass pill the category pills are built on, now usable on its own — and extract the MonoSlash, glassSurface and compactControl page primitives out of the search field, the pills and the search header
• Add userLoading to MainContext, so custom pages can tell "not logged in" from "still resolving the user"
• Add a userMenuContent slot to PageSettings.elements: extra entries for the logged-in account menu, rendered above the admin entry. The slot receives a MenuEntry component to build entries with, so each entry is styled by the menu it appears in — the desktop and mobile menus style theirs differently, and a consumer cannot match both on its own
• Add an adminPages slot to PageSettings.elements: extra admin dashboard pages, each declaring a name, icon, optional description and optional category, and each appearing in the side panel, as a card on the dashboard overview and as a route. Contributions are additive — a category name matching a built-in group appends to it, and a page whose path would shadow a built-in one is ignored
• Widen the published API for consumers building their own pages: the request layer (sendRequest, sendNonRetriableRequest, ErrorResponse, controllerFromSignal), MainContext, AppProviders, NotFound, createDefaultTheme with the MONO_FONT/NAVBAR_HEIGHT tokens, the createRoute/createAbsoluteURL/addQuery/formatCompactNumber/toRelativeTime utils, the useDebouncedCallback and useGridCursor hooks, the navbar-chrome, search-focus and page-search-bar hooks, the category icon helpers, ExtensionDetailRoutes, and the itemIcon/MenuItemText building blocks for userMenuContent entries

Changed

• Redesign the user settings: a sidebar (a pill strip below md) navigating profile, access tokens, trusted publishers, extensions and rate limiting, with the user's namespaces listed alongside it and each one deep-linkable at /user-settings/namespaces/:namespace. Every view is rebuilt on the cards, grids, placeholders and theme shape tokens the rest of the site uses, and the namespace detail is now a single component shared with the admin dashboard
• Revoking a single access token asks for confirmation first, like every other destructive action
• Present the unsigned publisher agreement on the access tokens page as a warning notice with a link to sign it, instead of a plain paragraph
• Mark a removed extension version in red across its row — version number, status pill and timeline dot — and disable its delete action. Every version of a rejected extension is marked too, and "Latest" is reserved for extensions the registry actually serves, so one that is inactive or removed has no version marked latest
• Publish from the navbar's Publish button, the p shortcut and the settings Extensions tab through the new publish page, replacing the one-file-at-a-time publish dialog
• Add an outlinedWarning style to MuiButton, so a warning-toned outlined button follows the theme like the secondary and error ones instead of MUI's default half-opacity border
• Breaking: elements.claimNamespace now receives { namespace, extension?, sx? } instead of { extension, sx? }. The namespace settings page offers the same claim action and has no extension to pass, so implementations must read the namespace from namespace rather than extension.namespace
• Publishing goes through TanStack Query: publishExtension and createNamespace are mutation hooks (usePublishExtension, useCreateNamespace), and both service methods lose their AbortController parameter — writes are no longer aborted, and retries are the query client's to own. The user's extension list is a query too (useUserExtensions), read by the settings tab and by the publish queue as it follows a package, so a card appears in the list as soon as the registry has the package
• ExtensionCard accepts an Extension as well as a SearchEntry, and takes optional to, linkState, overlay, footerStart, dimmed, tone and iconPending props so other surfaces can reuse it instead of copying it
• Show an extension card's rating as one star and the score rather than five stars, and no rating at all on an extension nobody has reviewed. Five icons could not shrink, so beside a long download count the count spilled out of the card
• Rename ScrollToTop to ScrollRestoration, matching what it does on back/forward navigation
• Rename the extension tint context to navbar-chrome-context and add a second channel to it: a page with sections pinned under the navbar can extend the navbar's blur fan down to back them (useExtendNavbarBlur)
• Give Popover and Autocomplete popups the same floating-paper treatment as the other menus, and stop Popovers locking body scroll — the lock jumps the scroll position on mobile and shifts the pinned chrome

Fixed

• Fix a React warning ("Received true for a non-boolean attribute notched") from the admin dashboard's publisher role filter, whose custom InputBase doesn't consume the notched prop MUI's Select injects for the (unused) outlined variant
• Fix the admin dashboard Scan tab getting stuck on the loading spinner after switching tabs, even though the new tab's data had already loaded successfully
• Fix the page jumping to the top whenever a menu, select or dialog opens.
• Fix the extension detail page's download menu so each target-platform option is clickable across its whole row, not just its text: the option was an inline link nested inside a non-interactive menu item, rather than the menu item itself being the link
• Fix sendRequest re-enabling fetch-retry's own retries for the request that follows a 429 wait, because the recursive call didn't forward the original retry flag. A sendStrictRequest/sendNonRetriableRequest call that hit a 429 could end up having its follow-up request retried twice - once by fetch-retry and once by the query client
• Fix the create-namespace dialog acting on Enter when its button is disabled: an empty or over-long name was submitted anyway, and a held key sent the request more than once
• Fix isError counting an empty error string as an error, and make it and isSuccess answer a null response body instead of throwing on it (typeof null === 'object'). The registry aggregates per-version outcomes when deleting extension versions, so a delete where every version succeeded answered with an empty error next to the success message - which raised an error dialog with nothing in it

Dependencies

• Remove the react-dropzone dependency; the publish page and the navbar's drop target handle their own drag events, and nothing else imports it
• Remove nine dependencies that nothing imports: clsx, prop-types and punycode from the runtime dependencies, and @types/d3-scale, @types/d3-shape, @types/prop-types, @types/punycode, @types/react-transition-group and ts-node from the development ones. All but @types/punycode and ts-node stay in the tree through MUI or the URL parsers that actually use them, so only those two...

Added

• Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
• Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
• Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
• Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
• Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
• publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
• Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
• Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

• Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

• A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

• Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

• Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

• publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
• publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
• Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

• Bump fast-uri from 3.1.5 to 3.1.7
• Bump qs from 6.15.2 to 6.16.0
• Bump @humanfs/node from 0.16.6 to 0.16.8
• Bump js-yaml from 4.3.1 to 4.3.2
• Bump nanoid from 3.3.16 to 3.3.18

This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

• fix(test): smoke tests broken by search UI redesign by @gnugomez in #2069
• feat: removing extension overview sidebar intermediate state by @gnugomez in #2072
• fix: restore response compression for VS Code Gallery API JSON responses by @netomi in #2073
• bug: consume request body before sending response by @cstamas in #2066
• feat: Add GDPR endpoint to openvsx admin API by @autumnfound in #1982
• build: Update check script by @cstamas in #2046
• Add SBOM generation workflows for docker, gradle and yarn by @lukpueh in #1999
• fix: handle non-absolute URLs in ExtensionValidator by @netomi in #2077

👒 Dependencies

• build(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #2063

New Contributors

• @lukpueh made their first contribution in #1999

Full Changelog: v1.1.1...v1.1.2

Added

• Add a "Forget user" action to the admin dashboard's publisher details, calling the GDPR erasure endpoint

Fixed

• Fix the extension overview sidebar overlapping the readme content at narrower ("tablet") window widths: there are now only mobile and desktop layouts, with tablet widths using the desktop layout (#2068)

This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

• fix: add validation for file resource name collisions by @netomi in #2036
• fix: use non-generic jackson serializers for various caches by @netomi in #2037
• fix: dependency detection on actual id rather by name alone by @netomi in #2038
• deps: Bump jOOQ to 3.19.37 by @cstamas in #2040
• Deps: Bump Jetty to 12.1.12 by @cstamas in #2043
• fix: review of the jooqRepository classes by @cstamas in #2044
• fix: make revoking of publisher contributions more resilient by @netomi in #2050
• fix: revert to jackson 2.x default behavior for primitives types by @netomi in #2052
• fix: restore custom error handling by @netomi in #2053
• fix: webui build on s390x and ppc64le by @netomi in #2054
• chore(deps): remove unused @mui/base dependency by @netomi in #2058
• fix: use jackson 2 compatible mapper for extensionquery by @netomi in #2061
• fix: cap pre-release versions returned by extensionQuery by @netomi in #2062

👒 Dependencies

• build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #2033
• build(deps): bump postcss from 8.5.22 to 8.5.25 in /webui by @dependabot[bot] in #2042
• build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /cli by @dependabot[bot] in #2041
• build(deps): bump dompurify from 3.4.12 to 3.4.13 in /webui by @dependabot[bot] in #2055
• build(deps): bump js-yaml from 4.3.0 to 4.3.1 in /cli by @dependabot[bot] in #2056

Full Changelog: v1.1.0...v1.1.1

Fixed

• Fix the WebUI build failing on s390x and ppc64le: use postcss instead of lightningcss (no ppc64le binary) for CSS, and bump vite for the Rolldown big-endian sourcemap fix (#2051)
• Fix the admin publisher revoke dialog prompting for an Eclipse login even when the target publisher's agreement status is none or could not be determined (nothing confirmed to revoke)

Dependencies

• Remove the unused @mui/base dependency; it is deprecated upstream (replaced by @base-ui/react) and nothing in the codebase imports from it
• Bump socks from 2.8.3 to 2.8.9
• Bump ip-address from 9.0.5 to 10.4.0
• Bump postcss from 8.5.22 to 8.5.25
• Bump vite from 8.1.5 to 8.2.1
• Bump dompurify from 3.4.12 to 3.4.13
• Bump js-yaml from 4.3.0 to 4.3.1
• Bump react-router from 7.18.1 to 7.18.2