Plugin.dependencyParse: is not a valid dependency string.

Error message

Plugin.dependencyParse: is not a valid dependency string.

What it means

Plugin.dependencyParse parses a dependency string of the form 'name' or 'name@x.y.z' (with optional ^, ~, *, >=, > operators). If the string fails the regex, this warning is logged, but parsing still proceeds by naively splitting on '@', which can yield a wrong name/range object.

Source

Thrown at src/core/Plugin.js:246

        return tracked;
    };

    /**
     * Parses a dependency string into its components.
     * The `dependency` is a string of the format `'module-name'` or `'module-name@version'`.
     * See documentation for `Plugin.versionParse` for a description of the format.
     * This function can also handle dependencies that are already resolved (e.g. a module object).
     * @method dependencyParse
     * @param dependency {string} The dependency of the format `'module-name'` or `'module-name@version'`.
     * @return {object} The dependency parsed into its components.
     */
    Plugin.dependencyParse = function(dependency) {
        if (Common.isString(dependency)) {
            var pattern = /^[\w-]+(@(\*|[\^~]?\d+\.\d+\.\d+(-[0-9A-Za-z-+]+)?))?$/;

            if (!pattern.test(dependency)) {
                Common.warn('Plugin.dependencyParse:', dependency, 'is not a valid dependency string.');
            }

            return {
                name: dependency.split('@')[0],
                range: dependency.split('@')[1] || '*'
            };
        }

        return {
            name: dependency.name,
            range: dependency.range || dependency.version
        };
    };

    /**
     * Parses a version string into its components.  
     * Versions are strictly of the format `x.y.z` (as in [semver](http://semver.org/)).
     * Versions may optionally have a prerelease tag in the format `x.y.z-alpha`.

View on GitHub (pinned to acb99b6f87)

Solutions

Rewrite the dependency string to match /^name(@(*|?d+.d+.d+))?$/ — a plain name or name@exact-semver with optional ^, ~, *.
Remove unsupported npm operators/tags like 'latest', '>=', or '1.x' from dependency strings.
For scoped packages, rename the plugin since the parser does not support '@scope/' names.

Example fix

// before
uses: ['my-plugin@1.2']
// after
uses: ['my-plugin@1.2.0']

Defensive patterns

Strategy: validation

Validate before calling

var depPattern = /^[\w-]+(@ (\*|[\^~]?\d+\.\d+\.\d+(-[0-9A-Za-z-+]+)?))?$/;
if (typeof dep === 'string' && !depPattern.test(dep)) {
  throw new Error('Invalid dependency string: ' + dep + '. Use name or name@x.y.z');
}

Prevention

Only use plain names or name@major.minor.patch (optionally prefixed with ^, ~, or *) in dependency strings.
Avoid npm-only specifiers ('latest', '>=1.0.0', '1.x') and scoped '@scope/name' plugin ids.
Validate dependency strings with the same regex at plugin authoring time.

When it happens

Trigger: Passing a dependency string with invalid characters or format to Plugin.dependencyParse, or via a plugin's 'uses' array — e.g. 'my plugin', 'plugin@1.0' (missing patch), 'plugin@', 'plugin@@1.0.0', scoped names like '@scope/pkg', or strings containing spaces/slashes.

Common situations: Using npm-style version specifiers unsupported by the simple regex (e.g. '>=1.2.3', '1.x', tags like 'latest'); scoped npm package names; typos such as missing patch segment or stray spaces.

Related errors

AI-assisted analysis of liabru/matter-js@acb99b6f87 (2026-09-02). Data as JSON: /api/errors/dd1e1c19a19eafdd. Report an issue: GitHub.