v1.1.0

Various notable changes are included in this release:

• Upgrade to use Spring Boot 4
• Upgrade to use Vite 8 to build the frontend
• Redesign of the Web UI
• Support for immutable extension versions
• Add an endpoint to get a feed of extension changes (/api/-/version-changes)

This release of Open VSX consists of:

• ovsx CLI
• openvsx-webui frontend library
• openvsx-server Docker image
• openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

Upgrade Note:

Due to the upgrade to Spring Boot 4, Elasticsearch has also been bumped to 9.2.8 to match the included client library.
There is no direct upgrade possible from the previously used Elasticsearch version, but it can be done it 2 ways:

• completely recreate the Elasticsearch PVC to start from scratch, the index will be recreated on first start
• upgrade your existing Elasticsearch image to 8.9.x first which will then be upgraded automatically to 9.2.8.

What's Changed

🏕 Features

• feat: migrate admin pages to TanStack Query by @gnugomez in #1917
• fix: Add lower casing to namespace + extension name in cache keys by @netomi in #1924
• chore(webui): adding prettier by @gnugomez in #1916
• feat(admin): improve user management page by @gnugomez in #1847
• Fix: honor path-style-access parameter in S3Presigner by @netomi in #1928
• feat: Add a bulk publisher revocation endpoint by @autumnfound in #1860
• Chore: add OpenAPI annotations for all endpoints in AdminAPI by @netomi in #1931
• Chore: add more pre-commit hook for consistency of source files by @netomi in #1932
• Fix: normalize multiple slashes when detecting malicious zip files by @netomi in #1933
• Chore: upgrade to spring boot 4 by @netomi in #1925
• fix: serialize deleteExtension and publish with a pessimistic lock by @gnugomez in #1919
• Fix: correctly set http headers when uploading a file to AWS S3 by @netomi in #1929
• Add SBOM generation and upload workflow for webui and cli packages by @iliescuioana in #1640
• Fix search relevance by @amvanbaren in #1385
• chore(server): align jooq generated classes with DB schema by @cstamas in #1936
• chore: update brace-expansion to address CVE-2026-45149 by @vinokurig in #1944
• feat: add extension detail page for user-settings and admin dashboard by @netomi in #1939
• Drop PAT jOOQ repository by @cstamas in #1947
• Chore: some minor cleanups in jooq repositories by @netomi in #1948
• chore: move off guava; low hanging fruits by @cstamas in #1941
• fix: consolidating deletion logic in ExtensionService by @gnugomez in #1935
• feat: prevent oversized extension uploads from the client by @gnugomez in #1937
• fix: delete recurrent extension control job when disabled by @netomi in #1955
• fix: do not reactivate extension versions that have failed scans by @netomi in #1952
• fix: force parsson 1.1.8 to address CVE-2026-9563 by @vinokurig in #1960
• build(deps): update tar to 7.5.19 to address CVE-2026-59874 by @vinokurig in #1959
• Change: disable transitive delete of extensions in extension control by default by @netomi in #1951
• feat: reject namespace display names that collide with other namespaces by @gnugomez in #1957
• feat(cli): replace keytar with cross-keychain for token storage by @gnugomez in #1950
• feat: masking PAT in CLI and webui by @gnugomez in #1966
• chore: remove unused dep jsonpath by @netomi in #1970
• Task: Download test extensions by @cstamas in #1971
• Deps: patch updates by @cstamas in #1972
• feat: refreshing UX/UI by @gnugomez in #1938
• fix: resolve js-yaml to ^5.2.1 to address CVE-2026-59869 by @vinokurig in #1976
• fix: upgrade httpcore5 to 5.4.3 to address CVE-2026-54428 by @vinokurig in #1977
• Feat: Use JBang-fmt to format sources by @cstamas in #1945
• chore: upgrade to vite 8 by @netomi in #1989
• fix: normalize section margins by @gnugomez in #1990
• feat: refining the UI refresh implementation by @gnugomez in #1996
• chore: upgrade to react-router 7 by @gnugomez in #1997
• change: make extension versions immutable by @netomi in #1983
• fix: backspace is prevented if done fast by @gnugomez in #2005
• chore: agent operating rules and skills by @gnugomez in #2006
• feat: fail-fast the publication when missing permissions or duplicate version an retry on DataIntegrityViolations due to concurrent publications by @netomi in #2008
• feat: add --allow-missing-repository option to ovsx publish by @netomi in #2012
• doc(security): revise security vulnerability reporting instructions by @mbarbero in #2014
• fix: limit the maximum number of tags per extensin version by @netomi in #2009
• fix: correctly encode + chars in storage location URLs in case of AWS by @netomi in #2011
• change: ignore generated tags with __ prefix tag limit by @netomi in #2018
• feat: quarantine based on scanner malicious verdict by @janbro in #1991
• feat: adding changes feed api by @gnugomez in #1859
• chore: remove deprecated fields in ExtensionJson by @netomi in #2024
• fix(test): run MockMvc async handling inline to fix flaky StreamingResponseBody tests by @netomi in #2028

👒 Dependencies

• build(deps): bump jackson from 2.18.6 to 2.18.8 in /server by @dependabot[bot] in #1923
• build(deps): bump the github-actions group across 1 directory with 5 updates by @dependabot[bot] in #1940
• build(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #1962
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1979
• build(deps): bump brace-expansion from 1.1.13 to 1.1.16 in /cli by @dependabot[bot] in #1981
• build(deps): bump tar from 7.5.16 to 7.5.21 in /cli by @dependabot[bot] in #1987
• build(deps): bump dompurify from 3.4.11 to 3.4.12 in /webui by @dependabot[bot] in #1984
• build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in #1992
• build(deps): bump tar from 7.5.19 to 7.5.22 in /webui by @dependabot[bot] in #1994
• build(deps): bump brace-expansion from 1.1.16 to 1.1.18 in /cli by @dependabot[bot] in #2031

New Contributors

• @iliescuioana made their first contribution in #1640

Full Changelog: v1.0.2...v1.1.0