ghostpkg 0.19.2__tar.gz → 0.20.0__tar.gz

{ghostpkg-0.19.2 → ghostpkg-0.20.0}/CHANGELOG.md

@@ -6,6 +6,83 @@ this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.20.0] - 2026-09-03
+
+Four defects found by scanning **10,109 packages** across `vercel/next.js`,
+`home-assistant/core` and `getsentry/sentry`. Those three repositories produced
+53 blocks and **every one of them was false**. None of these shapes occur in a
+small synthetic manifest, which is why 571 tests and a 35-check acceptance pass
+had missed all four.
+
+### Fixed
+- **`ghostpkg check -e npm "@scope/name"` reported success having checked
+  nothing.** The names went through the PEP 508 requirements parser, whose
+  pattern demands an alphanumeric first character, so every scoped npm name was
+  dropped in silence -- the run printed "all 0 packages look fine" and exited
+  0. On the command this tool is named for, and for a quarter of the npm
+  namespace. A false all-clear is worse than any false positive, and this is
+  the most serious defect the project has shipped.
+- **A pinned version was compared as text rather than as a version.**
+  `aiopurpleair==2025.08.1` was blocked as non-existent while `pip download`
+  installed it happily: PyPI stores the canonical `2025.8.1`. Comparison now
+  normalises both sides -- leading zeros, a leading `v`, `-`/`_` separators and
+  the pre-release spellings. Three such pins sit in unmodified Home Assistant
+  requirements, and a false block breaks a build.
+- **A package the checkout provides itself is no longer looked up.** All three
+  names blocked in a 6,335-package scan of `vercel/next.js` were the
+  repository's own packages, `@next/font` among them. A monorepo depends on
+  itself, and not always through `workspace:*` -- an exact pin is just as
+  common. Names declared by any `package.json` or `pyproject.toml` in the scan
+  are now excluded, which is the same rule as `workspace:` stated differently.
+- **`MANIFEST.in` is no longer read as a requirements file.** `.in` is the
+  pip-tools convention and also the extension of a packaging directives file.
+  Read as requirements it reported `graft` as a package that exists -- there is
+  a real project of that name -- and blocked `recursive-exclude`.
+
+### Documentation
+- The `--json` example showed the bare array from before 0.14.0. It is a
+  `{schema, tool, summary, findings}` envelope, and the documented example now
+  matches, including `source` and `line`.
+
+605 tests.
+
+## [0.19.3] - 2026-09-03
+
+Found by reviewing the published 0.19.2 rather than the working tree. Two of
+the four are false blocks, which this project treats as its worst failure, and
+both have the same cause: `jslocks.py` was written after the test file that
+exists to defend the rule "a dependency naming its own source is not the
+registry's business", so `yarn.lock` and `pnpm-lock.yaml` were never covered by
+it.
+
+### Fixed
+- **A yarn `owner/repo#ref` dependency was blocked.** GitHub shorthand was
+  handled for `package.json` and missed in `yarn.lock`, so
+  `internal-lib@acme/internal-lib#v1.2.3` was looked up on npmjs, found absent,
+  and reported as a package that does not exist.
+- **A pnpm git or URL dependency produced a nonsense package name.** The
+  protocol is only a prefix in lockfile v5; from v6 it follows `name@`, so the
+  guard never fired. `github.com/acme/forked/abc123` was read as a package
+  called `github.com/acme/forked`, and
+  `foo@https://codeload.github.com/...` as one called
+  `foo@https://codeload.github.com/acme/foo`. Both were then blocked.
+- **`--timeout` did nothing.** `def _get_json(url, timeout=TIMEOUT)` bound the
+  module global once, at import; the CLI assigned `registries.TIMEOUT` and
+  nothing ever re-read it, so every request used 15 seconds regardless.
+- **`.windsurfrules` was found and never scanned.** The directory search
+  offered it up, the parser refused it, and the CLI ignores an unreadable
+  *discovered* file on purpose -- so nothing was printed. There is now a test
+  asserting that every file the search returns can actually be parsed.
+
+### Added
+- End-to-end tests for suppression. The ignore file was loaded and applied in
+  `main()` only, and nothing asserted its effect on a verdict or an exit code:
+  the entire policy call could be replaced with `used = []` and all 539 tests
+  still passed. Three tests now cover the real path, and they fail against that
+  stub.
+
+571 tests.
+
 ## [0.19.2] - 2026-09-02
 
 Found by throwing hostile input at the parsers rather than by reading them.
@@ -733,7 +810,9 @@ First release.
 - No corpus of hallucinated package names is shipped, following the decision of
   the USENIX'25 authors not to publish theirs.
 
-[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.19.2...HEAD
+[Unreleased]: https://github.com/M1rwana12/ghostpkg/compare/v0.20.0...HEAD
+[0.20.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.20.0
+[0.19.3]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.19.3
 [0.19.2]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.19.2
 [0.19.1]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.19.1
 [0.19.0]: https://github.com/M1rwana12/ghostpkg/releases/tag/v0.19.0

{ghostpkg-0.19.2 → ghostpkg-0.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ghostpkg
-Version: 0.19.2
+Version: 0.20.0
 Summary: Catch package names that do not exist before you install them
 Project-URL: Homepage, https://github.com/m1rwana12/ghostpkg
 Project-URL: Issues, https://github.com/m1rwana12/ghostpkg/issues
@@ -340,19 +340,32 @@ malformed file **stops the run** rather than quietly leaving you unprotected.
 ### JSON output
 
 ```console
-$ ghostpkg check somepkgthatisnotreal9911 --json
-[
-  {
-    "name": "somepkgthatisnotreal9911",
-    "ecosystem": "pypi",
-    "verdict": "BLOCK",
-    "reasons": [
-      "does not exist on pypi"
-    ]
-  }
-]
+$ ghostpkg scan requirements.txt --json
+{
+  "schema": 1,
+  "tool": { "name": "ghostpkg", "version": "0.20.0" },
+  "summary": { "checked": 2, "blocked": 1, "warned": 0, "errored": 0 },
+  "findings": [
+    {
+      "name": "somepkgthatisnotreal9911",
+      "ecosystem": "pypi",
+      "verdict": "BLOCK",
+      "source": "requirements.txt",
+      "line": 2,
+      "exists": false,
+      "latest_version": null,
+      "reasons": [
+        { "rule": "GP001", "text": "does not exist on pypi" }
+      ]
+    }
+  ]
+}
 ```
 
+`schema` is there so a consumer can tell what it is reading; `source` and
+`line` say where the name was written. `--format github` emits workflow
+commands instead, and `--format text` is the default.
+
 ---
 
 ## Every signal it checks

{ghostpkg-0.19.2 → ghostpkg-0.20.0}/README.en.md

@@ -292,19 +292,32 @@ malformed file **stops the run** rather than quietly leaving you unprotected.
 ### JSON output
 
 ```console
-$ ghostpkg check somepkgthatisnotreal9911 --json
-[
-  {
-    "name": "somepkgthatisnotreal9911",
-    "ecosystem": "pypi",
-    "verdict": "BLOCK",
-    "reasons": [
-      "does not exist on pypi"
-    ]
-  }
-]
+$ ghostpkg scan requirements.txt --json
+{
+  "schema": 1,
+  "tool": { "name": "ghostpkg", "version": "0.20.0" },
+  "summary": { "checked": 2, "blocked": 1, "warned": 0, "errored": 0 },
+  "findings": [
+    {
+      "name": "somepkgthatisnotreal9911",
+      "ecosystem": "pypi",
+      "verdict": "BLOCK",
+      "source": "requirements.txt",
+      "line": 2,
+      "exists": false,
+      "latest_version": null,
+      "reasons": [
+        { "rule": "GP001", "text": "does not exist on pypi" }
+      ]
+    }
+  ]
+}
 ```
 
+`schema` is there so a consumer can tell what it is reading; `source` and
+`line` say where the name was written. `--format github` emits workflow
+commands instead, and `--format text` is the default.
+
 ---
 
 ## Every signal it checks

{ghostpkg-0.19.2 → ghostpkg-0.20.0}/ghostpkg/__init__.py

@@ -1,6 +1,6 @@
 """ghostpkg -- catch package names that do not exist before you install them."""
 
-__version__ = "0.19.2"
+__version__ = "0.20.0"
 
 from .assess import Finding, Verdict, assess
 from .registries import PackageFacts, RegistryError, fetch

{ghostpkg-0.19.2 → ghostpkg-0.20.0}/ghostpkg/cli.py

@@ -15,7 +15,13 @@ from . import __version__, registries
 from .assess import Finding
 from .cache import Cache
 from .discover import discover
-from .manifests import UnsupportedManifest, load_manifest, parse_requirements
+from .manifests import (
+    UnsupportedManifest,
+    declared_name,
+    load_manifest,
+    parse_npm_names,
+    parse_requirements,
+)
 from .policy import PolicyError, apply as apply_policy, load as load_policy
 from .report import Palette, as_github, as_json, render, summarise, use_colour
 from .scanner import DEFAULT_WORKERS, evaluate
@@ -134,6 +140,16 @@ def main(argv: list[str] | None = None) -> int:
             print(f"ghostpkg: no manifests found in {where}", file=sys.stderr)
             return EXIT_NOTHING_SCANNED
 
+        # Names the checkout provides itself. A monorepo depends on its own
+            # packages, and not always through `workspace:*` -- an exact pin is
+            # just as common, and looking those up on the public registry
+            # blocked every one of them.
+        local: set[str] = set()
+        for path in paths:
+            own = declared_name(path)
+            if own:
+                local.add(own.lower())
+
         for path in paths:
             try:
                 found, ecosystem = load_manifest(path)
@@ -151,6 +167,8 @@ def main(argv: list[str] | None = None) -> int:
                     return EXIT_ERROR
                 continue
             for requirement in found:
+                if requirement.name.lower() in local:
+                    continue  # provided by this checkout
                 by_ecosystem.setdefault(
                     requirement.ecosystem or ecosystem, []
                 ).append(requirement)
@@ -162,7 +180,15 @@ def main(argv: list[str] | None = None) -> int:
             return EXIT_NOTHING_SCANNED
     else:
         # Accept a pin on the command line too: `ghostpkg check requests==2.31.0`.
-        by_ecosystem[args.ecosystem] = parse_requirements("\n".join(args.names))
+        # npm names go through their own reader, because a scoped name is not
+        # expressible in PEP 508 and the requirements parser dropped every one.
+        if args.ecosystem == "npm":
+            by_ecosystem[args.ecosystem] = parse_npm_names(args.names)
+        else:
+            by_ecosystem[args.ecosystem] = parse_requirements("\n".join(args.names))
+        if not by_ecosystem[args.ecosystem]:
+            print(f"ghostpkg: no package names in {' '.join(args.names)}", file=sys.stderr)
+            return EXIT_NOTHING_SCANNED
 
     try:
         policy, policy_path = load_policy(args.config)

{ghostpkg-0.19.2 → ghostpkg-0.20.0}/ghostpkg/jslocks.py

@@ -1,156 +1,187 @@
-"""`pnpm-lock.yaml` and `yarn.lock`, read as text.
-
-Measured across twenty popular JavaScript repositories, `package-lock.json` --
-the only npm lockfile ghostpkg could read -- was present in two of them.
-`pnpm-lock.yaml` was in ten and `yarn.lock` in six, so four out of five projects
-had a lockfile the tool refused. Lockfiles are the list that matters, because CI
-installs from them and they name transitive dependencies a manifest never
-mentions.
-
-Both formats are read line by line rather than with a YAML library, for the same
-reason `pyproject.toml` has a hand-written fallback: a supply-chain tool that
-installs a dependency tree of its own undermines its own argument. Neither
-format needs general YAML -- the part worth reading is a list of keys.
-
-Every entry states its own source, and this module applies the same rule the
-rest of the parsers do: a name resolved from a workspace, a directory, a patch
-or a git host is not a registry name, so the registry has no say. Both formats
-carry that inline, and both were confirmed to do so in real files:
-`"eslint-plugin-react-internal@link:./scripts/eslint-rules"` in React's classic
-lockfile, `"@babel/benchmark@workspace:..."` in Babel's berry one.
-"""
-
-from __future__ import annotations
-
-import re
-
-from .manifests import Requirement, npm_alias_target, strip_bom
-
-#: A yarn descriptor protocol that resolves somewhere other than the registry.
-#: `exec:` and `patch:` are berry-only; the rest appear in both versions.
-YARN_LOCAL = (
-    "workspace:", "link:", "portal:", "file:", "patch:", "exec:",
-    "git+", "git:", "http://", "https://",
-    "github:", "gitlab:", "bitbucket:",
-)
-
-#: pnpm writes the same protocols into its keys, minus yarn's own inventions.
-PNPM_LOCAL = ("file:", "link:", "http://", "https://", "git+", "git:")
-
-#: In a pnpm key the version always starts with a digit, which is what tells a
-#: scoped name apart from its version: `@babel/parser@7.29.3` splits at the
-#: second `@`, not the first. Peer suffixes -- `(react@18.2.0)` in v9,
-#: `_react@18.2.0` in v5 -- come after it and must not be split on.
-PNPM_VERSION_AT = re.compile(r"(?<=.)@(?=\d)")
-
-
-def _yarn_descriptor(text: str) -> "tuple[str, str] | None":
-    """`(name, range)` from `name@range`, keeping a leading scope `@`.
-
-    The split is at the *first* `@` past position zero. Taking the last one
-    reads `@babel-baseline/cli@npm:@babel/cli@7.27.1` -- a real entry in
-    Babel's lockfile -- as a package called
-    `@babel-baseline/cli@npm:@babel/cli`.
-    """
-    text = text.strip().strip('"').strip("'")
-    at = text.find("@", 1)
-    if at < 1:
-        return None
-    return text[:at], text[at + 1 :]
-
-
-def parse_yarn_lock(text: str, source: str | None = None) -> list[Requirement]:
-    """Dependencies from a `yarn.lock`, classic (v1) or berry (v2+).
-
-    Both write entries as a key at column zero holding one or more
-    comma-separated descriptors. Classic writes the raw range (`lodash@^4.17.19`),
-    berry prefixes the protocol (`lodash@npm:^4.17.19`), and berry also uses the
-    descriptor to alias: `@babel-baseline/cli@npm:@babel/cli@7.27.1` installs
-    `@babel/cli`, which is the name worth checking.
-    """
-    found: list[Requirement] = []
-    seen: set[str] = set()
-
-    for raw in strip_bom(text).splitlines():
-        if not raw or raw[0] in " \t#" or not raw.rstrip().endswith(":"):
-            continue
-        line = raw.rstrip()[:-1].strip()
-        if not line or line.startswith("__metadata"):
-            continue
-
-        for part in line.split(","):
-            parsed = _yarn_descriptor(part)
-            if parsed is None:
-                continue
-            name, spec = parsed
-            if spec.startswith(YARN_LOCAL):
-                continue  # a protocol, so not a registry name
-            if spec.startswith("npm:"):
-                alias = npm_alias_target(spec)
-                if alias is not None:
-                    name = alias
-            if name and name not in seen:
-                seen.add(name)
-                found.append(Requirement(name=name, source=source))
-
-    return found
-
-
-def parse_pnpm_lock(text: str, source: str | None = None) -> list[Requirement]:
-    """Dependencies from a `pnpm-lock.yaml`.
-
-    Only the `packages:` block is read: it is the resolved set, and unlike
-    `dependencies:` it names transitive packages too. Three key shapes exist
-    across lockfile versions, all seen in the wild:
-
-        /react/18.2.0:          v5
-        /react@18.2.0:          v6
-        'react@18.2.0':         v9
-
-    v9 appends peer resolutions in parentheses and v5 after an underscore, so
-    the split is made at the `@` that starts the version rather than the last
-    one in the line.
-    """
-    found: list[Requirement] = []
-    seen: set[str] = set()
-    in_packages = False
-
-    for raw in strip_bom(text).splitlines():
-        stripped = raw.strip()
-        if not stripped or stripped.startswith("#"):
-            # A blank line does not end the block. Treating one as a
-            # column-zero key closed `packages:` at the first gap between
-            # entries, and every real lockfile has one there -- the parser
-            # returned nothing at all for all three files tested.
-            continue
-        if not raw[:1].isspace():
-            # A column-zero key ends whatever block preceded it.
-            in_packages = stripped == "packages:"
-            continue
-        if not in_packages or not stripped.endswith(":"):
-            continue
-        # Keys sit one level in; anything deeper belongs to an entry's body.
-        if len(raw) - len(raw.lstrip()) != 2:
-            continue
-
-        key = stripped[:-1].strip().strip('"').strip("'")
-        if not key or key.startswith(PNPM_LOCAL):
-            continue
-        key = key.split("(", 1)[0]  # v9 peer resolutions
-        if key.startswith("/"):
-            key = key[1:]
-
-        match = PNPM_VERSION_AT.search(key)
-        if match:
-            name = key[: match.start()]
-        elif "/" in key.lstrip("@"):
-            # v5 keys the version with a slash: @babel/code-frame/7.12.11
-            name = key.rsplit("/", 1)[0]
-        else:
-            continue
-
-        if name and name not in seen:
-            seen.add(name)
-            found.append(Requirement(name=name, source=source))
-
-    return found
+"""`pnpm-lock.yaml` and `yarn.lock`, read as text.
+
+Measured across twenty popular JavaScript repositories, `package-lock.json` --
+the only npm lockfile ghostpkg could read -- was present in two of them.
+`pnpm-lock.yaml` was in ten and `yarn.lock` in six, so four out of five projects
+had a lockfile the tool refused. Lockfiles are the list that matters, because CI
+installs from them and they name transitive dependencies a manifest never
+mentions.
+
+Both formats are read line by line rather than with a YAML library, for the same
+reason `pyproject.toml` has a hand-written fallback: a supply-chain tool that
+installs a dependency tree of its own undermines its own argument. Neither
+format needs general YAML -- the part worth reading is a list of keys.
+
+Every entry states its own source, and this module applies the same rule the
+rest of the parsers do: a name resolved from a workspace, a directory, a patch
+or a git host is not a registry name, so the registry has no say. Both formats
+carry that inline, and both were confirmed to do so in real files:
+`"eslint-plugin-react-internal@link:./scripts/eslint-rules"` in React's classic
+lockfile, `"@babel/benchmark@workspace:..."` in Babel's berry one.
+"""
+
+from __future__ import annotations
+
+import re
+
+from .manifests import (
+    GITHUB_SHORTHAND,
+    Requirement,
+    npm_alias_target,
+    strip_bom,
+)
+
+#: A yarn descriptor protocol that resolves somewhere other than the registry.
+#: `exec:` and `patch:` are berry-only; the rest appear in both versions.
+YARN_LOCAL = (
+    "workspace:", "link:", "portal:", "file:", "patch:", "exec:",
+    "git+", "git:", "http://", "https://",
+    "github:", "gitlab:", "bitbucket:",
+)
+
+#: pnpm writes the same protocols into its keys, minus yarn's own inventions.
+PNPM_LOCAL = ("file:", "link:", "http://", "https://", "git+", "git:")
+
+#: In a pnpm key the version always starts with a digit, which is what tells a
+#: scoped name apart from its version: `@babel/parser@7.29.3` splits at the
+#: second `@`, not the first. Peer suffixes -- `(react@18.2.0)` in v9,
+#: `_react@18.2.0` in v5 -- come after it and must not be split on.
+PNPM_VERSION_AT = re.compile(r"(?<=.)@(?=\d)")
+
+
+def _is_host_path(key: str) -> bool:
+    """`github.com/acme/forked/abc123` -- a v5 git dependency, keyed by host.
+
+    The slash is what gives it away. An unscoped npm name never contains one,
+    and a scoped name starts with `@`, so a key with a slash and no leading `@`
+    is a URL path rather than a package.
+
+    The dot alone is not enough, and testing it alone was wrong: dots are legal
+    and common in real names. Requiring only a dot threw away `big.js`,
+    `array.prototype.concat` and 289 of Svelte's 435 packages.
+    """
+    if key.startswith("@") or "/" not in key:
+        return False
+    return "." in key.split("/", 1)[0]
+
+
+def _yarn_descriptor(text: str) -> "tuple[str, str] | None":
+    """`(name, range)` from `name@range`, keeping a leading scope `@`.
+
+    The split is at the *first* `@` past position zero. Taking the last one
+    reads `@babel-baseline/cli@npm:@babel/cli@7.27.1` -- a real entry in
+    Babel's lockfile -- as a package called
+    `@babel-baseline/cli@npm:@babel/cli`.
+    """
+    text = text.strip().strip('"').strip("'")
+    at = text.find("@", 1)
+    if at < 1:
+        return None
+    return text[:at], text[at + 1 :]
+
+
+def parse_yarn_lock(text: str, source: str | None = None) -> list[Requirement]:
+    """Dependencies from a `yarn.lock`, classic (v1) or berry (v2+).
+
+    Both write entries as a key at column zero holding one or more
+    comma-separated descriptors. Classic writes the raw range (`lodash@^4.17.19`),
+    berry prefixes the protocol (`lodash@npm:^4.17.19`), and berry also uses the
+    descriptor to alias: `@babel-baseline/cli@npm:@babel/cli@7.27.1` installs
+    `@babel/cli`, which is the name worth checking.
+    """
+    found: list[Requirement] = []
+    seen: set[str] = set()
+
+    for raw in strip_bom(text).splitlines():
+        if not raw or raw[0] in " \t#" or not raw.rstrip().endswith(":"):
+            continue
+        line = raw.rstrip()[:-1].strip()
+        if not line or line.startswith("__metadata"):
+            continue
+
+        for part in line.split(","):
+            parsed = _yarn_descriptor(part)
+            if parsed is None:
+                continue
+            name, spec = parsed
+            if spec.startswith(YARN_LOCAL) or GITHUB_SHORTHAND.match(spec):
+                # A protocol, or `owner/repo#ref` shorthand. Both name their
+                # own source. The shorthand was handled for package.json and
+                # missed here, so a private repository dependency was looked
+                # up on npmjs and blocked.
+                continue
+            if spec.startswith("npm:"):
+                alias = npm_alias_target(spec)
+                if alias is not None:
+                    name = alias
+            if name and name not in seen:
+                seen.add(name)
+                found.append(Requirement(name=name, source=source))
+
+    return found
+
+
+def parse_pnpm_lock(text: str, source: str | None = None) -> list[Requirement]:
+    """Dependencies from a `pnpm-lock.yaml`.
+
+    Only the `packages:` block is read: it is the resolved set, and unlike
+    `dependencies:` it names transitive packages too. Three key shapes exist
+    across lockfile versions, all seen in the wild:
+
+        /react/18.2.0:          v5
+        /react@18.2.0:          v6
+        'react@18.2.0':         v9
+
+    v9 appends peer resolutions in parentheses and v5 after an underscore, so
+    the split is made at the `@` that starts the version rather than the last
+    one in the line.
+    """
+    found: list[Requirement] = []
+    seen: set[str] = set()
+    in_packages = False
+
+    for raw in strip_bom(text).splitlines():
+        stripped = raw.strip()
+        if not stripped or stripped.startswith("#"):
+            # A blank line does not end the block. Treating one as a
+            # column-zero key closed `packages:` at the first gap between
+            # entries, and every real lockfile has one there -- the parser
+            # returned nothing at all for all three files tested.
+            continue
+        if not raw[:1].isspace():
+            # A column-zero key ends whatever block preceded it.
+            in_packages = stripped == "packages:"
+            continue
+        if not in_packages or not stripped.endswith(":"):
+            continue
+        # Keys sit one level in; anything deeper belongs to an entry's body.
+        if len(raw) - len(raw.lstrip()) != 2:
+            continue
+
+        key = stripped[:-1].strip().strip('"').strip("'")
+        if not key:
+            continue
+        key = key.split("(", 1)[0]  # v9 peer resolutions
+        if key.startswith("/"):
+            key = key[1:]
+        # The protocol is only a prefix in v5. From v6 it follows `name@`, so
+        # testing the start of the key never fired and the parser fell through
+        # to its slash split -- emitting names like `github.com/acme/forked`,
+        # which were then looked up on npmjs and blocked.
+        if key.startswith(PNPM_LOCAL) or "://" in key or _is_host_path(key):
+            continue
+
+        match = PNPM_VERSION_AT.search(key)
+        if match:
+            name = key[: match.start()]
+        elif "/" in key.lstrip("@"):
+            # v5 keys the version with a slash: @babel/code-frame/7.12.11
+            name = key.rsplit("/", 1)[0]
+        else:
+            continue
+
+        if name and name not in seen:
+            seen.add(name)
+            found.append(Requirement(name=name, source=source))
+
+    return found