Harden external plugin validation: semver, SPDX, email, and unknown-field checks - #2445

Merged

aaronpowell merged 8 commits into

mainfrom

aaronpowell-external-plugin-spec-hardening

Jul 30, 2026

Commits on Jul 27, 2026

Harden external plugin validation: semver, SPDX, email, unknown fields

aaronpowell
and
Copilot
committed
Make license non-SPDX a warning and share license check with local plugins

aaronpowell
and
Copilot
committed

Commits on Jul 28, 2026

Extract shared license validation into eng/lib/license.mjs

aaronpowell
and
Copilot
committed
Fix SPDX license parsing correctness and warning-message injection

aaronpowell
and
Copilot
committed