Dependency evaluation for json schema validation

This is currently postponed on ✨ Add Single Directory Components as a new experimental module Fixed .

SDC is in.

Here because I'm working on ✨ Generate JSON schema for content entity types Needs review which also needs schema validation.

Unfortunately, this library appears to be very much in maintenance mode and is not getting updates that will be important, e.g. support for vocabularies, which was introduced in draft 2019-09. While it has maintainers and is getting commits, it only officially supports up through draft-04. SDC uses draft-04 as its schema, however OpenAPI 3.1 uses 2020-12.

Alternatives would perhaps include opis/json-schema however it's in that place where it hasn't seen a commit to trunk in 2 years and not a release in almost as long - and a big open issue queue. So I doubt this would pass muster on security review even if it "works."

Then there's swaggest/php-json-schema but it has the same contributor bandwidth problem.

So we're kind of in a tough spot where I think justinrainbow/json-schema is a good foundation and does what we need it to do for the code that exists in core today, but it's likely not really up to snuff as a full core dependency. It's also lacking in its ability to support our future direction.

I've used ajv on the client side and it's really amazing, well documented and supported by big players (e.g., browser vendors) but... it's in JavaScript. https://ajv.js.org/

OK, rubber-ducking here: I think it would be stupid to hold ourselves back on adopting modern standards (especially for greenfield functionality to Drupal core) on account of test tooling. Drupal core is moving to GitLab CI, which would in theory allow us to do things like use a node container to run ajv to validate generated schema or... whatever. Same can be said for projects like openapi that want to target OpenAPI 3.1, for instance.

I will need to check with core committers on this approach more broadly, but it is an idea for the test pipeline. As for runtime validation (which it sounds like SDC wanted this in core to perform) then we still have the question of whether the justinrainbow package passes the gates for inclusion... but it need not hold back other JSON schema type functionality in core.

For clarity, this issue focuses on inclusion for runtime tasks. We have this package in core in require-dev already.

Would just like to point out that there has been significant progress in resurrecting justinrainbow/json-schema as a community-supported project, though the future is still uncertain: https://github.com/justinrainbow/json-schema/issues/658

There is a tentative pseudo-roadmap that includes support for recent drafts of the spec.

Thanks for helping move the conversation forward @dafeder!

I am adding a note to the IS to note that Composer also depends on this package. This might add some additional confidence in adding this as a runtime dependency for Drupal.

The validation library is now on a new jsonrainbow (love that name) org and there is active development. https://github.com/jsonrainbow/json-schema