Trusted publishing sync w/ main - #2064
Merged
gnugomez merged 33 commits intoAug 17, 2026
Merged
Conversation
…pse-openvsx#2031) * build(deps): bump brace-expansion from 1.1.16 to 1.1.18 in /cli Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/commits) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Update dependencies in CHANGELOG.md Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>
…envsx#2033) Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action), [docker/login-action](https://github.com/docker/login-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `github/codeql-action/init` from 4.37.1 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7188fc3...e4fba86) Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7188fc3...e4fba86) Updates `docker/login-action` from 4.4.0 to 4.5.1 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@af1e73f...abd2ef4) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…x#2036) * fix: add validation for file resource name collisions * chore: show all name collisions at once
…with existing practice (eclipse-openvsx#2037)
Locally checked the generated code, no diffs. Release notes: https://github.com/jOOQ/jOOQ/releases#release-version-3.19.37
…envsx#2042) * build(deps): bump postcss from 8.5.22 to 8.5.25 in /webui Bumps [postcss](https://github.com/postcss/postcss) from 8.5.22 to 8.5.25. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.22...8.5.25) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Update CHANGELOG.md Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>
…sx#2041) * build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /cli Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Update CHANGELOG.md Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>
This is a bugfix release. Release notes: https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.12
* fix: review of the jooqRepository classes Minor issues found that were fixed. None was a "bug", is more like style issues. * add test for ExtensionVersion jooq repository --------- Co-authored-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>
…-openvsx#2050) * fix: make revoking of publisher contributions more resilient * if no eclipse user is linked do not set any publisher agreement status * revert to none if no eclipse user is linked, fix tests
…ipse-openvsx#2052) * fix: revert to jackson 2.x default behavior for primitives types that have null values * add more tests
* fix: restore custom error handling * suppress exceptions resulting from client disconnections
Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>
…openvsx#2055) * build(deps): bump dompurify from 3.4.12 to 3.4.13 in /webui Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.12 to 3.4.13. - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.12...3.4.13) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Update CHANGELOG.md Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>
…x#2056) * build(deps): bump js-yaml from 4.3.0 to 4.3.1 in /cli Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Update CHANGELOG.md Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>
…vsx#2061) * fix: use jackson 2 compatible mapper for extensionquery * fix: address review comments on eclipse-openvsx#2061 - Sanitize and bound the Jackson parse-failure message before putting it into the ResponseStatusException reason: strip control characters/newlines and truncate to 200 chars, since it is derived from attacker-controlled input and Spring propagates the reason into the response status line. - Add a POST regression test for eclipse-openvsx#2059 (the actual reported incident), confirming the @RequestBody path fixed by JacksonConfig (eclipse-openvsx#2052) still works end-to-end with pageNumber missing from the sibling sortBy/sortOrder fields. - Add a test asserting the sanitized message is single-line and length bounded. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
…nvsx#2062) * fix: cap pre-release versions returned by extensionQuery extensionQuery (vscode/gallery/extensionquery) fetches every active version of every requested extension when FLAG_INCLUDE_VERSIONS or FLAG_INCLUDE_VERSION_PROPERTIES is set. For an extension whose pre-release channel publishes one build per commit, that history can grow into the thousands, making the query and response needlessly expensive. Regular releases are left untouched, but active pre-release versions are now capped to the most recent N per extension (combined across all of its target platforms), ranked by the same semver-based ordering ExtensionVersion.SORT_COMPARATOR uses for "latest" - so the true latest pre-release (rank #1) is never dropped by the cap. The cap is a plain method parameter threaded through LocalVSCodeService -> RepositoryService -> ExtensionVersionJooqRepository, configured via ovsx.extension-query.max-pre-release-versions (default 100). A negative value (e.g. -1) disables the cap entirely, matching the "negative means unlimited" convention already used for ovsx.data.mirror.requests-per-second. Adds coverage in ExtensionVersionJooqRepositoryTest for: capping while leaving stable releases untouched, capping across target platforms combined rather than per platform, the target-platform filter being applied after the cap, honouring a caller-supplied limit, and disabling the cap with a negative value. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: break pre-release rank ties by timestamp, then id Addresses a review comment on this PR: isAmongLatestPreReleases ranked pre-releases by (semver_major, semver_minor, semver_patch) alone. Two rows tied on that triple - the normal case, not an edge case, since the same version published across several target platforms shares one (major, minor, patch) by construction, and a pre-release channel that republishes without bumping semver ties too - neither outranks the other, so neither counts against the cap. Unbounded ties meant the cap could fail to cap at all for exactly the "one build per commit" pre-release channel this PR targets. Fall back to timestamp, matching ExtensionVersion.SORT_COMPARATOR and every DB sort index in this class, which already resolve same-semver ties that way. Add id as a final tiebreaker so the comparison is a strict total order, guaranteeing the cap keeps exactly min(limit, total) rows rather than "at least". Adds a regression test with 105 pre-release versions sharing one version string (only target platform and timestamp differ) that fails on the prior comparison (105 returned, uncapped) and passes with the fix (capped to 100, most recent one kept). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: default max-pre-release-versions to -1 (unlimited) Make the pre-release cap opt-in rather than on-by-default: -1 (disabled) preserves the exact pre-existing, uncapped behaviour out of the box. Operators who want the cap set ovsx.extension-query.max-pre-release-versions explicitly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
As DDL on main drifted from TP
gnugomez
approved these changes
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sync with main and apply needed changes as DDL from TP and main are different.
The PR contains a change to GH Action workflow as well, as PRs are currently built only against
mainbranch.