Produce and Publish the set of vscode built in extensions

The "builtins" - What are they?

The "builtins", "built-ins" or "vscode builtin extensions" are a set of extensions that reside in the public vscode repository. Some of them provide the means to perform rule-based syntax highlighting, for code of a particular programming language. Others will provide advanced language support for a given language, including a Language Server, debug adapter, command/tasks contributions and more. Finally, some will provide potentially useful features, like various themes.

Every sub-folder is one built-in vscode extension:

https://github.com/microsoft/vscode/tree/main/extensions

They are built along and packaged, in the Visual Studio Code product as well as in products based on Code OSS and derivatives such as VSCodium. The built-in extensions are distributed as a part of their IDE product and are not made available separately, e.g. on the Visual Studio Marketplace.

Using the built-ins in Theia-based applications

In Theia-based application, there is a need to obtain some or all of the builtin extensions, ideally matching the version that the current application supports (i.e. vscode extensions API version that the underlying Theia version supports). The IDE author can include all built-in extensions by using the extension pack we publish along the extensions. Or they can curate the exact list of built-ins they want, and let the user install more later if needed. In theory they could decide to bundle no built-ins at all, if that fits their purpose.

In the Theia application's package.json, in section "theiaPlugins". Here's what it looks like in the example Theia application:

theiaPlugins": {
    "vscode.markdown-language-features": "https://open-vsx.org/api/vscode/markdown-language-features/1.64.2/file/vscode.markdown-language-features-1.64.2.vsix",
    "eclipse-theia.builtin-extension-pack": "https://open-vsx.org/api/eclipse-theia/builtin-extension-pack/1.70.2/file/eclipse-theia.builtin-extension-pack-1.70.2.vsix",
    "EditorConfig.EditorConfig": "https://open-vsx.org/api/EditorConfig/EditorConfig/0.14.4/file/EditorConfig.EditorConfig-0.14.4.vsix",
    "dbaeumer.vscode-eslint": "https://open-vsx.org/api/dbaeumer/vscode-eslint/2.1.20/file/dbaeumer.vscode-eslint-2.1.20.vsix"
  },

Producing

Publishing to openvsx.org

3PP IP / Security

3PP License Check

Eclipse Theia is an Eclipse Foundation project, we follow the Foundation's IP process regarding 3PPs (runtime dependencies as well as "build and test" dependencies, obtained from the public npm registry). See the Eclipse Foundation Project Handbook IP section for more details. We use dash-licenses to obtain (mostly) automated approval for the 3PP dependencies used to build the built-in extensions. This is done manually ATM, documented in details here

3PP Vulnerability Audit

At the moment this is only informational. This check uncovers known vulnerabilities in 3PP dependencies, in specific versions of dependencies, used by the current set of builtins. There used to be a lot when we were a couple of years late in producing a set of older built-ins. The portrait has recently improved a lot, because we have made rapid progress in supporting newer vscode extensions API versions. This means the vscode built-in extensions we produced recently are based on more recent packages, that have accumulated less vulnerability reports. When we catch-up and stay on top of new APIs as they are released, the built-in extensions we build will have close to zero vulnerabilities, in the moment when we produce and publish them, just like their twins that are part of the most recently released version of Visual Studio Code product.

See here for how to run yarn audit, for the full set of built-in extensions.