purl of scoped packages about cyclonedx-node-module HOT 6 CLOSED

This fix will be included in the upcoming 2.0.0 release.

from cyclonedx-node-module.

FYI: Dependency Track relies on this format pkg:npm/angular/%40angular%[email protected] and does not work with pkg:npm/%40angular/[email protected].

from cyclonedx-node-module.

It should be producing scoped packages in the following format: pkg:npm/%40angular/[email protected]. If it doesn't, then that is certainly a defect.

from cyclonedx-node-module.

@stevespringett on my machine it's reproducible, see for example:
https://github.com/scolytus/dependency-demo/blob/master/boms/angular20200506.bom.xml

I also checked the implementation in Dependency Track, it also relies on this faulty behavior for scoped packages, it does not use purl.namespace at all for npm analysis.
Shall I open an issue there as well?

And just for completeness, OSS Index understands neither version, see OSSIndex/vulns#91

from cyclonedx-node-module.

Thank you.

I also checked the implementation in Dependency Track, it also relies on this faulty behavior for scoped packages, it does not use purl.namespace at all for npm analysis.
Shall I open an issue there as well?

Yes please

from cyclonedx-node-module.

2.0.0 was pushed to npm. closing.

from cyclonedx-node-module.