vscode-extension-update: skip Marketplace validation-failed versions

[cavebatsofware]

Description of changes

vscode_extension_update.py previously selected the newest extension version
satisfying targetPlatform, prerelease, and engine constraints, without
inspecting whether the Marketplace had validated it. Versions that fail
validation (for example virus scan failures) are hidden from the Marketplace
UI and should not be packaged.

This change adds a _version_passed_validation helper and filters such
entries in find_compatible_extension_version. When the Marketplace API
response sets validationResultMessage to a payload whose results contain
status: "failure", that version is skipped and the next compatible version
is considered.

Reproduced and verified against vscode-extensions.anthropic.claude-code,
where the API was returning a virus-scan-failed 2.1.146 entry while the
Marketplace UI still listed 2.1.145 as current. After the fix, the script
correctly falls back to 2.1.145.

Validation was manual: ran the updater against the affected extension and
confirmed it now selects 2.1.145, then ran nixos-rebuild switch against the
branch and built the resulting package successfully. No Nix files were
changed, and the updater has no test suite, so no automated tests apply.

Fixes #522773.
Relates to #482821.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.11 Release Notes are up to date with package changes in this PR
• Fits CONTRIBUTING.md

[drupol]

Cool, thanks for that! I added the security label, hope it's OK.

[drupol]

nixpkgs-review result

Generated using nixpkgs-review-gha

Command: nixpkgs-review pr 522775
Commit: d373280bd0305e6ddb993c34c11e267df89718c2 (subsequent changes)
Merge: 93227a8485b1206d2de3bebb65dea5d0659eacd0

Logs: https://github.com/drupol/nixpkgs-review-gha/actions/runs/26250322151

---

x86_64-linux

✅ 1 package built:

• vscode-extension-update

---

aarch64-linux

✅ 1 package built:

• vscode-extension-update

---

x86_64-darwin (sandbox = relaxed)

✅ 1 package built:

• vscode-extension-update

---

aarch64-darwin (sandbox = relaxed)

✅ 1 package built:

• vscode-extension-update

[drupol]

Approved automatically following the successful run of nixpkgs-review.

[cavebatsofware]

Cool, thanks for that!

@drupol
It should be noted that 2.1.146 (pkgs/application/editors/vscode/extensions/anthropic.claude-code/default.nix) is already merged for the vscode claude code extension. This is not yet a valid extension.

[drupol]

Should this be backported ? I haven't check whether this upgrade script is available in the current stable version.

[nixpkgs-ci]

Successfully created backport PR for release-25.11:

• [Backport release-25.11] vscode-extension-update: skip Marketplace validation-failed versions #522952