Skip to content

Commit eb6ff9e

Browse files
jkowalleckjkowalleck
authored
feat!: remove package url factory (#1378)
<!--🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅 You can expedite processing of your PR by using this template to provide context and additional information. Before actually opening a PR please make sure that it does NOT fall into any of the following categories 🚫 Spam PRs (accidental or intentional) - these will result in a 30-days or even ∞ ban from interacting with the project depending on reoccurrence and severity. 🚫 Lazy typo fixing PRs - if you fix a typo in a file, your PR will only be merged if all other typos in the same file are also fixed with the same PR 🚫 If you fail to provide any _Description_ below, your PR will be considered spam. If you do not check the _Affirmation_ box below, your PR will not be merged. 🚫 If you do not check one of the _AI Tool Disclosure_ boxes below, your PR will not be merged. If you used AI tools to assist you in writing code, but fail to provide the required disclosure, your PR will not be merged. 🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅🔅--> ### Description BREAKING Changes: removed symbols * `Contrib.PackageUrl.Factories.PackageUrlFactory` * `Contrib.FromNodePackageJson.Factories.PackageUrlFactory` No longer depend on `packageurl-js@^2.0.1` Resolves or fixes issue: #1348 ### AI Tool Disclosure - [x] My contribution does not include any AI-generated content - [ ] My contribution includes AI-generated content, as disclosed below: - AI Tools: `[e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]` - LLMs and versions: `[e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]` - Prompts: `[Summarize the key prompts or instructions given to the AI tools]` ### Affirmation - [x] My code follows the [CONTRIBUTING.md](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/CONTRIBUTING.md) guidelines --------- Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
1 parent 7c69f36 commit eb6ff9e

11 files changed

Lines changed: 11 additions & 841 deletions

‎HISTORY.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,13 @@ All notable changes to this project will be documented in this file.
88

99
* BREAKING changes
1010
* Removed deprecated symbols
11+
* Removed PackageUrl factories
1112
* No longer use external standards' implementations nor models
1213
* Removed
1314
* Entrypoint `Builders` (via [#1377])
1415
* Entrypoint `Factories` (via [#1377])
1516
* Entrypoint `Utils` (via [#1377])
17+
* Entrypoint `Contrib/PackageUrl` (via [#1378])
1618
* Deprecated symbol `Builders` ([#1346] via [#1377])
1719
* Deprecated symbol `Builders.FromNodePackageJson` ([#1346] via [#1377])
1820
* Deprecated symbol `Builders.FromNodePackageJson.ToolBuilder` ([#1346] via [#1377])
@@ -24,12 +26,10 @@ All notable changes to this project will be documented in this file.
2426
* Deprecated symbol `Factories.FromNodePackageJson.ExternalReferenceFactory` ([#1346] via [#1377])
2527
Use `Contrib.FromNodePackageJson.Factories.ExternalReferenceFactory` instead.
2628
* Deprecated symbol `Factories.FromNodePackageJson.PackageUrlFactory` ([#1346] via [#1377])
27-
Use `Contrib.FromNodePackageJson.Factories.PackageUrlFactory` instead.
28-
* Deprecated symbol `Factories.LicenseFactory` ([#1346] via [#1377])
29+
* Deprecated symbol `Factories.LicenseFactory` ([#1346], [#1348] via [#1377], [#1378])
2930
Use `Contrib.License.Factories.LicenseFactory` instead.
3031
* Deprecated symbol `Factories.PackageUrlFactory` ([#1346] via [#1377])
31-
Use `Contrib.PackageUrl.Factories.PackageUrlFactory` instead.
32-
* Deprecated symbol `Types.NodePackageJson` ([#1346] via [#1377])
32+
* Deprecated symbol `Types.NodePackageJson` ([#1346], [#1348] via [#1377], [#1378])
3333
Use `Contrib.FromNodePackageJson.Types.NodePackageJson` instead.
3434
* Deprecated symbol `Types.assertNodePackageJson` ([#1346] via [#1377])
3535
Use `Contrib.FromNodePackageJson.Types.assertNodePackageJson` instead.
@@ -55,8 +55,12 @@ All notable changes to this project will be documented in this file.
5555
Use `Contrib.FromNodePackageJson.Utils.parsePackageIntegrity` instead.
5656
* Deprecated symbol `Utils.NpmjsUtility.defaultRegistryMatcher` ([#1346] via [#1377])
5757
Use `Contrib.FromNodePackageJson.Utils.defaultRegistryMatcher` instead.
58+
* Symbol `Contrib.PackageUrl.Factories.PackageUrlFactory` ([#1348] via [#1378])
59+
* Symbol `Contrib.FromNodePackageJson.Factories.PackageUrlFactory` ([#1348] via [#1378])
5860
* Changed
5961
* `Component.purl` is a `string` now, was `PackaheUrl` ([#1348] via [#1379])
62+
* Dependencies
63+
* No longer depend on `packageurl-js@^2.0.1` ([#1348] via [#1378])
6064
* Build
6165
* Use _webpack_ `5.105.2` now, was `v5.103.0` (via [#1360], [#1374])
6266

@@ -65,6 +69,7 @@ All notable changes to this project will be documented in this file.
6569
[#1360]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1360
6670
[#1374]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1374
6771
[#1377]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1377
72+
[#1378]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1378
6873
[#1379]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1379
6974

7075
## 9.4.1 -- 2025-12-04

‎examples/web/webpack/src/index.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ const componentA = new CDX.Models.Component(
4141
}
4242
)
4343
componentA.licenses.add(lFac.makeFromString('Apache-2.0'))
44-
componentA.purl = purlFac.makeFromComponent(componentA)
44+
componentA.purl = `pkg:generic/${componentA.group}/${componentA.name}@${componentA.version}`
4545

4646
bom.components.add(componentA)
4747
bom.metadata.component.dependencies.add(componentA.bomRef)

‎package.json‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,6 @@
8080
"node": ">=20.18.0"
8181
},
8282
"dependencies": {
83-
"packageurl-js": "^2.0.1",
8483
"spdx-expression-parse": "^3.0.1 || ^4"
8584
},
8685
"peerDependencies": {
@@ -188,10 +187,6 @@
188187
"./Contrib/License": {
189188
"types": "./dist.d/contrib/license/index.node.d.ts",
190189
"default": "./dist.node/contrib/license/index.node.js"
191-
},
192-
"./Contrib/PackageUrl": {
193-
"types": "./dist.d/contrib/packageUrl/index.d.ts",
194-
"default": "./dist.node/contrib/packageUrl/index.js"
195190
}
196191
},
197192
"directories": {

‎src/contrib/fromNodePackageJson/factories.ts‎

Lines changed: 1 addition & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -26,19 +26,14 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
2626
* Normalization should be done downstream, for example via [`normalize-package-data`](https://www.npmjs.com/package/normalize-package-data).
2727
*/
2828

29-
import type { PackageURL } from 'packageurl-js'
30-
import { PurlQualifierNames } from 'packageurl-js'
31-
3229
import { isNotUndefined } from '../../_helpers/notUndefined'
3330
import { ExternalReferenceType } from '../../enums/externalReferenceType'
3431
import { HashAlgorithm } from '../../enums/hashAlogorithm'
35-
import type { Component } from '../../models/component'
3632
import { ExternalReference } from '../../models/externalReference'
3733
import { HashDictionary } from '../../models/hash'
38-
import { PackageUrlFactory as PlainPackageUrlFactory } from '../packageUrl/factories'
3934
import { tryCanonicalizeGitUrl } from './_helpers/gitUrl'
4035
import type { NodePackageJson } from './types'
41-
import { defaultRegistryMatcher, parsePackageIntegrity } from './utils'
36+
import { parsePackageIntegrity } from './utils'
4237

4338
/**
4439
* Node-specific ExternalReferenceFactory.
@@ -130,57 +125,3 @@ export class ExternalReferenceFactory {
130125
return undefined
131126
}
132127
}
133-
134-
/**
135-
* Node-specific PackageUrlFactory.
136-
* @see {@link https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#npm}
137-
*/
138-
export class PackageUrlFactory extends PlainPackageUrlFactory<'npm'> {
139-
/* eslint-disable-next-line @typescript-eslint/no-inferrable-types -- docs */
140-
override makeFromComponent (component: Component, sort: boolean = false): PackageURL | undefined {
141-
const purl = super.makeFromComponent(component, sort)
142-
return purl === undefined
143-
? undefined
144-
: this.#finalizeQualifiers(purl)
145-
}
146-
147-
/**
148-
* Will strip unnecessary qualifiers according to [PURL-SPECIFICATION](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst#known-qualifiers-keyvalue-pairs).
149-
* <blockquote cite="https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst#known-qualifiers-keyvalue-pairs">
150-
* Do not abuse qualifiers: it can be tempting to use many qualifier keys but their usage should be limited
151-
* to the bare minimum for proper package identification to ensure that a purl stays compact and readable
152-
* in most cases.
153-
* </blockquote>
154-
*
155-
* Therefore:
156-
* - "vcs_url" is stripped, if a "download_url" is given.
157-
* - "download_url" is stripped, if it is NPM's default registry ("registry.npmjs.org")
158-
* - "checksum" is stripped, unless a "download_url" or "vcs_url" is given.
159-
*/
160-
#finalizeQualifiers(purl: PackageURL): PackageURL {
161-
/* eslint-disable no-param-reassign -- intended */
162-
const qualifiers = new Map(Object.entries(purl.qualifiers ?? {}))
163-
164-
const downloadUrl = qualifiers.get(PurlQualifierNames.DownloadUrl)
165-
if (downloadUrl !== undefined) {
166-
qualifiers.delete(PurlQualifierNames.VcsUrl)
167-
if (defaultRegistryMatcher.test(downloadUrl)) {
168-
qualifiers.delete(PurlQualifierNames.DownloadUrl)
169-
}
170-
}
171-
if (!qualifiers.has(PurlQualifierNames.DownloadUrl) && !qualifiers.has(PurlQualifierNames.VcsUrl)) {
172-
// nothing to base a checksum on
173-
qualifiers.delete(PurlQualifierNames.Checksum)
174-
}
175-
if (qualifiers.size > 0) {
176-
purl.qualifiers = Object.fromEntries(qualifiers.entries())
177-
/* @ts-expect-error TS2322 */
178-
purl.qualifiers.__proto__ = null /* eslint-disable-line no-proto -- intended */
179-
} else {
180-
purl.qualifiers = undefined
181-
}
182-
183-
return purl
184-
/* eslint-enable no-param-reassign */
185-
}
186-
}

‎src/contrib/index.common.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,3 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
2222
*/
2323

2424
export * as Bom from './bom'
25-
export * as PackageUrl from './packageUrl'

‎src/contrib/packageUrl/factories.ts‎

Lines changed: 0 additions & 92 deletions
This file was deleted.

‎src/contrib/packageUrl/index.ts‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

0 commit comments

Comments
 (0)