From the design doc:

Both the frontend and the API, the latter by means of k6deps, should analyze scripts and reject those that import extensions, or that include version pragmas that would change the k6 version being used.