fix(purl): encode gitmodules PURLs and drop pnpm's unreachable fallback

src/parsers/gitmodules.rs

@@ -192,7 +192,7 @@ fn parse_github_url(url: &str) -> Option<String> {
         return None;
     };
 
-    Some(truncate_field(format!("pkg:github/{}/{}", namespace, name)))
+    crate::parsers::utils::namespaced_purl("github", &namespace, &name, None).map(truncate_field)
 }
 
 fn parse_gitlab_url(url: &str) -> Option<String> {
@@ -206,7 +206,7 @@ fn parse_gitlab_url(url: &str) -> Option<String> {
         return None;
     };
 
-    Some(truncate_field(format!("pkg:gitlab/{}/{}", namespace, name)))
+    crate::parsers::utils::namespaced_purl("gitlab", &namespace, &name, None).map(truncate_field)
 }
 
 fn parse_repo_path(path: &str) -> Option<(String, String)> {

src/parsers/pnpm_lock.rs

@@ -500,7 +500,7 @@ fn create_simple_dependency(
     let is_optional = scope.as_deref() == Some("optional");
 
     Some(Dependency {
-        purl: Some(purl),
+        purl,
         extracted_requirement: Some(version),
         scope,
         is_runtime: Some(is_runtime),
@@ -631,7 +631,7 @@ pub fn extract_dependency(
     };
 
     let dependency = Dependency {
-        purl: Some(purl),
+        purl,
         extracted_requirement: Some(version),
         scope,
         is_runtime: Some(is_runtime),
@@ -726,7 +726,9 @@ pub fn parse_purl_fields(
     }
 }
 
-pub fn create_purl(namespace: &Option<String>, name: &str, version: &str) -> String {
+/// Builds the npm PURL for a lockfile entry, or `None` when the components
+/// cannot form one.
+pub fn create_purl(namespace: &Option<String>, name: &str, version: &str) -> Option<String> {
     let full_name = match namespace {
         Some(ns) if !ns.is_empty() => {
             let ns_with_at = if ns.starts_with('@') {
@@ -738,7 +740,7 @@ pub fn create_purl(namespace: &Option<String>, name: &str, version: &str) -> Str
         }
         _ => name.to_string(),
     };
-    npm_purl(&full_name, Some(version)).unwrap_or_else(|| format!("pkg:npm/{}", name))
+    npm_purl(&full_name, Some(version))
 }
 
 fn parse_integrity(

src/parsers/pnpm_lock_test.rs

@@ -211,7 +211,8 @@ fn test_parse_purl_fields_v9_multiple_at_symbols() {
 
 #[test]
 fn test_create_purl_scoped() {
-    let purl = create_purl(&Some("@babel".to_string()), "runtime", "7.18.9");
+    let purl = create_purl(&Some("@babel".to_string()), "runtime", "7.18.9")
+        .expect("a scoped package should yield a purl");
     assert!(purl.contains("pkg:npm"));
     assert!(purl.contains("%40babel"));
     assert!(purl.contains("runtime"));
@@ -220,7 +221,8 @@ fn test_create_purl_scoped() {
 
 #[test]
 fn test_create_purl_non_scoped() {
-    let purl = create_purl(&None, "express", "4.18.2");
+    let purl =
+        create_purl(&None, "express", "4.18.2").expect("a plain package should yield a purl");
     assert!(purl.contains("pkg:npm"));
     assert!(purl.contains("express"));
     assert!(purl.contains("4.18.2"));