error: Invalid Go manifest file: node_modules/flatted/golang/pkg/flatted/flatted.go
❯ npx @grafana/create-plugin@latest
❯ Data source (query data from a custom source)
✔ Add a backend to support server-side functionality? (alerting, advanced authentication, public dashboards, etc) (y/N) · true
✔ Enter a name for your plugin · test-datasource
✔ Enter your organization name (usually your Grafana Cloud org) · myorg
❯ cd ./myorg-test-datasource
❯ npm install
❯ npm run build
❯ mage
❯ mv dist myorg-test-datasource
❯ zip -qr myorg-test-datasource.zip myorg-test-datasource
❯ npx @grafana/plugin-validator@latest -sourceCodeUri file://$PWD myorg-test-datasource.zip
2026/03/31 20:20:57 Starting filesystem walk for root: /
2026/03/31 20:20:57 INFO Scanned /Users/alk/tmp/myorg-test-datasource/go.mod file and found 85 packages
2026/03/31 20:20:57 End status: 0 dirs visited, 1 inodes visited, 1 Extract calls, 1.451459ms elapsed, 1.452ms wall time
2026/03/31 20:20:59 Starting filesystem walk for root: /
2026/03/31 20:20:59 INFO Scanned /Users/alk/tmp/myorg-test-datasource/package-lock.json file and found 1065 packages
2026/03/31 20:20:59 End status: 0 dirs visited, 1 inodes visited, 1 Extract calls, 22.438167ms elapsed, 22.439ms wall time
error: osv-scanner detected a critical severity issue in package google.golang.org/grpc
detail: SEVERITY: CRITICAL in package google.golang.org/grpc, vulnerable to CVE-2026-33186 GO-2026-4762
error: osv-scanner detected critical severity issues
detail: osv-scanner detected 1 unique critical severity issues for lockfile: /Users/alk/tmp/myorg-test-datasource/go.mod
error: osv-scanner detected a high severity issue in package serialize-javascript
detail: SEVERITY: HIGH in package serialize-javascript, vulnerable to
error: osv-scanner detected high severity issues
detail: osv-scanner detected 1 unique high severity issues for lockfile: /Users/alk/tmp/myorg-test-datasource/package-lock.json
warning: unsigned plugin
detail: This is a new (unpublished) plugin. This is expected during the initial review process. Please allow the review to continue, and a member of our team will inform you when your plugin can be signed.
suspected: Code diff skipped due to errors in osv-scanner
detail: Fix the errors reported by osv-scanner before code diff can run.
warning: plugin.json: description is empty
detail: Consider providing a plugin description for better discoverability.
suspected: LLM review skipped due to errors in osv-scanner
detail: Fix the errors reported by osv-scanner before LLM review can run.
warning: plugin.json: should include screenshots for the Plugin catalog
detail: Screenshots are displayed in the Plugin catalog. Please add at least one screenshot to your plugin.json.
recommendation: You can include a sponsorship link if you want users to support your work
detail: Consider to add a sponsorship link in your plugin.json file (Info.Links section: with Name: 'sponsor' or Name: 'sponsorship'), which will be shown on the plugin details page to allow users to support your work if they wish.
error: Invalid Go manifest file: node_modules/flatted/golang/pkg/flatted/flatted.go
detail: file node_modules/flatted/golang/pkg/flatted/flatted.go is in the source code but not in the manifest
warning: License file contains generic text
detail: Your current license file contains generic text from the license template. Please make sure to replace {name of copyright owner} and {yyyy} with the correct values in your LICENSE file.
npm show @grafana/plugin-validator@latest version
0.39.2
Looks like it's not fixed by #547, problem is still there: