External dependencies

[mjlbach]

Some dependencies are runtime, some are build time. The specification may want to distinguish these, as the latter could cause the plugin to fail installation.

[wbthomason]

This guidance should also include what we expect package managers to do about verifying external dependency versions.

[mjlbach]

It's hard, because we can't enforce the versioning scheme (it could be calver or something-not-semver). I'm not sure what the best generic way to check against versions is. We could allow specifying comparator rules, regex matches on version, etc. Not sure.

[wbthomason]

Yeah, I'm not sure what we can require that isn't too onerous for plugin managers.

[lewis6991]

Personally, I think we should defer this and omit it from the initial release.