Aart van Baren

@filiptronicek > @amvanbaren are there any docs we should add for this after this is shipped? No, [the wiki](https://github.com/eclipse/openvsx/wiki/Deploying-Open-VSX#upstream-registry-instance) already has documentation about setting up an upstream instance. Upstream support...

@amtadev Can you verify that the vulnerabilities mentioned in #465 and #467 are fixed by this PR? Below you find the output of the `./gradlew dependencies` command: [dependencies-new.txt](https://github.com/eclipse/openvsx/files/8926171/dependencies-new.txt)

@amtadev I'm currently waiting on feedback, so that the current release can be deployed to production: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/1377 Once that release is deployed, then this (and other) PRs will be merged...

> The hierarchy-level-changing move of the mentioned tags makes sense if and only if the mentioned entries are not version-specific. (Are they?) Yes, the changes reflect the database model. The...

I've added the `/api/v3/-/query` endpoint. The response size is ~800 KB, so the `allVersions` entry contributes the most to the response size.

> > * **preview**: whether the extension is in preview mode. > > But that one _is_ version-specific. E.g. > Query URL preview > https://open-vsx.org/api/vscode/bat/1.62.3 false > https://open-vsx.org/api/vscode/bat/1.64.0-next.d9fa2b12136 true It...

> In fact, v4 has no allVersions (nor versionLinks) map even in unversioned queries without includeAllVersions. Conceptually that is OK with me, but this raises the question how to get...

The `download:plugins` logic calls: [140    const extension = await client.getLatestCompatibleExtensionVersion(id);](https://github.com/eclipse-theia/theia/blob/8ba808a0008714fdbbc9a596b8408b5c602eff43/dev-packages/cli/src/download-plugins.ts#L140) and `getLatestCompatibleExtensionVersion` calls: [119    const extensions = await this.getAllVersions(id);](https://github.com/eclipse-theia/theia/blob/8ba808a0008714fdbbc9a596b8408b5c602eff43/dev-packages/ovsx-client/src/ovsx-client.ts#L119) `this.getAllVersions(id);` calls the `/api/-/query?extensionId=&includeAllVersions=true` The API call returns 'full' extension objects for all...

Maybe the 'minimized' entries add to the confusion. I mean when `includeAllVersions=false` the response still contains multiple extension entries: one 'full' object and 'minimized' objects for all other versions. Instead...

> I suppose that `allVersions`should never be needed when `includeAllVersions=true`. (The `url` entries are better suited for that case.) So we do not need to make incongruent element layouts for...