Bump github.com/git-pkgs/purl to v0.1.19

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: ['1.25']
+        go-version: ['1.26.7']
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.25'
+          go-version: '1.26.7'
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9

go.mod

@@ -1,15 +1,15 @@
 module github.com/git-pkgs/registries
 
-go 1.25.6
+go 1.26.7
 
 require (
 	github.com/cenk/backoff v2.2.1+incompatible
 	github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a
 	github.com/git-pkgs/artifacts v0.1.1
 	github.com/git-pkgs/pom v0.1.7
-	github.com/git-pkgs/purl v0.1.17
+	github.com/git-pkgs/purl v0.1.19
 	github.com/git-pkgs/spdx v0.3.1
-	github.com/git-pkgs/vers v0.4.0
+	github.com/git-pkgs/vers v0.6.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529
 	github.com/rubyist/circuitbreaker v2.2.1+incompatible
@@ -18,7 +18,7 @@ require (
 
 require (
 	github.com/github/go-spdx/v2 v2.7.0 // indirect
-	github.com/package-url/packageurl-go v0.1.6 // indirect
+	github.com/package-url/packageurl-go v0.1.7 // indirect
 	github.com/peterbourgon/g2s v0.0.0-20170223122336-d4e7ad98afea // indirect
 	golang.org/x/sync v0.20.0 // indirect
 )

go.sum

@@ -8,18 +8,18 @@ github.com/git-pkgs/artifacts v0.1.1 h1:FqaInQsEMb/53cT5kFlCBvF2dGOHIf+iRYm+EQpz
 github.com/git-pkgs/artifacts v0.1.1/go.mod h1:zWZ0mrFi2M6ajGwpbo1nBGQTSb7qptP+zNG/EwAemBE=
 github.com/git-pkgs/pom v0.1.7 h1:4yKdtw6eyShtjul6bcZdyz7yLQ+jdrYeYkKbskDGi4c=
 github.com/git-pkgs/pom v0.1.7/go.mod h1:ufdMBe1lKzqOeP9IUb9NPZ458xKV8E8NvuyBMxOfwIk=
-github.com/git-pkgs/purl v0.1.17 h1:oRSd8tqllTLl74Wa4WnuqU500hXd9OdUnImOEswQUVE=
-github.com/git-pkgs/purl v0.1.17/go.mod h1:7u7ora8tQdrkS7Auclr5v8dCJdjN4ej6AbrvYZi2b7k=
+github.com/git-pkgs/purl v0.1.19 h1:AT9ReTQjZIqEr+trKhfFJ/YZoh4pwdWsyJKKZWzs23c=
+github.com/git-pkgs/purl v0.1.19/go.mod h1:hthV5mp+Q67HpQ9+LnRLLmsReu5ooyQ5EaJsCGrA8yE=
 github.com/git-pkgs/spdx v0.3.1 h1:58JPY5X9pYpXvnzzZIgehItlBykeOOw52pNc4OBcS+c=
 github.com/git-pkgs/spdx v0.3.1/go.mod h1:cqRoZcvl530s/W+oGNvwjt4ODN8T1W6D/20MUZEFdto=
-github.com/git-pkgs/vers v0.4.0 h1:EYPSys2D+QAcjrN0Dmz+zizaCDINyAp6zixRcIQMR5E=
-github.com/git-pkgs/vers v0.4.0/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo=
+github.com/git-pkgs/vers v0.6.0 h1:droJw8+oSyl8/UoDj/96B9ZPggmxJDTl/JeixzfKzSc=
+github.com/git-pkgs/vers v0.6.0/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo=
 github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ=
 github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/package-url/packageurl-go v0.1.6 h1:YO3p6u1XmCUliivUg/qWphaY8vI6hxSnnPv7Bfg3m5M=
-github.com/package-url/packageurl-go v0.1.6/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
+github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY=
+github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
 github.com/peterbourgon/g2s v0.0.0-20170223122336-d4e7ad98afea h1:sKwxy1H95npauwu8vtF95vG/syrL0p8fSZo/XlDg5gk=
 github.com/peterbourgon/g2s v0.0.0-20170223122336-d4e7ad98afea/go.mod h1:1VcHEd3ro4QMoHfiNl/j7Jkln9+KQuorp0PItHMJYNg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

internal/npm/npm.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/git-pkgs/purl"
 	"github.com/git-pkgs/registries/internal/core"
 )
 
@@ -404,23 +405,5 @@ func (u *URLs) Documentation(name, version string) string {
 }
 
 func (u *URLs) PURL(name, version string) string {
-	namespace := ""
-	pkgName := name
-	if strings.HasPrefix(name, "@") && strings.Contains(name, "/") {
-		parts := strings.SplitN(name, "/", 2) //nolint:mnd // scope/name split
-		namespace = parts[0]
-		pkgName = parts[1]
-	}
-
-	if namespace != "" {
-		if version != "" {
-			return fmt.Sprintf("pkg:npm/%s/%s@%s", namespace, pkgName, version)
-		}
-		return fmt.Sprintf("pkg:npm/%s/%s", namespace, pkgName)
-	}
-
-	if version != "" {
-		return fmt.Sprintf("pkg:npm/%s@%s", pkgName, version)
-	}
-	return fmt.Sprintf("pkg:npm/%s", pkgName)
+	return purl.BuildPURLString(ecosystem, name, version, "")
 }

internal/npm/npm_test.go

@@ -500,7 +500,7 @@ func TestURLBuilder(t *testing.T) {
 		{"download", func() string { return urls.Download("lodash", "4.17.21") }, "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"},
 		{"scoped download", func() string { return urls.Download("@babel/core", "7.24.0") }, "https://registry.npmjs.org/@babel/core/-/core-7.24.0.tgz"},
 		{"purl", func() string { return urls.PURL("lodash", "4.17.21") }, "pkg:npm/lodash@4.17.21"},
-		{"scoped purl", func() string { return urls.PURL("@babel/core", "7.24.0") }, "pkg:npm/@babel/core@7.24.0"},
+		{"scoped purl", func() string { return urls.PURL("@babel/core", "7.24.0") }, "pkg:npm/%40babel/core@7.24.0"},
 	}
 
 	for _, tt := range tests {

registries_test.go

@@ -212,6 +212,31 @@ func TestBuildURLs(t *testing.T) {
 	}
 }
 
+func TestBuildURLsCleansPURLConstraints(t *testing.T) {
+	reg, err := registries.New("npm", "", nil)
+	if err != nil {
+		t.Fatalf("New failed: %v", err)
+	}
+
+	tests := []struct {
+		name    string
+		version string
+		want    string
+	}{
+		{name: "exclusive lower bound", version: ">1.0.0", want: "pkg:npm/lodash@%3E1.0.0"},
+		{name: "union uses ecosystem ordering", version: "2.0.0 || 1.0.0", want: "pkg:npm/lodash@1.0.0"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got := registries.BuildURLs(reg.URLs(), "lodash", test.version)
+			if got["purl"] != test.want {
+				t.Errorf("purl = %q, want %q", got["purl"], test.want)
+			}
+		})
+	}
+}
+
 func TestConstants(t *testing.T) {
 	// Verify constants are exported correctly
 	if registries.Runtime != "runtime" {