aboutcode-org / aboutcode-org/scancode-toolkit
Support npm dependencies with "weird" versions
Abierto
bug
dependencies
package scan
package-formats
- Lenguaje dominante
- Python
- Estrellas
- 2.6k
- Forks
- 791
- Merge medio
- 1 d 12 h
- PR fusionados (30 d)
- 5
Descripción
Per https://docs.npmjs.com/cli/v7/configuring-npm/package-json#dependencies the version of a dependency can be various things:
- URLs as Dependencies: "http://asdf.com/asdf.tar.gz",
- Git URLs as Dependencies: See https://docs.npmjs.com/cli/v7/configuring-npm/package-json#git-urls-as-dependencies ... this is using a VCS_URL-os-SPDX and pip-like syntax
- GitHub URLs: user/repo#feature\/branch
- Local Paths: "bar": "file:../foo/bar" ....
These versions end up in the package-lock.json too and they are not really versions.
We should instead treat them as requirements and not as concrete versions.
This is also impacting ScanCode.io BTW
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.