v4.3.0 Causing PURL Processing Errors about dependency-review-action HOT 6 CLOSED

Just double checked, and we are not using any configurations besides the default settings. Here's the build process, which is the same as the documentation example:

dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v4
      - name: 'Dependency Review'
        uses: actions/dependency-review-action@v4

from dependency-review-action.

Was just about to report the same issue. Had to pin to actions/[email protected] to prevent a build issue.
Example build: https://github.com/ni/nimble/actions/runs/8853178015

Edit: I get a slightly different error with v4.3 is Error: A purl string argument is required.

from dependency-review-action.

Thanks for the report, @watercable76! Sorry for the bother, I've reset the v4 tag to point to the previous release while we figure this out.

from dependency-review-action.

I'm having a hard time reproducing this in my test repo(s). @watercable76, can you share (a possibly redacted version of) your dependency review config?

from dependency-review-action.

I've narrowed down the cause of this to the handling of @ symbols in NPM namespaces. These weren't a problem before because we weren't using a packageurl-js, but it has a somewhat pedantic insistence that the namespace be URL-encoded. To be fair, that is what the spec dictates.

Nonetheless, I've seen many implementations that tolerate @ symbols there, and I think there's a practical purpose to that. In this case, not only are user configs likely to have things like pkg:npm/@namespace/name, but even internally we tend to represent namespaces in purls with the literal @ rather than %40.

Given the amount of monkeying around we've already had to do to get this library working, and our modest needs for parsing in the first place, I'm tempted to just hand-roll our own purl parser and be done with it.

from dependency-review-action.

@watercable76 thanks again for the report, this should be fixed now.

from dependency-review-action.