Skip to content

Fix case-parsing for "new" npm packages #95

@sschuberth

Description

@sschuberth

Currently, packageurl-js package parses the name of an npm package from the purl case-sensitively only in specific cases for some legacy npm packages. (Thanks @lamppu for the analysis.)

See:

// Ignore lowercasing legacy names because they could be mixed case.
// https://github.com/npm/validate-npm-package-name/tree/v6.0.0?tab=readme-ov-file#legacy-names
if (!isNpmLegacyName(getNpmId(purl))) {
lowerName(purl)
}

According to this discussion in this purl-spec issue that conditional behavior seems to be wrong, and mixed case packages should be unconditionally allowed (see the last comment from @pombredanne).

@jdalton, do you think a fix and release would be doable soon?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions