DRUPAL vulnerabilities are often not on the default packagist.org repository, but this information is dropped when we generate the PURLs for them.
e.g. DRUPAL-CONTRIB-2026-079 affects ecosystems Packagist:https://packages.drupal.org/8, but the generated PURL uses the generic composer PURL type without any qualifiers - pkg:composer/drupal/commerce_guest_registration.
From my reading of the packageurl spec, the unqualified composer type refers to packagist.org, but we can use a repository_url qualifier to point to a specific repository
In that example, the generated PURL should probably be pkg:composer/drupal/commerce_guest_registration?repository_url=https://packages.drupal.org/8
We also would want to make the PURL -> OSV conversion grab this field, so API queries with PURLs work as expected.
DRUPAL vulnerabilities are often not on the default packagist.org repository, but this information is dropped when we generate the PURLs for them.
e.g. DRUPAL-CONTRIB-2026-079 affects ecosystems
Packagist:https://packages.drupal.org/8, but the generated PURL uses the generic composer PURL type without any qualifiers -pkg:composer/drupal/commerce_guest_registration.From my reading of the packageurl spec, the unqualified
composertype refers topackagist.org, but we can use arepository_urlqualifier to point to a specific repositoryIn that example, the generated PURL should probably be
pkg:composer/drupal/commerce_guest_registration?repository_url=https://packages.drupal.org/8We also would want to make the PURL -> OSV conversion grab this field, so API queries with PURLs work as expected.