3 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
SynvoyaandSynvoya	3cc3ecb003	Fix panic on cabal.project.freeze 'installed' boot-lib constraints (#5040) ... GHC boot-lib constraints (any.base installed) have no ' ==', so fields[1] panicked with index out of range and the recover dropped all Haskell packages. Skip constraint lines without a version. Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com> Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com>	2026-07-13 10:57:32 -04:00
SynvoyaandSynvoya	bd0917fe93	fix(javascript): strip peer-dep suffix from deno.lock npm keys (#5055) ... deno.lock npm keys append resolved peer dependencies after the version, separated by "_" (e.g. "typedoc@0.28.19_typescript@6.0.3" or the scoped "@scope/name@1.2.3_@scope+peer@4.5.6"). parseDenoNpmNameVersion split on the last "@", capturing a peer's "@" and producing a garbage package name plus the peer's version (and a corrupt PURL that breaks vulnerability matching). Strip the peer suffix (the first "_" after the version "@") before splitting name@version; a semver version never contains "_". Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com> Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com>	2026-07-13 14:38:32 +00:00
SynvoyaandSynvoya	aebdf4bff4	Fix mix.lock git/path deps mislabeled as hex.pm with bogus PURL (#5041) ... parseMixLock read the version from a hex-only token position and hardcoded a pkg:hex PURL, so git/path deps got a URL-fragment version and a false hex.pm PURL (false CVE matches). Branch on the source atom: git uses the commit SHA, path an empty version, and pkg:hex PURLs are emitted only for hex deps. Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com> Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com>	2026-07-06 15:13:20 +00:00