Skip to content

feat: adopt proper handling of npm manifest repository #1119

@jkowalleck

Description

@jkowalleck

https://github.com/CycloneDX/cyclonedx-node-npm/releases/edit/v1.19.2 introduced a fix

CycloneDX externalReferences for vcs type (#1198 via #1202)


this was a quick fix to a larger problem: NPM manifest's repository is not guaranteed to be a URL.
see https://docs.npmjs.com/cli/v10/configuring-npm/package-json#repository

The URL should be a publicly available (perhaps read-only) URL that can be handed directly to a VCS program without any modification.

so valid values could be like git@gitlab.example.com:user/project.git.

the shortcuts with alternative protocols (github:, gitlab:, etc) are out of scope, they are expected to be normalized before processing.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions