aboutcode-org / aboutcode-org/scancode-toolkit
Support npm dependencies with "weird" versions
Đang mở
bug
dependencies
package scan
package-formats
- Ngôn ngữ chính
- Python
- Star
- 2.6k
- Fork
- 791
- Merge trung bình
- 1 ngày 12 giờ
- Pull request đã merge (30 ngày)
- 5
Mô tả
Per https://docs.npmjs.com/cli/v7/configuring-npm/package-json#dependencies the version of a dependency can be various things:
- URLs as Dependencies: "http://asdf.com/asdf.tar.gz",
- Git URLs as Dependencies: See https://docs.npmjs.com/cli/v7/configuring-npm/package-json#git-urls-as-dependencies ... this is using a VCS_URL-os-SPDX and pip-like syntax
- GitHub URLs: user/repo#feature\/branch
- Local Paths: "bar": "file:../foo/bar" ....
These versions end up in the package-lock.json too and they are not really versions.
We should instead treat them as requirements and not as concrete versions.
This is also impacting ScanCode.io BTW
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.