Repository navigation
Bump manifests to v0.12.4 and purl to v0.2.1 - #225
Merged
Merged
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues block approval of the submodule identity and dependency updates.
No open issues 🎉
What changed in this PR
Updates dependency parsing and PURL generation so Git submodules are identified by their clone URL’s host and path rather than their local checkout path.
Changes:
- Upgrades
manifeststo v0.12.4 andpurlto v0.2.1, plus indirect dependencydoublestar/v4to v4.10.3. - Updates submodule test expectations to use host/path names and
pkg:git/<host>/<path>PURLs.
| File | Description |
|---|---|
| go.sum | Updates checksums for the upgraded dependencies. |
| go.mod | Bumps the direct and indirect dependency versions. |
| detect/detect_test.go | Aligns submodule dependency expectations with the new identity format. |
Review effort: Balanced
manifests v0.12.4 identifies git submodules by clone URL host/path instead of checkout path, so update the detect test expectations.
andrew
force-pushed
the
bump-manifests-purl
branch
from
November 1, 2026 10:31
5e1b45e to
0f78262
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
manifests v0.12.4 names git submodules by clone URL host/path rather than checkout path (git-pkgs/manifests#129), and purl v0.2.x builds
pkg:git/<host>/<path>from that identity instead of encoding the path with arepository_urlqualifier. UpdatesTestGitSubmoduleManifestDependenciesto expect the new names and PURLs.Also pulls
github.com/bmatcuk/doublestar/v4v4.10.3 as an indirect via manifests.Supersedes #223.