From 9a1b33bbfdafd5938fb49cd1b7d22923b88c8357 Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Mon, 2 Nov 2026 05:49:26 +0100
Subject: [PATCH] Reject signed major in plugin manifest api version string
 (#1853)

Found while testing crates/plugin/src/manifest.rs:70 (api_from_number_or_string, the Api::Text arm)

Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
---
 crates/plugin/src/manifest.rs | 1 +
 crates/plugin/src/tests.rs    | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/crates/plugin/src/manifest.rs b/crates/plugin/src/manifest.rs
index 6bca9aef2..269174e0f 100644
--- a/crates/plugin/src/manifest.rs
+++ b/crates/plugin/src/manifest.rs
@@ -77,6 +77,7 @@ fn api_from_number_or_string<'de, D: serde::Deserializer<'de>>(d: D) -> Result<u
             .trim()
             .split('.')
             .next()
+            .filter(|major| !major.is_empty() && major.bytes().all(|b| b.is_ascii_digit()))
             .and_then(|major| major.parse().ok())
             .ok_or_else(|| serde::de::Error::custom(format!("invalid api version `{s}`"))),
     }
diff --git a/crates/plugin/src/tests.rs b/crates/plugin/src/tests.rs
index 30311d802..3f5479081 100644
--- a/crates/plugin/src/tests.rs
+++ b/crates/plugin/src/tests.rs
@@ -472,3 +472,10 @@ fn api_may_be_a_version_string() {
     assert!(manifest(json!({"api": format!("{}.0.0", crate::API_VERSION + 1)})).is_err());
     assert!(manifest(json!({"api": "x"})).is_err());
 }
+
+#[test]
+fn api_version_string_rejects_signs() {
+    for bad in ["+2.0.0", "-1.0.0", "+2", ""] {
+        assert!(manifest(json!({"api": bad})).is_err(), "accepted {bad:?}");
+    }
+}