warn-extension-version-pin

What triggers it

CREATE EXTENSION where the CreateExtensionStmt options don't include a new_version DefElem — i.e. no VERSION clause.

What does not

Statements with no extension name (ext?.extname missing), and any CREATE EXTENSION that already specifies VERSION '...'.

Where it applies

Applies to every PostgreSQL version MigrationPilot targets. It works on the SQL text alone — no database connection needed.

The lock, and what it blocks

None — this isn't about locking, it's about the migration installing a different extension version depending on which server it runs against.

Why it matters

Without a VERSION clause, CREATE EXTENSION installs the server default version, which can differ between environments. This makes migrations non-reproducible.

Unsafe, and safe

CREATE EXTENSION IF NOT EXISTS pgcrypto;

CREATE EXTENSION IF NOT EXISTS pgcrypto VERSION '1.3';

What it assumes

Assumes the extension's version matters for correctness — for an extension your team never upgrades, or where every environment runs from the same base image, the default and the pinned version are the same thing anyway. It flags every CREATE EXTENSION the same way regardless of whether that extension has ever shipped a breaking version bump.

What the CLI prints

⚠ [MP078] WARNING (line 1)
  CREATE EXTENSION "pgcrypto" without VERSION clause. Pin the version for reproducible migrations across environments.

  Safe alternative:
  CREATE EXTENSION IF NOT EXISTS "pgcrypto" VERSION '1.0';

  Why: Without a VERSION clause, CREATE EXTENSION installs the server's default version, which can differ between development, staging, and production environments. This makes migrations non-reproducible and can cause subtle behavior differences. Pinning the version ensures consistent behavior across all environments.
  Docs: https://migrationpilot.dev/rules/mp078

Generated by running the CLI's own formatter over the flagged example above, so it is the text the tool actually produces. A real run also reports the other rules that fire on the same statement; those blocks are left out here.

Turning it off

For one statement, put a comment on the line before it:

-- migrationpilot-disable MP078
CREATE EXTENSION IF NOT EXISTS pgcrypto;

For the whole project, in .migrationpilotrc.yml — by name or by id:

rules:
  MP078: false

# or keep it, and downgrade it
rules:
  MP078:
    severity: warning

Try it

Open this rule's flagged example in the playground. It runs in your browser — edit it and watch the finding appear and disappear.