Recently, the monumental milestone of Open VSX 1.0 was celebrated, a release that solidified the project’s position as the leading vendor-neutral registry for VS Code extensions. The Open VSX project is excited to share the next step in that journey: the release of Open VSX 1.1.0 and subsequent 1.1.1 release just days after.
While version 1.0 was about maturity and community, the 1.1.x versions are about evolution and trust. These point releases introduce critical security enhancements, modernizes the underlying architecture, and begins a visual transformation of the Web UI—all while deepening the open-source mission that underpins every line of code in the project.
Modernizing the Core
To ensure Open VSX remains a high-performance, secure, and maintainable platform, there are some changes to upgrade core technology.
- Spring Boot 4 Migration: The server has been successfully migrated to Spring Boot 4. This move not only brings the service in line with the latest industry standards but also provides a more robust framework for handling the high traffic volumes the Managed Registry sees every day.
- Vite 8 for Frontend Build Tooling: On the client side, Vite 8 has been transitioned to for building the web interface. This change significantly streamlines development cycles and improves build performance, allowing features and security patches to be shipped faster.
A Fresh Vision for the Web UI
A powerful registry should also be an intuitive one. Version 1.1.0 rolls out the first phase of a Web UI redesign. This "modern touch" includes updated navigation, a redesigned home page composition, and a more accessible menu structure.
It is important to note that this is a work in progress. The user experience is being refined incrementally, and further enhancements will be delivered in subsequent releases. The goal is to create a seamless interface that serves everyone—from individual developers searching for tools to enterprise administrators managing extensions.
Strengthening Ecosystem Trust
Security and reliability are not just features; they are the foundation of trust in a developer marketplace. This release introduces two major changes to ensure that trust is maintained.
Immutable Extension Versions
One of the most significant shifts in 1.1.0 is the enforcement of immutable extension versions. Previously, the ability to re-publish the same version of an extension could potentially bypass security scans or lead to supply chain inconsistencies.
In this release, once a version is published, it cannot be modified. This ensures that the code you download today is exactly the code the publisher intended, providing a stable and verifiable supply chain for all users.
The Registry Changes Feed (Preview)
The release also introduces a new endpoint designed to empower security monitoring and mirroring tools: the Registry Changes Feed. Available in preview at /api/-/version-changes, this append-only log records all visible transitions of extension versions—including publications, deactivations, and removals.
A critical part of this feed is the refined handling of extension lifecycle states. A clear distinction between Delete and Purge has been introduced:
- Delete: A soft-delete operation where the extension version is no longer accessible but remains in the database to maintain the integrity of the change log.
- Purge: A hard-delete reserved for permanent data removal.
By distinguishing these actions, a robust and predictable feed is provided that third-party tools can use to monitor the registry for malicious activity or to keep mirrors in sync.
We’re excited about Open VSX 1.1.0, a strong foundation for an open, vendor-neutral extension registry. At the same time we continue to want your feedback on both the API and the registry website.
Get Started and Share Your Feedback
- Explore the Registry: Visit the updated interface at open-vsx.org.
- Review the API: Check out the new Changes Feed documentation.
- Join the Conversation: We welcome your thoughts on the new UI and the preview API features on GitHub.
Open VSX 1.1.0 is a community effort. A special thank you to Thomas Neidhart, Martin Lowe, Tamas Cservenak, Jordi Gómez Hidalgothe, Manpreet Kaur, Sridhar Ettkepalli, and the other contributors whose dedication made this release possible.
Contribute to Open VSX
Interested in shaping the future of Open VSX? We encourage you to join the project and contribute to our growing open source community. Your code, feedback, and engagement are what make this registry possible.
