GDT / URI-PackageURL-2.26 / Changes 
Change history for URI-PackageURL

2.26 2026-10-16
    - PURL: Improved component validation and percent-encoding
    - PURL: Added UTF-8 support (RFC 3629) in components, "purl-tool" input and output
    - PURL: Added "is_purl" utility and validation flag (enabled by default) in
      "URI::PackageURL->from_string" and "decode_purl"
    - PURL: Reduced execution time by ~39% for "URI::PackageURL::Type"
    - PURL: FIX "0" value lost in namespace, name, version, qualifiers and subpath
    - PURL: FIX "clone" and qualifiers modified by "new" and "to_string"
    - PURL: FIX missing "URI::VersionRange" import ("vers" qualifier)
    - PURL: FIX "URI::PackageURL::Type->validate" default "pkg" scheme'
    - VERS: FIX code injection via "scheme" in "URI::VersionRange::Version->load"
      (removed string eval)
    - VERS: FIX "vers:none/*" contained all versions (vers-spec: no versions)
    - VERS: Added "is_vers" utility and "scheme" validation (aligned to vers-spec "type")
    - VERS: Added "semver", "npm", "intdot", "lexicographic" and "datetime" scheme comparators
    - VERS: The scheme comparator class is now used by "contains", "to_string" (sort),
      "version_compare" and "from_native" (if implemented)
    - VERS: Improved scheme comparator class loading ("." and "-" in scheme, croak on
      load errors)
    - VERS: FIX percent-encoding (vers-spec canonical form, decoded exactly once) and
      added UTF-8 support
    - VERS: FIX constraint parser (croak on empty version)
    - VERS: FIX "alpm" and "pypi" schemes compared as SemVer
    - VERS: FIX "vers-tool --contains" fallback comparator warning
    - VERS: FIX npm/semver native range intersection (eg. ">=5.0.3 >=4.2.1" --> "vers:npm/>=5.0.3")
      and croak on unsatisfiable ranges
    - VERS: Improved "pypi" and "generic" schema and "gem" native range
    - Synced PURL and VERS spec and tests, switched to "purl-test.schema-0.2.json"
    - Improved tests ("parse" vers-spec tests, experimental PURL examples) and disabled
      "legacy" PURL test suite

2.25 2026-01-26
    - Added missing import (@gregoa patch applied from Debian Perl Group -
      liburi-packageurl-perl) - giterlizzi/perl-URI-PackageURL#22
    - Updated documentations
    - FIX MANIFEST

2.24 2026-01-25
    - Imported all PURL type definition files from https://package-url/purl-spec
    - Added "URI::PackageURL::Type" helper class for normalize components,
      validation and load the using PURL type definition schema file, generate
      repository or download URLs and more
    - Added "validate" param in "URI::PackageURL->new"
    - Added "--validate" option to "purl-tool(1)" for check if the provided PURL
      string is valid using the exit code ("0" - valid, "1" not valid)
    - Added "--info TYPE" option to "purl-tool(1)" for display information about
      provided PURL type (allowed components, repository, examples, etc.)
    - Improved man pages for "purl-tool(1)" and "vers-tool(1)"
    - Added PURL test cases from https://github.com/package-url/purl-spec (package-url/purl-spec#514)
    - Added VERS test cases from https://github.com/package-url/vers-spec (package-url/vers-spec#28)
    - Improved 'name' and 'namespace' parsing (package-url/purl-spec#582 - package-url/purl-spec#583)
    - FIX NPM PURL string parser
    - Writes some debug messages when checksums are not formatted correctly and
      if there are unknown qualifiers.
    - Added "URI::VersionRange->from_native" method
    - Added "PURL" and "VERS" package alias for "URI::PackageURL" and "URI::VersionRange"
    - Sync with PURL v1.0.0 spec
    - Sync with VERS main spec

2.23 2025-07-11
    - Updated CPAN PURL type spec
    - Added PURL_LEGACY_CPAN_TYPE env
    - Added "to_hash" helper
    - Use "checksum" qualifier as singular (giterlizzi/perl-URI-PackageURL#15)
    - Added getter/setter methods for PURL components (giterlizzi/perl-URI-PackageURL#16)
    - Improved the support of "vers" qualifier (giterlizzi/perl-URI-PackageURL#17)
    - Improved encoding
    - Added support for "vers:none/*" and "vers:all/*" in "URI::VersionRange"
    - Improved version comparator class loader in "URI::VersionRange"
    - Updated tests
    - Synced "test-suite-data.json" from "package-url/purl-spec"

2.22 2024-12-16
    - Improved parsing of non-canonical PURL (package-url/purl-spec#363)
    - Improved "URI::VersionRange->constraint_contains"
    - Updated "maven" repository URL
    - FIX typo in documentation
    - Synced "test-suite-data.json" from "package-url/purl-spec"

2.21 2024-07-24
    - Use RFC 2119 terms for CPAN purl type specification (sjn)
    - Added "swid" purl type support
    - Moved normalization and validation check in "URI::PackageURL::Util"
    - Dropped support for "version_prefix" qualifier for "github", "gitlab" and
      "bitbucket" PURL types in "purl_to_urls" util (pombredanne via giterlizzi/perl-URI-PackageURL#14)

2.20 2024-05-13
    - Added support for the official "cpan" PURL type specification (giterlizzi/perl-URI-PackageURL#8)
    - Added "Version Range" (vers) support (giterlizzi/perl-URI-PackageURL#12)
    - Added "URI::VersionRange::Version::cpan" version comparator for "cpan" scheme
    - Added "vers-tool(1)"
    - FIX Apply percent-encoding in "subpath" in "to_string" method

2.11 2024-04-19
    - Improved the cpan PURL type to be compatible with the 'PURL-TYPES' specification
      (giterlizzi/perl-URI-PackageURL#8 - https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst)
    - Added "luarocks" PURL type support
    - Improved test suite (giterlizzi/perl-URI-PackageURL#11)
    - Renamed CLI package in "URI::PackageURL::App"
    - Changed JSON module pre-requisite to "JSON::PP" to be compatible with CPAN Toolchain
      (giterlizzi/perl-URI-PackageURL#12)

2.04 2023-11-16
    - Added "docker", "bitbuket", "golang" support to
      "URI::PackageURL::Util::purl_to_urls"
    - Added new options for create canonical purl string using "purl-tool(1)"
      (giterlizzi/perl-URI-PackageURL#9)
    - Added sample scripts
    - Removed empty "qualifier" keys in "URI::PackageURL->from_string"

2.03 2023-11-09
    - Improved validation during encode and decode "purl" string
    - Fixed CPAN repository URL
    - FIX Qualifiers are case sensitive
      (giterlizzi/perl-URI-PackageURL#4)
    - FIX PURLs containing multiple namespaces segments parse incorrectly
      (giterlizzi/perl-URI-PackageURL#5)
    - FIX Incorrect parsing of PURLs that begin with "pkg:/"
      (giterlizzi/perl-URI-PackageURL#6)
    - Improved "t/99-official-purl-test-suite.t" test

2.02 2023-09-22
    - Added core "JSON" module prerequisite in Makefile.PL (#4)

2.01 2023-09-17
    - Added "repository_url" qualifier support for "cpan" PURL type

2.00 2023-06-13
    - Added "purl-tool(1)" (giterlizzi/perl-URI-PackageURL#3)
    - Added "URI::PackageURL::Util::purl_to_urls" helper
    - Fixed name qualifier for "cpan" (giterlizzi/perl-URI-PackageURL#2)
    - Fixed some little issues

1.10 2022-08-01
    - Fixed "namespace vs name" (RT#143917)
    - Fixed substitution warning when "version" component is not provided
      in URI::PackageURL->from_string

1.02 2022-07-31
    - Fixed decode when "namespace" component is "undef"

1.01 2022-07-26
    - Fixed documentation and test prerequisite (JSON::PP)

1.00 2022-07-25
    - First release of URI::PackageURL