The validation of grafanaDependency uses a regex pattern that is too strict

[darrenjaneczek]

See:

• plugin-validator/config/plugin.schema.json

  Line 173 in 762a056

  "pattern": "^(<=|>=|<|>|=|~|\\^)?([0-9]+)(\\.[0-9x\\*]+)(\\.[0-9x\\*]+)?(\\s(<=|>=|<|=>)?([0-9]+)(\\.[0-9x]+)(\\.[0-9x]+))?(\\-[0-9]+)?$"

This pattern:
^(<=|>=|<|>|=|~|\\^)?([0-9]+)(\\.[0-9x\\*]+)(\\.[0-9x\\*]+)?(\\s(<=|>=|<|=>)?([0-9]+)(\\.[0-9x]+)(\\.[0-9x]+))?(\\-[0-9]+)?$
does not permit more complicated, but valid, semantic version ranges such as:

• >= 10.4.10 < 11 || >= 11.1.0

Options:

• Remove the pattern, and allow any string for this field
  • fix: remove strict pattern on grafanaDependency #280
• Attempt to build a new mechanism to evaluate the validity of the semver range
  • Perhaps a different kind of validation layer can be added to this that makes use of some javascript code and the semver library itself.

Background:

While building an urgent patch for the GEL Plugin (https://github.com/grafana/gex-plugins) for a customer POC, our build process spontaneously failed due to a change of plugin-validator where a strict pattern for grafanaDependency is required to pass. The gex-plugins currently use >= 10.4.10 < 11 || >= 11.1.0 to specify the officially supported range. This is a valid semver, but the pattern used in the schema for grafanaDependency does not allow for spaces, multiple operators, or multiple ranges separated by ||.

To work around this issue, I had to disable this check altogether. In order to proceed, I will need to know which path the plugin-validator is choosing to take so I can respond accordingly.

• A. Keep this regex
• B. Remove this regex
• C. Remove this regex for now and later replace it with true semver test

If the choice is A, I will have to alter the officially supported version range in gex-plugins, or find a way to disable this strict check without also disabling overall plugin-validation.

See:

• https://raintank-corp.slack.com/archives/C01C4K8DETW/p1731326942187249?thread_ts=1731093846.187719&cid=C01C4K8DETW

[darrenjaneczek]

@mckn, I have taken @academo's advice and disabled the plugin schema analyzer so that our build would succeed. It seems our project has bigger problems than just the dependency expression -- our plugin id is also "in violation."

The solution I went with is here:

• fix: remove strict pattern on grafanaDependency #280 (comment)