aboutcode-org / aboutcode-org/scancode-toolkit
Support npm dependencies with "weird" versions
- Langage dominant
- Python
- Étoiles
- 2.6k
- Forks
- 791
- Merge moyen
- 1 j 12 h
- PR mergées (30 j)
- 5
Description
Per https://docs.npmjs.com/cli/v7/configuring-npm/package-json#dependencies the version of a dependency can be various things:
- URLs as Dependencies: "http://asdf.com/asdf.tar.gz",
- Git URLs as Dependencies: See https://docs.npmjs.com/cli/v7/configuring-npm/package-json#git-urls-as-dependencies ... this is using a VCS_URL-os-SPDX and pip-like syntax
- GitHub URLs: user/repo#feature\/branch
- Local Paths: "bar": "file:../foo/bar" ....
These versions end up in the package-lock.json too and they are not really versions.
We should instead treat them as requirements and not as concrete versions.
This is also impacting ScanCode.io BTW
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.