Merge pull request #598 from actions/dependabot/npm_and_yarn/packageurl-js-1.2.0

Bump packageurl-js from 1.0.2 to 1.2.0

dist/index.js

@@ -25029,6 +25029,12 @@ class PackageURL {
   _handlePyPi() {
     this.name = this.name.toLowerCase().replace(/_/g, '-');
   }
+  _handlePub() {
+    this.name = this.name.toLowerCase();
+    if (!/^[a-z0-9_]+$/i.test(this.name)) {
+      throw new Error('Invalid purl: contains an illegal character.');
+    }
+  }
 
   toString() {
     var purl = ['pkg:', encodeURIComponent(this.type), '/'];
@@ -25036,6 +25042,9 @@ class PackageURL {
     if (this.type === 'pypi') {
       this._handlePyPi();
     }
+    if (this.type === 'pub') {
+      this._handlePub();
+    }
 
     if (this.namespace) {
       purl.push(
@@ -25128,7 +25137,18 @@ class PackageURL {
     let version = null;
     if (path.includes('@')) {
       let index = path.indexOf('@');
-      version = decodeURIComponent(path.substring(index + 1));
+      let rawVersion= path.substring(index + 1);
+      version = decodeURIComponent(rawVersion);
+
+      // Convert percent-encoded colons (:) back, to stay in line with the `toString`
+      // implementation of this library.
+      // https://github.com/package-url/packageurl-js/blob/58026c86978c6e356e5e07f29ecfdccbf8829918/src/package-url.js#L98C10-L98C10
+      let versionEncoded = encodeURIComponent(version).replace(/%3A/g, ':');
+
+      if (rawVersion !== versionEncoded) {
+        throw new Error('Invalid purl: version must be percent-encoded');
+      }
+
       remainder = path.substring(0, index);
     } else {
       remainder = path;

package-lock.json

@@ -19,7 +19,7 @@
         "got": "^13.0.0",
         "jest": "^29.7.0",
         "octokit": "^3.1.1",
-        "packageurl-js": "^1.0.2",
+        "packageurl-js": "^1.2.0",
         "spdx-expression-parse": "^3.0.1",
         "spdx-satisfies": "^5.0.1",
         "ts-jest": "^29.1.1",
@@ -6929,9 +6929,9 @@
       }
     },
     "node_modules/packageurl-js": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-1.0.2.tgz",
-      "integrity": "sha512-fWC4ZPxo80qlh3xN5FxfIoQD3phVY4+EyzTIqyksjhKNDmaicdpxSvkWwIrYTtv9C1/RcUN6pxaTwGmj2NzS6A=="
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-1.2.0.tgz",
+      "integrity": "sha512-JFoZnz1maKB0hTjn0YrmqRLgiU825SkbA370oe9ERcsKsj1EcBpe+CDo1EK9mrHc+18Hi5NmZbmXFQtP7YZEbw=="
     },
     "node_modules/parent-module": {
       "version": "1.0.1",

package.json

@@ -35,7 +35,7 @@
     "got": "^13.0.0",
     "jest": "^29.7.0",
     "octokit": "^3.1.1",
-    "packageurl-js": "^1.0.2",
+    "packageurl-js": "^1.2.0",
     "spdx-expression-parse": "^3.0.1",
     "spdx-satisfies": "^5.0.1",
     "ts-jest": "^29.1.1",