change: make extension versions immutable by netomi · Pull Request #1983 · eclipse-openvsx/openvsx

netomi · 2026-07-22T11:28:44Z

This PR modifies the default behavior of the registry such that extension versions are immutable.

Deleting an extension version does not remove it from the database, but instead marks is as deleted so that the same version can not be published again. Extension files uploaded to the cloud storage are deleted, so it is not possible to undelete a version again.

Additionally, there is now a purge mechanism for admins to be able to remove extension versions completely from the database as well.

The UI has also been refactored to better display the status of extension versions.

This fixes #1805, #1956.

…ul namespace ui

cstamas · 2026-07-22T11:31:03Z

Supersedes #1866

netomi · 2026-07-22T11:34:06Z

This is how the extension admin page for an extension with deleted versions looks like:

netomi · 2026-07-22T11:50:37Z

The UI changes include various fixes that were existing, for example from the namespace admin page you were redirected to the user settings of the extension where you could not delete them as an admin. Another things was that it was not visible whether a version is active or not, so this is now also included so that as an admin you immediately see that without needing to query the DB.

The refactoring also make sure components that are used from the admin dashboard and user settings are now shared in src/components to make it cleaner.

…ions

netomi · 2026-07-22T12:56:46Z

I decided against an additional enum for the state to keep things as simple as possible as to focus on correctness and making sure we do not add any regression and fix the UI accordingly which was pretty much broken in this regard.

In a follow up step we should cleanup the different states an extension can be in, but this will take some time and we need to have the soft-delete as a basis for other work.

cstamas · 2026-07-22T12:59:20Z

re Backend changes: LGTM, one observation: extension_version table is now having 39 columns!

re Frontend changes: Ponytail remark:

webui/src/components/extension/extension-card-list-item.tsx:L153: delete: canDelete prop threaded through ExtensionCardList → NamespaceExtensionList → ExtensionCardListItem but never read in the leaf component's JSX. Drop the prop and its pass-through in extension-card-list.tsx:L20/L42, namespace-extension-list.tsx:L91/L105, user-settings-extensions.tsx:L89.

cstamas · 2026-07-22T13:18:16Z

I decided against an additional enum for the state to keep things as simple as possible as to focus on correctness and making sure we do not add any regression and fix the UI accordingly which was pretty much broken in this regard.

In a follow up step we should cleanup the different states an extension can be in, but this will take some time and we need to have the soft-delete as a basis for other work.

Yes, I wanted exactly to ask this, as perso, I liked more the "enum way" @gnugomez started with. Right now, we have two related boolean columns (there is clearly a logical dependency between the two; maybe even more) but are implemented as independent from each other.

netomi · 2026-07-22T13:34:50Z

The reason against an enum with state is that you need to have a state machine that ensures what transitions are possible or allowed. We certainly want a state for an extension to also cover cases like:

scan results
publisher agreement missing
... other cases you can imagine

but this is not something I would do light-heartily so I would like to postpone that to get the immutable version stuff in.

netomi · 2026-07-22T13:40:48Z

I know that 39 columns is bad, also considering that we use jooq and we need to explicitly select the columns we want to retrieve which is easy to miss. This is certainly an area that needs improvements and the reason why I am afraid to touch that code.

autumnfound

Java code generally LGTM, can't speak on the React code and I don't have capacity to test immediately. I don't love that we're as light as we are on tests since this is such an impactful change.

…deprecated test container

gnugomez · 2026-07-23T11:32:45Z

    public boolean isDeleteAllVersions(
            @Nullable UserData user,
            String namespaceName,
            String extensionName,
            TargetPlatformVersion... targetVersions
    ) {
        if (targetVersions.length == 0) {
            return true;
        }

        var all = dsl.select(DSL.count(EXTENSION_VERSION.ID).as("all"))
                .from(EXTENSION_VERSION)
                .join(EXTENSION).on(EXTENSION.ID.eq(EXTENSION_VERSION.EXTENSION_ID))
                .join(NAMESPACE).on(NAMESPACE.ID.eq(EXTENSION.NAMESPACE_ID))
                .and(NAMESPACE.NAME.equalIgnoreCase(namespaceName))
                .and(EXTENSION.NAME.equalIgnoreCase(extensionName))
                .fetchOne("all", Integer.class);


issue: I believe we have a bug here, basically when a user asks to delete all versions we run this query, but I see no modifications from you here, we need to make sure that the count we run here is skipping versions that have a remove = true tombstone

otherwise the the extension that bundles the versions trying to be removed will never be removed right?

is this intentional?

that was missed, ty for spotting.

It took me a while but I understand the problem now. The bug is that we need to check if this operation (either delete or purge) would remove all active versions of the extension which we would need to additionally check (are there other extensions depending on it).

at the same time I will also fix #1956 as we actually check if this extension is declared in a bundle and then prevent it from being deleted. Now this is not synchronous with publication as you can publish an extension that declares bundled extensions that do not exist also the IDEs usually handle that gracefully: if you install a bundle with non-existing extensions, they are just skipped.

…xtension should be purged, they are prohibited from uploaded again separately

change: make extension version immutable, add purge mechanism, overha…

5f5f737

…ul namespace ui

netomi requested review from cstamas and gnugomez July 22, 2026 11:28

fix smoke tests

32d4bce

netomi mentioned this pull request Jul 22, 2026

Implement endpoint to retrieve extension changes feed #1854

Open

netomi added 2 commits July 22, 2026 14:32

apply suggestions from review to safe-guard against soft-deleted vers…

3dc72f3

…ions

only return file urls for active versions

c867ab9

netomi requested a review from autumnfound July 22, 2026 12:57

cstamas approved these changes Jul 22, 2026

View reviewed changes

netomi added 2 commits July 22, 2026 15:42

fix view in marketplace button

6f0b67b

fix duplicate effect on namespace-extension-list

346fd59

netomi mentioned this pull request Jul 22, 2026

feat: implement soft-delete of extensions #1866

Closed

autumnfound reviewed Jul 22, 2026

View reviewed changes

add more tests

803a1ad

autumnfound approved these changes Jul 22, 2026

View reviewed changes

integration test improvements: share db container, use tags, replace …

227b6e6

…deprecated test container

gnugomez reviewed Jul 23, 2026

View reviewed changes

netomi added 5 commits July 23, 2026 15:03

remove unused parameter

4ca44ac

move method from AdminService to ExtensionService

0411cb2

adapt AdminAPI

42b00bc

rename methods used by extension control to match intent, malicious e…

9306820

…xtension should be purged, they are prohibited from uploaded again separately

do not check for bundles when deleting an extension

f6dc302

netomi added 2 commits July 23, 2026 18:15

fix test

85717b3

purge extension without checking dependencies in DataMirrorService

cff21cf

Uh oh!

Conversation

netomi commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cstamas commented Jul 22, 2026

Uh oh!

netomi commented Jul 22, 2026

Uh oh!

netomi commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netomi commented Jul 22, 2026

Uh oh!

cstamas commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cstamas commented Jul 22, 2026

Uh oh!

netomi commented Jul 22, 2026

Uh oh!

netomi commented Jul 22, 2026

Uh oh!

autumnfound left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gnugomez Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

netomi Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

netomi Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

netomi Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

netomi commented Jul 22, 2026 •

edited

Loading

netomi commented Jul 22, 2026 •

edited

Loading

cstamas commented Jul 22, 2026 •

edited

Loading

gnugomez Jul 23, 2026 •

edited

Loading