From 25ad4373e27bf7161132b01c442ef36d7f4eb84d Mon Sep 17 00:00:00 2001 From: Andrew Nesbitt Date: Sun, 16 Aug 2026 23:26:20 +0100 Subject: [PATCH] Bump github.com/git-pkgs/purl to v0.1.17 MakePURL/MakePURLString/New now apply the same per-type normalization as Parse (git-pkgs/purl#30), so canonicalPackagePURL no longer needs its own Normalize call and DB writes/lookups produce canonical keys. Existing rows written under a non-canonical purl (mixed-case pypi, composer, etc) become cache misses on lookup and re-populate under the canonical key on the next fetch; the old rows are left in place. Closes #207 --- go.mod | 2 +- go.sum | 4 ++-- internal/handler/handler.go | 4 +--- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 0bb2e1b..c8bb4f6 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/git-pkgs/cooldown v0.1.1 github.com/git-pkgs/enrichment v0.6.5 github.com/git-pkgs/magic v0.2.0 - github.com/git-pkgs/purl v0.1.16 + github.com/git-pkgs/purl v0.1.17 github.com/git-pkgs/registries v0.7.0 github.com/git-pkgs/spdx v0.3.1 github.com/git-pkgs/vers v0.3.1 diff --git a/go.sum b/go.sum index 1ff787f..699e1cc 100644 --- a/go.sum +++ b/go.sum @@ -256,8 +256,8 @@ github.com/git-pkgs/packageurl-go v0.3.1 h1:WM3RBABQZLaRBxgKyYughc3cVBE8KyQxbSC6 github.com/git-pkgs/packageurl-go v0.3.1/go.mod h1:rcIxiG37BlQLB6FZfgdj9Fm7yjhRQd3l+5o7J0QPAk4= github.com/git-pkgs/pom v0.1.5 h1:TGT8Az2OMxGWsXnSagtUMGzZm7Oax8HrSCteA+mi0qY= github.com/git-pkgs/pom v0.1.5/go.mod h1:ufdMBe1lKzqOeP9IUb9NPZ458xKV8E8NvuyBMxOfwIk= -github.com/git-pkgs/purl v0.1.16 h1:VAX6tv0hhdTENbkrGMoPZbOAl1Y8U1/ZnzoCsYuNBYM= -github.com/git-pkgs/purl v0.1.16/go.mod h1:7u7ora8tQdrkS7Auclr5v8dCJdjN4ej6AbrvYZi2b7k= +github.com/git-pkgs/purl v0.1.17 h1:oRSd8tqllTLl74Wa4WnuqU500hXd9OdUnImOEswQUVE= +github.com/git-pkgs/purl v0.1.17/go.mod h1:7u7ora8tQdrkS7Auclr5v8dCJdjN4ej6AbrvYZi2b7k= github.com/git-pkgs/registries v0.7.0 h1:+LbOOMHbvjmXGfsi88hcGH+SfTXYsXA3UY5KYI5mB7s= github.com/git-pkgs/registries v0.7.0/go.mod h1:VCD4q+ZW0fInopzseg9rAmBEL553R2JQe60UHXtv26w= github.com/git-pkgs/spdx v0.3.1 h1:58JPY5X9pYpXvnzzZIgehItlBykeOOw52pNc4OBcS+c= diff --git a/internal/handler/handler.go b/internal/handler/handler.go index 8dcc9c9..cfbe5e0 100644 --- a/internal/handler/handler.go +++ b/internal/handler/handler.go @@ -61,9 +61,7 @@ var artifactCopyBufferPool = sync.Pool{ //nolint:gochecknoglobals // shared acro // canonicalPackagePURL returns a versionless PURL in canonical form so cooldown // lookups match keys produced by config.CooldownConfig.NormalizedPackages. func canonicalPackagePURL(ecosystem, name string) string { - p := purl.MakePURL(ecosystem, name, "") - _ = p.Normalize() - return p.String() + return purl.MakePURLString(ecosystem, name, "") } const contentTypeJSON = "application/json"