Hi @jscaltreto , thanks for filing a pull request, and my apologies for the delay in reviewing it. Could you provide an example of a situation where package_url is not included but source_repository_url is? I know this would be the case for dependency changes to version ranges (e.g. to a package.json file). Is that what you encountered?

Hi @hmaurer! The example where I encountered this was when using a package directly from a github repo instead of npm as one might do to install an unreleased version of a dependency. Here's a trivial example. In this case, calling the dependency-graph API the result contains:

 {
    "change_type": "added",
    "manifest": "package.json",
    "ecosystem": "npm",
    "name": "octokit",
    "version": "github:octokit/octokit.js#4.0.2",
    "package_url": "",
    "license": null,
    "source_repository_url": "https://github.com/octokit/octokit.js",
    "scope": "runtime",
    "vulnerabilities": []
  }

@jscaltreto I see, thank you for the prompt reply. Let me talk to some people internally about this. I wonder if the right approach here would be for us to change the API so that we'd return a PURL without a version specifier in such cases, similar to what you're doing in this pull request, e.g.

 {
    "change_type": "added",
    "manifest": "package.json",
    "ecosystem": "npm",
    "name": "octokit",
    "version": "github:octokit/octokit.js#4.0.2",
+   "package_url": "pkg:npm/octokit",
    "license": null,
    "source_repository_url": "https://github.com/octokit/octokit.js",
    "scope": "runtime",
    "vulnerabilities": []
  }

Ideally we would include a version specifier but we may not be able to do this in the short term.