SynvoyaandSynvoya bd0917fe93 fix(javascript): strip peer-dep suffix from deno.lock npm keys (#5055) ...

deno.lock npm keys append resolved peer dependencies after the version,
separated by "_" (e.g. "typedoc@0.28.19_typescript@6.0.3" or the scoped
"@scope/name@1.2.3_@scope+peer@4.5.6"). parseDenoNpmNameVersion split on the
last "@", capturing a peer's "@" and producing a garbage package name plus
the peer's version (and a corrupt PURL that breaks vulnerability matching).

Strip the peer suffix (the first "_" after the version "@") before splitting
name@version; a semver version never contains "_".

Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com>
Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com>

2026-07-13 14:38:32 +00:00

..

bun

feat: add support for Bun lockfile (#4625)

2026-06-09 13:22:43 -04:00

bun-trailing-comma

feat: add support for Bun lockfile (#4625)

2026-06-09 13:22:43 -04:00

bun-variable-tuples

feat: add support for Bun lockfile (#4625)

2026-06-09 13:22:43 -04:00

deno

fix(javascript): strip peer-dep suffix from deno.lock npm keys (#5055)

2026-07-13 14:38:32 +00:00