{"record":{"id":"a18e6b66154f435c","repo":"Kong/insomnia","slug":"extends-entry-entry-is-not-a-valid-spectral","errorCode":null,"errorMessage":"\"extends\" entry \"${entry}\" is not a valid spectral identifier, local path, or URL.","messagePattern":"\"extends\" entry \"(.+?)\" is not a valid spectral identifier, local path, or URL\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/insomnia/src/main/bundle-spectral-ruleset.ts","lineNumber":74,"sourceCode":"\n// Shallow-merges top-level keys from source into target.\n// Object values (e.g. \"rules\") are merged one level deep with source taking precedence.\n// Scalar values are overwritten by source.\nfunction mergeInto(target: Ruleset, source: Ruleset): void {\n  for (const key of Object.keys(source)) {\n    const sourceVal = source[key];\n    const targetVal = target[key];\n    target[key] = isPlainObject(targetVal) && isPlainObject(sourceVal) ? { ...targetVal, ...sourceVal } : sourceVal;\n  }\n}\n\n// Resolves an \"extends\" entry into a URL. When `base` is provided, relative paths are\n// resolved against it — used when processing extends entries inside a remote ruleset.\nfunction parseRemoteExtendsUrl(entry: string, base?: URL): URL {\n  try {\n    return new URL(entry, base);\n  } catch {\n    throw new Error(`\"extends\" entry \"${entry}\" is not a valid spectral identifier, local path, or URL.`);\n  }\n}\n\n// Rejects URLs that could be used for SSRF attacks:\n// - Must be https (no http, ftp, file, etc.)\n// - Hostname must not be a known private/loopback address\n// - DNS resolution must not yield a private/loopback address\nasync function assertSafeRemoteUrl(url: URL): Promise<void> {\n  const hostname = url.hostname.toLowerCase();\n  if (url.protocol !== 'https:') {\n    throw new Error(`Remote \"extends\" URL ${url.href} must use https`);\n  }\n  if (!hostname || isPrivateOrLoopbackHost(hostname)) {\n    throw new Error(`Remote \"extends\" URL targets a disallowed host: ${url.href}`);\n  }\n  // The literal hostname can still resolve to an internal address (e.g. *.localtest.me → 127.0.0.1).\n  const records = await dns.lookup(hostname, { all: true });\n  for (const { address } of records) {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/Kong/insomnia/blob/d9bb2b0142600f21309832daea3317942d285984/packages/insomnia/src/main/bundle-spectral-ruleset.ts#L56-L92","documentation":"Error \"\"extends\" entry \"${entry}\" is not a valid spectral identifier, local path, or URL.\" thrown in Kong/insomnia.","triggerScenarios":"Thrown at packages/insomnia/src/main/bundle-spectral-ruleset.ts:74 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9bb2b0142600f21309832daea3317942d285984","analyzedAt":"2026-08-26T18:04:05.187Z","schemaVersion":2},"datasetVersion":"2026-08-26T21:11:00.512Z"}