SynvoyaandSynvoya aebdf4bff4 Fix mix.lock git/path deps mislabeled as hex.pm with bogus PURL (#5041) ...

parseMixLock read the version from a hex-only token position and hardcoded a pkg:hex PURL, so git/path deps got a URL-fragment version and a false hex.pm PURL (false CVE matches). Branch on the source atom: git uses the commit SHA, path an empty version, and pkg:hex PURLs are emitted only for hex deps.

Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com>
Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com>

2026-07-06 15:13:20 +00:00

..

glob-paths/src

chore: migrate fixtures to testdata (#4651)

2026-03-06 19:42:04 +00:00

relationships

feat(elixir): emit dependency relationships from mix.lock (#4985)

2026-06-29 10:22:38 -04:00

mix.lock

Fix mix.lock git/path deps mislabeled as hex.pm with bogus PURL (#5041)

2026-07-06 15:13:20 +00:00