The `allow-dependencies-licenses` option was not checking the namespace part of the PURL to make sure it matched.