JSON:API 1.1 RC1 Spec Compliance: Creating/updating a relationship to a non-existant resource should 404

Nor we should. This falls on the implementor's side, they should use JSON:API Extras for it.

Completely agreed — sorry for not making that more clear :) OTOH, good to have an explicit +1 :)

Once we switch to 1.1 support, we'll need to take care of all of the following (in these points below I'm following the structure in https://jsonapi.org/#update-history):

1. Features
   1. Profiles: https://jsonapi.org/format/1.1/#profiles — #2955020: Spec Compliance: JSON API's profile/extention (Fancy Filters, Drupal sorting, Drupal pagination, relationship arity) needs to be explicitly communicated
   2. @-Members: https://jsonapi.org/format/1.1/#document-member-names-at-members — this is pure API addition, no break needed — rough patch attached
   3. error object type links: https://jsonapi.org/format/1.1/#error-objects — again pure API addition, no break — at worst this causes some duplicate links — for example the sole info URL may be repeated as one of the type URLs
2. Editorial clarifications
   1. for query parameters: https://jsonapi.org/format/1.1/#query-parameters — we were already interpreting it this way
   2. for appropriate status codes: https://github.com/json-api/json-api/pull/1036 (for https://github.com/json-api/json-api/issues/1033) and https://github.com/json-api/json-api/pull/1029 (for https://github.com/json-api/json-api/issues/1023). The latter already works, the former not yet. Added a failing test for the former.
3. Recommendation changes
   1. now recommending camelCase — we're not adopting that (see #2 + #3), plus it's only a recommendation anyway

Based on #4, AFAICT JSON:API 1.1 only requires changes for:

1. point 1.1 (Profiles), and for that we already have #2955020: Spec Compliance: JSON API's profile/extention (Fancy Filters, Drupal sorting, Drupal pagination, relationship arity) needs to be explicitly communicated — ideally we'd have a patch ready for that, proving that it is indeed possible to express our profiles using the spec
2. point 1.2 (@-Members): to ignore such members in incoming requests — definitely no BC break there
3. point 1.3 (error object type links): just adding more links — definitely no BC break there
4. point 2.2.a: status code when creating relationship to non-existing resource: this WILL BE a behavior change, and should therefore in principle happen before JSON:API 2.0
5. point 2.2.b: status code when deleting non-existing resource — just needs test coverage (#4 includes it already, and it passes)

@e0ipso and @gabesullice: I'd love to hear your thoughts on how this should impact 2.0RC3 and 2.0-stable. IMHO 2.2.a is a hard blocker for 2.0-stable, and 1.1 should be too to be safe.

I'm beginning to feel like we're abusing the RC process a bit...

I don't think we are. We released RC1 thinking it could be a stable release. Bugs were found. RC2 was released. Bugs were again found, and they're now all fixed. But also during RC2, https://twitter.com/jsonapi/status/1069593631365959680 happened. While that is not a bug, that does pose a risk of BC breaks post-2.0. Better to address that now rather than later.

But yes, I think we're getting distracted in the RC phase; I think several of the lately committed performance issues should not have been committed during RC (2 commits for #3014232, 1 commit for #3017239. They weren't critical. Anything non-critical should wait until after 2.0.

This fixes most failures.

+++ b/src/JsonApiSpec.php
@@ -72,8 +72,8 @@ class JsonApiSpec {
-        // First character must be "globally allowed". Length must be >=1.
-        self::MEMBER_NAME_GLOBALLY_ALLOWED_CHARACTER_CLASS . '{1}' .
+        // First character must be "globally allowed" or @. Length must be >=1.
+        '(' . self::MEMBER_NAME_GLOBALLY_ALLOWED_CHARACTER_CLASS . '|){1}' .

+++ b/src/Normalizer/HttpExceptionNormalizer.php
@@ -94,6 +94,7 @@ class HttpExceptionNormalizer extends NormalizerBase {
+    // @todo add `type` links: https://jsonapi.org/format/1.1/#error-objects

+++ b/src/Normalizer/JsonApiDocumentTopLevelNormalizer.php
@@ -85,6 +86,7 @@ class JsonApiDocumentTopLevelNormalizer extends NormalizerBase implements Denorm
+      // @todo drop @-members

@@ -93,6 +95,7 @@ class JsonApiDocumentTopLevelNormalizer extends NormalizerBase implements Denorm
+      // @todo drop @-members

+++ b/tests/src/Unit/JsonApiSpecTest.php
@@ -42,6 +42,7 @@ class JsonApiSpecTest extends UnitTestCase {
+    $data['@-member'] = ['@kittens', TRUE];

These are for points 1.2 and 1.3 and are definitely safe to add later. Let's remove them here. That will make the patch green.

IMHO #16 should get committed, then RC3 should be tagged. We'll need a Minor taskfollow-up for points 1.2 and 1.3.

+1 from @e0ipso and/or @gabesullice wanted :)