Repository: lirantal/lockfile-lint
Pull request #204 (2025-04-24 06:35:00)

fix: add missing trailing slash
### **User description**
## Description

Fix missing trailing slash in package name.

![image](https://github.com/user-attachments/assets/b68b8d02-788c-4d7e-96ea-e12a25210b8e)


## Checklist:

- [ x] I have updated the documentation (if required).
- [ x] I have read the **CONTRIBUTING** document.
- [ x] I have added tests to cover my changes.
- [ x] All new and existing tests passed.
- [ x] I added a picture of a cute animal cause it's fun


___

### **PR Type**
Bug fix


___

### **Description**
- Fixes missing trailing slash in resolved package URL validation.

- Updates test to use a more accurate malicious package name.


___



### **Changes walkthrough** 📝
<table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Bug fix</strong></td><td><table>
<tr>
  <td>
    <details>
      <summary><strong>ValidatePackageNames.js</strong><dd><code>Add trailing slash to expected resolved URL prefix</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

packages/lockfile-lint-api/src/validators/ValidatePackageNames.js

<li>Adds a trailing slash to the expected URL prefix for package <br>validation.<br> <li> Ensures stricter matching of resolved package URLs.


</details>


  </td>
  <td><a href="https://github.com/lirantal/lockfile-lint/pull/204/files#diff-7b6dad04db36da63d356f1efef9b4d9c273ebd22c4f0d94ce3f6aa0777f95099">+1/-1</a>&nbsp; &nbsp; &nbsp; </td>

</tr>
</table></td></tr><tr><td><strong>Tests</strong></td><td><table>
<tr>
  <td>
    <details>
      <summary><strong>validators.packageNames.test.js</strong><dd><code>Update test with more accurate malicious package name</code>&nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

packages/lockfile-lint-api/__tests__/validators.packageNames.test.js

<li>Changes test malicious package name from 'malicious' to 'meowlicious'.<br> <li> Improves test accuracy for package name validation.


</details>


  </td>
  <td><a href="https://github.com/lirantal/lockfile-lint/pull/204/files#diff-d81a81eb8fabd55cbb36bdbe851d7f9440e7b1170a1d858c69b23fa9ed208dd7">+1/-1</a>&nbsp; &nbsp; &nbsp; </td>

</tr>
</table></td></tr></tr></tbody></table>

___

> <details> <summary>  Need help?</summary><li>Type <code>/help how to ...</code> in the comments thread for any questions about Qodo Merge usage.</li><li>Check out the <a href="https://qodo-merge-docs.qodo.ai/usage-guide/">documentation</a> for more information.</li></details>

qodo-merge-pro-for-open-source[bot]: Failed to generate code suggestions for PR
codecov-commenter: ## [Codecov](https://app.codecov.io/gh/lirantal/lockfile-lint/pull/204?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 98.01%. Comparing base [(`89b5cad`)](https://app.codecov.io/gh/lirantal/lockfile-lint/commit/89b5cad028df4d77bab2b73ac93bc61e392668ab?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal) to head [(`c02840f`)](https://app.codecov.io/gh/lirantal/lockfile-lint/commit/c02840f473e45e3ff819c904c3ba34b5c719df5a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal).

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##             main     #204   +/-   ##
=======================================
  Coverage   98.01%   98.01%           
=======================================
  Files          13       13           
  Lines         403      403           
  Branches       96       96           
=======================================
  Hits          395      395           
  Misses          8        8           
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/lirantal/lockfile-lint/pull/204?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal).

<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>

Patch:
diff --git a/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js b/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js
index 8a68a1d..4a5143d 100644
--- a/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js
+++ b/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js
@@ -53,7 +53,7 @@ module.exports = class ValidatePackageNames {
 
         const packageNameOnly = this._getPackageNameOnly(packageName)
 
-        const expectedURLBeginning = `${packageResolvedURL.origin}/${packageNameOnly}`
+        const expectedURLBeginning = `${packageResolvedURL.origin}/${packageNameOnly}/`
 
         const isPassing = packageMetadata.resolved.startsWith(expectedURLBeginning)
         if (!isPassing) {


Test patch:
diff --git a/packages/lockfile-lint-api/__tests__/validators.packageNames.test.js b/packages/lockfile-lint-api/__tests__/validators.packageNames.test.js
index 2d8e271..bac9f89 100644
--- a/packages/lockfile-lint-api/__tests__/validators.packageNames.test.js
+++ b/packages/lockfile-lint-api/__tests__/validators.packageNames.test.js
@@ -15,7 +15,7 @@ describe('Validator: PackageName', () => {
 
   it('validator should fail if a resolved URL for a different package is found', () => {
     const failedPackage = 'meow'
-    const maliciousPackage = 'malicious'
+    const maliciousPackage = 'meowlicious'
     const mockedPackages = {
       '@babel/code-frame@^0.16.0': {
         resolved: 'https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.0.0.tgz'