Plugin API versioned
Why it matters
Without a declared plugin API version, every host release is a potential silent breaking change for the entire plugin ecosystem. Plugins have no way to declare compatibility, so the host cannot warn before loading an incompatible plugin, and plugin authors have no signal to know which host version their code targets. ISO 25010 maintainability.modifiability requires that the impact of changes be assessable before they are made; API versioning is the mechanism that makes that assessment possible at the plugin-host boundary.
Severity rationale
High because an undeclared plugin API version prevents compatibility checking at load time, causing hook signature changes in host updates to break all installed plugins silently and without warning.
Remediation
Declare a PLUGIN_API_VERSION constant in the host and require plugins to specify their compatible version range in their manifest. Reject plugins at load time when the range is not satisfied.
// Host declares its API version:
export const PLUGIN_API_VERSION = '2.0.0';
// plugin.json:
{ "name": "my-plugin", "engines": { "host": "^2.0.0" } }
// Host checks on load:
if (!semver.satisfies(PLUGIN_API_VERSION, plugin.manifest.engines.host)) {
throw new PluginIncompatibleError(
plugin.name, plugin.manifest.engines.host, PLUGIN_API_VERSION
);
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Plugin / Extension Architecture Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.modifiability — Modifiability — versioned plugin API lets the host evolve without silently breaking installed plugins
Taxons
History
- 2026-04-18·v1.0.0·Initial import from plugin-extension-architecture·automated