fix: strip purl qualifiers when matching deps.dev license response to SBOM purls

The deps.dev backend returns package purls with a ?scope=compile qualifier
(e.g. pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4?scope=compile),
while the SBOM generated by the client uses plain purls without qualifiers.
The strict purls.includes(purl) check in normalizeLicensesResponse never
matched qualifier-suffixed purls, causing incompatibleDependencies to always
be empty even when LGPL/copyleft dependencies were present.

Fix by stripping the qualifier segment (?...) from both sides before comparing
and storing the qualifier-free purl as the map key, making the match resilient
to any qualifiers the backend may return.

Adds three tests for normalizeLicensesResponse covering the qualifier mismatch
scenario and a bug report in docs/bug-purl-qualifier-mismatch.md.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: soul2zimate

src/license/licenses_api.js

@@ -55,6 +55,8 @@ export function normalizeLicensesResponse(data, purls = []) {
 	const map = new Map();
 	if (!data || !Array.isArray(data)) {return map;}
 
+	const allowed = purls.length > 0 ? new Set(purls.map(p => p.split('?')[0])) : null;
+
 	for (const providerResult of data) {
 		const packages = providerResult?.packages;
 		if (!packages || typeof packages !== 'object') {continue;}
@@ -64,8 +66,13 @@ export function normalizeLicensesResponse(data, purls = []) {
 			const expression = concluded?.expression;
 			const licenses = identifiers.length > 0 ? identifiers : (expression ? [expression] : []);
 			const category = concluded?.category; // PERMISSIVE | WEAK_COPYLEFT | STRONG_COPYLEFT | UNKNOWN
-			if (purls.length === 0 || purls.includes(purl)) {
+			if (allowed === null) {
 				map.set(purl, { licenses: licenses.filter(Boolean), category });
+			} else {
+				const purlBase = purl.split('?')[0];
+				if (allowed.has(purlBase)) {
+					map.set(purlBase, { licenses: licenses.filter(Boolean), category });
+				}
 			}
 		}
 		// Use first provider that has packages; backend may return multiple (e.g. deps.dev)

test/providers/license.test.js

@@ -10,6 +10,56 @@ import Javascript_npm from '../../src/providers/javascript_npm.js'
 import Javascript_pnpm from '../../src/providers/javascript_pnpm.js'
 import Javascript_yarn from '../../src/providers/javascript_yarn.js'
 import pythonPipProvider from '../../src/providers/python_pip.js'
+import { normalizeLicensesResponse } from '../../src/license/licenses_api.js'
+
+suite('normalizeLicensesResponse', () => {
+	const lgpl = { id: 'LGPL-2.1', name: 'GNU Lesser General Public License v2.1 only', category: 'WEAK_COPYLEFT' }
+	const apache = { id: 'Apache-2.0', name: 'Apache License 2.0', category: 'PERMISSIVE' }
+
+	const backendResponse = [
+		{
+			status: { ok: true, name: 'deps.dev' },
+			packages: {
+				// backend returns purls with ?scope=compile qualifier
+				'pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4?scope=compile': {
+					concluded: { identifiers: [lgpl], expression: 'LGPL-2.1', category: 'WEAK_COPYLEFT' }
+				},
+				'pkg:maven/javassist/javassist@3.12.1.GA?scope=compile': {
+					concluded: { identifiers: [lgpl], expression: 'LGPL-2.1', category: 'WEAK_COPYLEFT' }
+				},
+				'pkg:maven/commons-collections/commons-collections@3.2.1': {
+					concluded: { identifiers: [apache], expression: 'Apache-2.0', category: 'PERMISSIVE' }
+				}
+			}
+		}
+	]
+
+	// SBOM purls have no qualifier
+	const sbomPurls = [
+		'pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4',
+		'pkg:maven/javassist/javassist@3.12.1.GA',
+		'pkg:maven/commons-collections/commons-collections@3.2.1'
+	]
+
+	test('matches backend purls with ?scope=compile qualifier against plain SBOM purls', () => {
+		const map = normalizeLicensesResponse(backendResponse, sbomPurls)
+		expect(map.size).to.equal(3)
+	})
+
+	test('stores purl without qualifier as map key', () => {
+		const map = normalizeLicensesResponse(backendResponse, sbomPurls)
+		expect(map.has('pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4')).to.be.true
+		expect(map.has('pkg:maven/javassist/javassist@3.12.1.GA')).to.be.true
+		expect(map.has('pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4?scope=compile')).to.be.false
+	})
+
+	test('preserves correct license category for qualifier-stripped purls', () => {
+		const map = normalizeLicensesResponse(backendResponse, sbomPurls)
+		expect(map.get('pkg:maven/org.mariadb.jdbc/mariadb-java-client@3.1.4').category).to.equal('WEAK_COPYLEFT')
+		expect(map.get('pkg:maven/javassist/javassist@3.12.1.GA').category).to.equal('WEAK_COPYLEFT')
+		expect(map.get('pkg:maven/commons-collections/commons-collections@3.2.1').category).to.equal('PERMISSIVE')
+	})
+})
 
 suite('testing readLicenseFromManifest with existing test manifests', () => {