This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

• fix: add validation for file resource name collisions by @netomi in #2036
• fix: use non-generic jackson serializers for various caches by @netomi in #2037
• fix: dependency detection on actual id rather by name alone by @netomi in #2038
• deps: Bump jOOQ to 3.19.37 by @cstamas in #2040
• Deps: Bump Jetty to 12.1.12 by @cstamas in #2043
• fix: review of the jooqRepository classes by @cstamas in #2044
• fix: make revoking of publisher contributions more resilient by @netomi in #2050
• fix: revert to jackson 2.x default behavior for primitives types by @netomi in #2052
• fix: restore custom error handling by @netomi in #2053
• fix: webui build on s390x and ppc64le by @netomi in #2054
• chore(deps): remove unused @mui/base dependency by @netomi in #2058
• fix: use jackson 2 compatible mapper for extensionquery by @netomi in #2061
• fix: cap pre-release versions returned by extensionQuery by @netomi in #2062

👒 Dependencies

• build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #2033
• build(deps): bump postcss from 8.5.22 to 8.5.25 in /webui by @dependabot[bot] in #2042
• build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /cli by @dependabot[bot] in #2041
• build(deps): bump dompurify from 3.4.12 to 3.4.13 in /webui by @dependabot[bot] in #2055
• build(deps): bump js-yaml from 4.3.0 to 4.3.1 in /cli by @dependabot[bot] in #2056

Full Changelog: v1.1.0...v1.1.1

Fixed

• Fix the WebUI build failing on s390x and ppc64le: use postcss instead of lightningcss (no ppc64le binary) for CSS, and bump vite for the Rolldown big-endian sourcemap fix (#2051)
• Fix the admin publisher revoke dialog prompting for an Eclipse login even when the target publisher's agreement status is none or could not be determined (nothing confirmed to revoke)

Dependencies

• Remove the unused @mui/base dependency; it is deprecated upstream (replaced by @base-ui/react) and nothing in the codebase imports from it
• Bump socks from 2.8.3 to 2.8.9
• Bump ip-address from 9.0.5 to 10.4.0
• Bump postcss from 8.5.22 to 8.5.25
• Bump vite from 8.1.5 to 8.2.1
• Bump dompurify from 3.4.12 to 3.4.13
• Bump js-yaml from 4.3.0 to 4.3.1
• Bump react-router from 7.18.1 to 7.18.2

Dependencies

• Bump ip-address from 10.2.0 to 10.4.0
• Bump fast-uri from 3.1.4 to 3.1.5
• Bump js-yaml from 4.3.0 to 4.3.1

Various notable changes are included in this release:

• Upgrade to use Spring Boot 4
• Upgrade to use Vite 8 to build the frontend
• Redesign of the Web UI
• Support for immutable extension versions
• Add an endpoint to get a feed of extension changes (/api/-/version-changes)

This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

Upgrade Note:

Due to the upgrade to Spring Boot 4, Elasticsearch has also been bumped to 9.2.8 to match the included client library.
There is no direct upgrade possible from the previously used Elasticsearch version, but it can be done it 2 ways:

• completely recreate the Elasticsearch PVC to start from scratch, the index will be recreated on first start
• upgrade your existing Elasticsearch image to 8.9.x first which will then be upgraded automatically to 9.2.8.

What's Changed

🏕 Features

• feat: migrate admin pages to TanStack Query by @gnugomez in #1917
• fix: Add lower casing to namespace + extension name in cache keys by @netomi in #1924
• chore(webui): adding prettier by @gnugomez in #1916
• feat(admin): improve user management page by @gnugomez in #1847
• Fix: honor path-style-access parameter in S3Presigner by @netomi in #1928
• feat: Add a bulk publisher revocation endpoint by @autumnfound in #1860
• Chore: add OpenAPI annotations for all endpoints in AdminAPI by @netomi in #1931
• Chore: add more pre-commit hook for consistency of source files by @netomi in #1932
• Fix: normalize multiple slashes when detecting malicious zip files by @netomi in #1933
• Chore: upgrade to spring boot 4 by @netomi in #1925
• fix: serialize deleteExtension and publish with a pessimistic lock by @gnugomez in #1919
• Fix: correctly set http headers when uploading a file to AWS S3 by @netomi in #1929
• Add SBOM generation and upload workflow for webui and cli packages by @iliescuioana in #1640
• Fix search relevance by @amvanbaren in #1385
• chore(server): align jooq generated classes with DB schema by @cstamas in #1936
• chore: update brace-expansion to address CVE-2026-45149 by @vinokurig in #1944
• feat: add extension detail page for user-settings and admin dashboard by @netomi in #1939
• Drop PAT jOOQ repository by @cstamas in #1947
• Chore: some minor cleanups in jooq repositories by @netomi in #1948
• chore: move off guava; low hanging fruits by @cstamas in #1941
• fix: consolidating deletion logic in ExtensionService by @gnugomez in #1935
• feat: prevent oversized extension uploads from the client by @gnugomez in #1937
• fix: delete recurrent extension control job when disabled by @netomi in #1955
• fix: do not reactivate extension versions that have failed scans by @netomi in #1952
• fix: force parsson 1.1.8 to address CVE-2026-9563 by @vinokurig in #1960
• build(deps): update tar to 7.5.19 to address CVE-2026-59874 by @vinokurig in #1959
• Change: disable transitive delete of extensions in extension control by default by @netomi in #1951
• feat: reject namespace display names that collide with other namespaces by @gnugomez in #1957
• feat(cli): replace keytar with cross-keychain for token storage by @gnugomez in #1950
• feat: masking PAT in CLI and webui by @gnugomez in #1966
• chore: remove unused dep jsonpath by @netomi in #1970
• Task: Download test extensions by @cstamas in #1971
• Deps: patch updates by @cstamas in #1972
• feat: refreshing UX/UI by @gnugomez in #1938
• fix: resolve js-yaml to ^5.2.1 to address CVE-2026-59869 by @vinokurig in #1976
• fix: upgrade httpcore5 to 5.4.3 to address CVE-2026-54428 by @vinokurig in #1977
• Feat: Use JBang-fmt to format sources by @cstamas in #1945
• chore: upgrade to vite 8 by @netomi in #1989
• fix: normalize section margins by @gnugomez in #1990
• feat: refining the UI refresh implementation by @gnugomez in #1996
• chore: upgrade to react-router 7 by @gnugomez in #1997
• change: make extension versions immutable by @netomi in #1983
• fix: backspace is prevented if done fast by @gnugomez in #2005
• chore: agent operating rules and skills by @gnugomez in #2006
• feat: fail-fast the publication when missing permissions or duplicate version an retry on DataIntegrityViolations due to concurrent publications by @netomi in #2008
• feat: add --allow-missing-repository option to ovsx publish by @netomi in #2012
• doc(security): revise security vulnerability reporting instructions by @mbarbero in #2014
• fix: limit the maximum number of tags per extensin version by @netomi in #2009
• fix: correctly encode + chars in storage location URLs in case of AWS by @netomi in #2011
• change: ignore generated tags with __ prefix tag limit by @netomi in #2018
• feat: quarantine based on scanner malicious verdict by @janbro in #1991
• feat: adding changes feed api by @gnugomez in #1859
• chore: remove deprecated fields in ExtensionJson by @netomi in #2024
• fix(test): run MockMvc async handling inline to fix flaky StreamingResponseBody tests by @netomi in #2028

👒 Dependencies

• build(deps): bump jackson from 2.18.6 to 2.18.8 in /server by @dependabot[bot] in #1923
• build(deps): bump the github-actions group across 1 directory with 5 updates by @dependabot[bot] in #1940
• build(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #1962
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1979
• build(deps): bump brace-expansion from 1.1.13 to 1.1.16 in /cli by @dependabot[bot] in #1981
• build(deps): bump tar from 7.5.16 to 7.5.21 in /cli by @dependabot[bot] in #1987
• build(deps): bump dompurify from 3.4.11 to 3.4.12 in /webui by @dependabot[bot] in #1984
• build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in #1992
• build(deps): bump tar from 7.5.19 to 7.5.22 in /webui by @dependabot[bot] in #1994
• build(deps): bump brace-expansion from 1.1.16 to 1.1.18 in /cli by @dependabot[bot] in #2031

New Contributors

• @iliescuioana made their first contribution in #1640

Full Changelog: v1.0.2...v1.1.0

Added

• Add a home page with hero search, popular searches, a category browser, curated extension rows and get-involved cards
• Add a dedicated search page under /search with query, category, sort field and sort order synced to the URL
• Add global keyboard shortcuts
• Add keyboard navigation of search results: ↑/↓
• Add a structured footer
• Add scroll-to-top on forward navigation
• Support searching users and managing their roles in the admin dashboard (#1847)
• Added an extension details page to admin dashboard and user settings (#1939)

Changed

• Redesign the web UI: new navbar with integrated search field, new theme, extension cards, category pills and page layout
• Consolidate the app-wide providers into a single AppProviders; keyboard shortcuts and search now wrap every route, including the admin dashboard
• Improve accessibility: visible focus outlines on interactive controls
• Morph the hero search into the navbar search field using the View Transitions API
• Token display in generate-token dialog now uses a masked input with show/hide toggle and copy button (#1966
• Migrate admin dashboard to use @tanstack/react-query (#1917
• Replace formatting from stylistic with prettier (#1916)
• Upgrade to vite 8+ and disable manual chunks for bundling (#1989)
• Upgrade to react-router 7: import everything from react-router instead of react-router-dom. Consumers passing additionalRoutes must upgrade to react-router 7 as well

Fixed

• Refresh the extension version list in the delete views when a delete fails with a conflict
• Keep the hero-to-navbar search morph working under react-router 7, which wraps location updates in React.startTransition

Dependencies

• Bump brace-expansion from 1.1.11 to 1.1.16 (#1981)
• Bump brace-expansion from 2.0.2 to 2.1.2 (#1944)
• Bump brace-expansion from 5.0.3 to 5.0.7 (#1944)
• Bump tar from 7.5.16 to 7.5.22 (#1994)
• Bump js-yaml from 4.2.0 to 4.3.0 (#1976)
• Bump dompurify from 3.4.11 to 3.4.12 (#1984)
• Bump react-router from 6.30.4 to 7.18.1
• Remove react-router-dom and its stale @types/react-router-dom v5 typings

Added

• Add an encrypted filestore as fallback to the system keychain if it cant be accessed (#1950)
• Add --allow-missing-repository option to the publish command, passed on to vsce to package an extension whose package.json has no repository field without asking for confirmation (#1735)

Changed

• Replace keytar with cross-keychain to store credentials in the system keychain (#1950)
• Mask token input when using login command (#1966

Dependencies

• Bump js-yaml from 4.2.0 to 4.3.0 (#1976)
• Bump tar from 7.5.16 to 7.5.21 (#1987)
• Bump brace-expansion from 1.1.16 to 1.1.18 (#2031)

This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

• Change: switch from mocha to vitest by @netomi in #1914
• Change: add check for unsafe paths to MaliciousZipCheckService by @netomi in #1915
• Fix: add consistent and strict http headers when serving files inside extensions by @netomi in #1922

👒 Dependencies

• build(deps): bump tmp from 0.2.6 to 0.2.7 in /cli by @dependabot[bot] in #1903
• build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #1902
• build(deps): bump tar from 7.5.11 to 7.5.16 in /webui by @dependabot[bot] in #1907
• build(deps): bump js-yaml from 4.1.1 to 4.2.0 in /webui by @dependabot[bot] in #1908
• build(deps-dev): bump vite from 7.3.2 to 7.3.5 in /webui by @dependabot[bot] in #1905
• build(deps): bump dompurify from 3.4.0 to 3.4.9 in /webui by @dependabot[bot] in #1906
• build(deps): bump markdown-it from 14.1.1 to 14.2.0 in /webui by @dependabot[bot] in #1904
• build(deps): bump tar from 7.5.11 to 7.5.16 in /cli by @dependabot[bot] in #1911
• build(deps): bump @babel/core from 7.29.0 to 7.29.7 in /webui by @dependabot[bot] in #1909
• build(deps): bump form-data from 4.0.4 to 4.0.6 in /cli by @dependabot[bot] in #1910
• build(deps): bump js-yaml from 4.1.1 to 4.2.0 in /cli by @dependabot[bot] in #1912
• build(deps): bump markdown-it from 14.1.1 to 14.2.0 in /cli by @dependabot[bot] in #1913
• build(deps): bump dompurify from 3.4.10 to 3.4.11 in /webui by @dependabot[bot] in #1920
• build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #1921

Full Changelog: v1.0.1...v1.0.2

Changed

• Migrate unit test framework from mocha to vitest

Dependencies

• Bump tar from 7.5.11 to 7.5.16 (#1907)
• Bump js-yaml from 4.1.1 to 4.2.0 (#1908)
• Bump vite from 7.3.2 to 7.3.5 (#1905)
• Bump dompurify from 3.4.0 to 3.4.11 (#1920)
• Bump markdown-it from 14.1.1 to 14.2.0 (#1904)
• Bump @babel/core from 7.29.0 to 7.29.7 (#1909)

Dependencies

• Bump tmp from 0.2.6 to 0.2.7 (#1903)
• Bump tar from 7.5.11 to 7.5.16 (#1911)
• Bump form-data from 4.0.4 to 4.0.6 (#1910)
• Bump js-yaml from 4.1.1 to 4.2.0 (#1912)
• Bump markdown-it from 14.1.1 to 14.2.0 (#1913)

This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

• Fix: evict all relevant caches when deleting an extension by @netomi in #1890
• Fix: add validation for size/offset parameters for various endpoints by @netomi in #1892
• Fix: properly encode path segments in getUrl by @netomi in #1893
• chore: Update to Gradle 9.5.1 by @cstamas in #1894
• chore(deps): bump qs and react-router by @netomi in #1897

👒 Dependencies

• build(deps): bump the github-actions group across 1 directory with 5 updates by @dependabot[bot] in #1888
• chore(deps): pin opentelemetry version to 1.63.0 by @vinokurig in #1899
• chore(deps): bump netty to 4.1.135.Final by @netomi in #1900

New Contributors

• @cstamas made their first contribution in #1894

Full Changelog: v1.0.0...v1.0.1