crowdsecurity/crowdsec · error

%s: %w

Error message

%s: %w

What it means

sortedVersions converts raw version strings from a hub item's version metadata into semver.Version values so it can sort them newest-first. If any string is not valid semantic version (semver.NewVersion fails), sorting cannot proceed and the raw string is wrapped into this error. detectVersionFromHash calls it when matching an installed file's hash against known item versions.

Source

Thrown at pkg/cwhub/sync.go:156

	targetInHub, err := isPathInside(spec.target, hubDir)
	if err != nil {
		return nil, ErrSkipPath
	}

	spec.local = !targetInHub

	return spec, nil
}

// sortedVersions returns the input data, sorted in reverse order (new, old) by semver.
func sortedVersions(raw []string) ([]string, error) {
	vs := make([]*semver.Version, len(raw))

	for idx, r := range raw {
		v, err := semver.NewVersion(r)
		if err != nil {
			// TODO: should catch this during index parsing
			return nil, fmt.Errorf("%s: %w", r, err)
		}

		vs[idx] = v
	}

	sort.Sort(sort.Reverse(semver.Collection(vs)))

	ret := make([]string, len(vs))
	for idx, v := range vs {
		ret[idx] = v.Original()
	}

	return ret, nil
}

func newLocalItem(h *Hub, path string, spec *itemSpec) (*Item, error) {
	type localItemName struct {
		Name string `yaml:"name"`

View on GitHub (pinned to 909b515798)

Solutions

1. Run 'cscli hub update' (and 'cscli hub upgrade') to get a corrected index from upstream
2. Inspect the item's versions in the hub index file and fix any non-semver tag to a valid MAJOR.MINOR.PATCH form
3. If it's a custom hub, republish the item metadata with semver-compliant version strings

Example fix

// before: item in .index.json
"version": "latest"
// after
"version": "1.0.0"

import "golang.org/x/mod/semver"

func allSemver(tags []string) error {
	for _, t := range tags {
		v := strings.TrimPrefix(t, "v")
		parts := strings.Split(v, ".")
		if len(parts) != 3 {
			return fmt.Errorf("%q is not MAJOR.MINOR.PATCH", t)
		}
	}
	return nil
}
// run against the item's versions before enabling a custom hub

if err := hub.Load(ctx); err != nil {
	var badVer string
	if matchesInvalidVersion(err, &badVer) {
		return fmt.Errorf("hub index has non-semver version %q; run 'cscli hub update'", badVer)
	}
	return err
}

When it happens

Trigger: A hub index entry contains a version tag that is not valid semver (e.g. '1.0', 'v1-', a branch name like 'master', or a typo like '1..2'), and localSync/detectVersionFromHash tries to sort that item's versions.

Common situations: Out-of-tree or hand-edited hub index (.index.json) with non-semver version fields; custom/private hubtacks whose authors used loose version labels; upstream hub metadata change not handled by the local crowdsec version.

Related errors

• no parser found. Please install the appropriate parser and r
• %s: latest hash missing from index. The index file is invali
• %s:%s has no index metadata
• path is too short: %s (%d)
• unknown configuration type '%s'

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6ac1eb8fd421788d. Report an issue: GitHub.