fix(registries): use buildPURL for proper percent-encoding in urls().purl()#38
fix(registries): use buildPURL for proper percent-encoding in urls().purl()#38
Conversation
…purl() All registries manually constructed PURL strings without percent-encoding. For npm scoped packages like @babel/core, this produced pkg:npm/@babel/core which can't round-trip through parsePURL - the @ gets mistaken for a version separator and parsing fails. Switched every registry to use the shared buildPURL function which handles encoding correctly per the PURL spec.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
🧰 Additional context used📓 Path-based instructions (7)src/**/*.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
src/registries/**/*.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
src/**/!(client).ts📄 CodeRabbit inference engine (src/AGENTS.md)
Files:
src/registries/*.ts📄 CodeRabbit inference engine (src/registries/AGENTS.md)
Files:
test/**/*.test.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
test/unit/**/*.test.ts📄 CodeRabbit inference engine (test/AGENTS.md)
Files:
test/unit/{registry,registries}.test.ts📄 CodeRabbit inference engine (test/AGENTS.md)
Files:
🧠 Learnings (20)📓 Common learnings📚 Learning: 2026-03-10T07:36:29.354ZApplied to files:
📚 Learning: 2026-03-10T07:36:38.679ZApplied to files:
📚 Learning: 2026-03-10T07:36:12.605ZApplied to files:
📚 Learning: 2026-03-10T07:36:03.586ZApplied to files:
📚 Learning: 2026-03-10T07:36:29.354ZApplied to files:
📚 Learning: 2026-03-10T07:36:12.605ZApplied to files:
📚 Learning: 2026-03-10T07:36:54.862ZApplied to files:
📚 Learning: 2026-03-10T07:36:03.586ZApplied to files:
📚 Learning: 2026-03-10T07:36:46.164ZApplied to files:
📚 Learning: 2026-03-10T07:36:12.605ZApplied to files:
📚 Learning: 2026-03-10T07:36:38.679ZApplied to files:
📚 Learning: 2026-03-10T07:36:54.862ZApplied to files:
📚 Learning: 2026-03-10T07:36:54.862ZApplied to files:
📚 Learning: 2026-03-10T07:36:54.862ZApplied to files:
📚 Learning: 2026-03-10T07:36:46.164ZApplied to files:
📚 Learning: 2026-03-10T07:36:46.164ZApplied to files:
📚 Learning: 2026-03-10T07:36:46.164ZApplied to files:
📚 Learning: 2026-03-10T07:36:38.679ZApplied to files:
📚 Learning: 2026-03-10T07:36:46.164ZApplied to files:
🧬 Code graph analysis (7)src/registries/alpm.ts (3)
src/registries/rubygems.ts (3)
test/unit/registries.test.ts (1)
src/registries/packagist.ts (1)
src/registries/pypi.ts (3)
src/registries/cargo.ts (3)
src/registries/npm.ts (3)
🔇 Additional comments (7)
📝 WalkthroughWalkthroughRefactors six registry implementations (alpm, cargo, npm, packagist, pypi, rubygems) to replace manual PURL string construction with calls to a centralized Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
✨ Simplify code
📝 Coding Plan
Comment |
Sequence DiagramThis PR changes registry URL helpers to generate PURLs through a shared builder instead of manual string concatenation. The new flow percent-encodes package parts (notably npm scopes) so generated PURLs can be parsed reliably in round-trip scenarios. sequenceDiagram
participant Caller
participant Registry
participant PURLBuilder
participant PURLParser
Caller->>Registry: Request purl from urls helper
Registry->>Registry: Derive namespace and package name
Registry->>PURLBuilder: Build purl with type name namespace version
PURLBuilder-->>Registry: Return percent encoded purl
Registry-->>Caller: Return valid purl string
Caller->>PURLParser: Parse generated purl
PURLParser-->>Caller: Return parsed package fields
Generated by CodeAnt AI |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 7 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Requires human review: Modifies the logic for generating package identifiers (PURLs) across multiple registry modules and introduces new string parsing logic for scoped packages in npm/packagist.
Architecture diagram
sequenceDiagram
participant Client
participant Registry as Registry (npm, cargo, etc.)
participant PURL as buildPURL (core/purl)
Note over Client, PURL: PURL Generation Flow (Refactored)
Client->>Registry: urls().purl(name, version)
alt Registry: npm
Registry->>Registry: Extract namespace (e.g., "@babel")
Registry->>Registry: Extract bare name (e.g., "core")
else Registry: packagist / alpm
Registry->>Registry: Parse vendor/namespace and package name
else Registry: pypi
Registry->>Registry: Normalize name
end
Registry->>PURL: CHANGED: buildPURL({ type, namespace, name, version })
Note over PURL: NEW: Applies percent-encoding<br/>(e.g., "@" becomes "%40")
PURL-->>Registry: Encoded PURL string
Registry-->>Client: "pkg:type/namespace/name@version"
Note over Client, Registry: Example (npm scoped package)
Client->>Registry: purl("@babel/core", "7.0.0")
Registry->>PURL: buildPURL({ type: "npm", namespace: "@babel", name: "core", ... })
PURL-->>Client: "pkg:npm/%40babel/core@7.0.0"
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Summary
urls().purl()in every registry manually built PURL strings without percent-encoding@babel/core, the outputpkg:npm/@babel/corecan't round-trip throughparsePURLbecause the@gets mistaken for a version separatorbuildPURLfunction which encodes per the PURL specTest plan
@babel/core->pkg:npm/%40babel/core)