Missing dependency "justinrainbow/json-schema" on Drupal 8

Interesting, indeed it's missing, though Drupal Core would bring it in as dependency already, but makes sense that we should not rely on that.

https://api.drupal.org/api/drupal/vendor!justinrainbow!json-schema!src!J...
https://api.drupal.org/api/drupal/core%21modules%21jsonapi%21src%21Event...

Core JsonAPI uses it! Does anyone know how that defines its dependency on the library? Or is it "magic" by core?

Thanks for the nice implementation, which Drupal 8 version are you using @mpaulo?

I don't think adding the dependency will do any harm, the only thing I'm unsure about is, if we should declare the library version (^5.2) or better use * here to not conflict with core in the future?

@Grevil what do you think? I'm not sure if this really only affects Drupal 8 or perhaps even minimal Drupal 9 installations? Otherwise we could discuss to make 2.1.0 only Drupal ^9 || ^10 compatible instead and keep the 2.0.x for Drupal 8?

@mpaulo thank you very much for this important information!
Indeed we can see the same here: https://packagist.org/packages/drupal/core-dev

Which means that core-dev requires the library. Still this can't be the way how jsonapi requires it, as jsonapi has no dependency on drupal/core-dev and also works with core?

I'd still like to understand how that works...

Anyway, we won't make things worse here by adding this to the composer.json of the module. Should we ever run into a version conflict in the future with drupal-dev, we should change the version to * in this module.

I'll create a new 2.1.1 release.

@Anybody

jsonapi has no dependency on drupal/core-dev and also works with core

Yep, this is correct! Although, "JsonSchema" is ONLY used inside the jsonapi's "ResourceResponseValidator" class. And there, the validator will only get initialized if the "JsonSchema\Validator" is present otherwise, the variable is NULL and gets checked in every function if it even exists.

  /**
   * The schema validator.
   *
   * This property will only be set if the validator library is available.
   *
   * @var \JsonSchema\Validator|null
   */
  protected $validator;

So, to make it simple:

No JsonSchema library required = No schema validation

I actually kinda like this approach, because the schema validation is not critically needed. If the user inputs a faulty json, I guess it's their problem then!

What I don't like about the jsonapi module implementation is, that it doesn't inform the user about the optional json schema validation, so anyone using drupal/core probably doesn't even know about the existing schema validation in "jsonapi".

@Anybody, what do you think about a similar implementation + noticing the user about the missing library on the status page? Or should we just leave it?

Thanks for the feedback @Grevil, indeed that's a nice idea for less overhead, especially if the JSON field is not used at all! (That might be the case quite often).

So what we could do is create a new feature request issue linking this one and suggesting to:
1. Move the composer require depencendy into a composer suggestion (suggests)
2. Add information below the json input fields showing if the library is enabled for validation and otherwise informing the user about the suggestion
3. Only validate if the library is present.

I wouldn't add it to the status report as we don't want to bother users to require a library, which isn't needed (optional).

Still that's a minor feature request and I think the current status is fine for now after adding the dependency.

Please create the feature request, link it here and add a note for the dependency on the module page, then we should set this fixed again :)

@Anybody, agree! Going to close this issue then :)

Done, see #3322860: Make json schema validation an optional feature