{"record":{"id":"a867bdc5264848b1","repo":"hashicorp/nomad","slug":"malformed-constraint-s","errorCode":null,"errorMessage":"Malformed constraint: %s","messagePattern":"Malformed constraint: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/constraints/semver/constraints.go","lineNumber":109,"sourceCode":"\t\tcsStr[i] = c.String()\n\t}\n\n\treturn strings.Join(csStr, \",\")\n}\n\n// Check tests if a constraint is validated by the given version.\nfunc (c *Constraint) Check(v *version.Version) bool {\n\treturn c.f(v, c.check)\n}\n\nfunc (c *Constraint) String() string {\n\treturn c.original\n}\n\nfunc parseSingle(v string) (*Constraint, error) {\n\tmatches := constraintRegexp.FindStringSubmatch(v)\n\tif matches == nil {\n\t\treturn nil, fmt.Errorf(\"Malformed constraint: %s\", v)\n\t}\n\n\tcheck, err := version.NewSemver(matches[2])\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &Constraint{\n\t\tf:        constraintOperators[matches[1]],\n\t\tcheck:    check,\n\t\toriginal: v,\n\t}, nil\n}\n\n//-------------------------------------------------------------------\n// Constraint functions\n//-------------------------------------------------------------------\n","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/constraints/semver/constraints.go#L91-L127","documentation":"parseSingle in the semver constraints package fails when a single constraint string does not match constraintRegexp, i.e. it is not of the form <operator><whitespace?><version>. The whole NewConstraint call returns this error without parsing anything. It is a pure input-syntax error on the caller-supplied constraint string.","triggerScenarios":"NewConstraint(\"~> 1.2\") or other operators unsupported by this regex; missing version (\">= \"); non-numeric versions (\">= v1.x\"); stray characters (\">=1.0.0!\"); splitting a compound constraint incorrectly so an empty or malformed token is parsed.","commonSituations":"Hand-written version pins in config files with typos; constraints copied from other ecosystems (e.g. Ruby's \"~>\" pessimistic operator) that hashicorp/go-version doesn't support; empty strings produced by splitting on \",\"; user-supplied constraint input not validated upstream.","solutions":["Inspect the %s in the message to find the offending token and correct its syntax: operator (>=, >, <, <=, =, ~>) immediately followed by a valid semver.","Validate the constraint string with a regex or NewConstraint in a dry-run before persisting or using it in config.","Check that version components are numeric and the version parses (cross-check with version.NewSemver).","Sanitize user-supplied constraint input and reject empty tokens before calling NewConstraint."],"exampleFix":"// before\nc, err := constraints.NewConstraint(\"~> 1.2\") // unsupported operator/version\n// after\nc, err := constraints.NewConstraint(\">= 1.2.0, < 2.0.0\")\nif err != nil {\n    return fmt.Errorf(\"invalid constraint %q: %w\", raw, err)\n}","handlingStrategy":"validation","validationCode":"var constraintRe = regexp.MustCompile(`^(>=|<=|>|<|=|~>)?\\s*v?\\d+(\\.\\d+){0,2}([-+].*)?$`)\nfunc validConstraint(s string) bool {\n    s = strings.TrimSpace(s)\n    if s == \"\" { return false }\n    return constraintRe.MatchString(s)\n}\n// usage:\nif !validConstraint(userInput) {\n    return fmt.Errorf(\"invalid constraint %q\", userInput)\n}","typeGuard":null,"tryCatchPattern":"c, err := constraints.NewConstraint(raw)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"Malformed constraint\") {\n        return fmt.Errorf(\"constraint %q is not valid syntax: %w\", raw, err)\n    }\n    return err\n}","preventionTips":["Only use operators supported by hashicorp/go-version: =, !=, >, <, >=, <=, ~> — not ecosystem-specific ones like Ruby's pessimistic pin without a valid version.","Always pair an operator with a valid numeric semver (no wildcards like 1.x).","Trim and validate user/config-supplied constraint strings before calling NewConstraint; reject empty tokens from comma-splitting.","Unit-test all constraint strings shipped in your config with NewConstraint at startup and fail fast."],"tags":["semver","parsing","validation","constraints"],"backgroundTag":"malformed-version-constraint","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}