v2.4.2

Security

• Prevent relative, absolute, and symlinked paths in zip files from being able
  to break out of the extension directory root.

v2.4.1

Security

• Updated Go version to 1.24.11 to address a CVE.

Changed

• Update the Kubernetes Deployment spec.strategy.type field to be of type Recreate
  in order to properly handle upgrades/restarts as the default deployment creates a PVC
  of type ReadWriteOnce and could only be assigned to one replica.
• Expose the --verbose and --sign runtime parameters as Helm variables.

v2.4.0

Added

• Implement the new /api/vscode/{publisher}/{extension}/latest endpoint. This
  will fix issues where VS Code is unable to install extensions unless you
  explicitly provide the version.

v2.3.1

Changed

• Updated several dependencies with CVEs.

v2.3.0

Added

• Add empty signatures when starting the server with --sign. This will not work
  with VS Code on Windows and macOS as we do not have the key required, but it
  will work for open source versions of VS Code (VSCodium, code-server) and VS
  Code on Linux where signatures must exist but are not actually checked.

Changed

• Ignore extensions without a manifest. This is not expected in normal use, but
  could happen if, for example, a manifest temporarily failed to download, which
  would then crash the entire process with a segfault.

v2.2.1

Fixed

• The "attempt to download manually" URL in VS Code will now work.

v2.2.0

Changed

• Default max page size increased from 50 to 200.

Added

• New server sub-command flag --max-page-size for setting the max page size.

v2.1.0

Added

• New server sub-command flag --list-cache-duration for setting the duration
  of the cache used when listing/searching extensions. The default is still
  one minute.
• Local storage will also use a cache for listing and searching extensions
  (previously only Artifactory storage used a cache).

v2.0.1

Fixed

• Extensions with problematic UTF-8 characters will no longer cause a panic.
• Preview extensions will now show up as such.

v2.0.0

Breaking changes

• When removing extensions, the version is now delineated by @ instead of -
  (for example remove vscodevim.vim@1.0.0). This fixes being unable to remove
  extensions with - in their names. Removal is the only backwards-incompatible
  change; extensions are still added, stored, and queried the same way.

Added

• Support for platform-specific extensions. Previously all versions would have
  been treated as universal and overwritten each other but now versions for
  different platforms will be stored separately and show up separately in the
  API response. If there are platform-specific versions that have already been
  added, they will continue to be treated as universal versions so these should
  be removed and re-added to be properly registered as platform-specific.