Skip to content

Fix case-parsing for "new" npm packages #95

@sschuberth

Description

@sschuberth

Currently, packageurl-js package parses the name of an npm package from the purl case-sensitively only in specific cases for some legacy npm packages. (Thanks @lamppu for the analysis.)

See:

// Ignore lowercasing legacy names because they could be mixed case.
// https://github.com/npm/validate-npm-package-name/tree/v6.0.0?tab=readme-ov-file#legacy-names
if (!isNpmLegacyName(getNpmId(purl))) {
lowerName(purl)
}

According to this discussion in this purl-spec issue that conditional behavior seems to be wrong, and mixed case packages should be unconditionally allowed (see the last comment from @pombredanne).

@jdalton, do you think a fix and release would be doable soon?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions