How to specify the username of a non-npm dependency

[teepeemm]

Select Topic Area

Question

Body

I'm trying to use package.json to document the dependencies of my non-npm JavaScript project. Based on https://docs.npmjs.com/cli/v10/configuring-npm/package-json#dependencies, I've tried the following:

    "dependencies": {
        "hardhat": "^2.0.1",
        "hardhat-verify": "^2.0.2",
        "@nomicfoundation/hardhat": "^2.0.3",
        "@nomicfoundation/hardhat-verify": "^2.0.4",
        "@nomicfoundation/somethingelse": "^2.0.5",
        "hardhat6": "nomicfoundation/hardhat",
        "hardhat7": "nomicfoundation/hardhat#semver:^2.0.7",
        "hardhat8": "git+https://nomicfoundation@github.com/hardhat",
        "hardhat9": "git+https://nomicfoundation@github.com/hardhat#semver:^2.0.9"
    }

I would expect 1, 3, 6, 7, 8, and 9 to work. Instead, 1 and 4 are the only ones that work (although 4 links to nomicfoundation/hardhat). It seems like the only thing that actually succeeds is a valid npm project as the key and ending with a valid number (although why 4 and not 3 is confusing me).

Since my project is not npm, I have non-npm dependencies that I would like to include. Primarily, this is to get a valid Software Bill of Materials, but it would also be nice to have the dependencies properly linked in my Insights tab (having Dependabot alerts would be great, but probably impractical since I've left the npm ecospace). Unfortunately, my SBOM includes, for example,

        {
            "SPDXID": "SPDXRef-npm-hardhat7",
            "name": "npm:hardhat7",
            "versionInfo": "^ 2.0.7",
            "downloadLocation": "NOASSERTION",
            "filesAnalyzed": false,
            "supplier": "NOASSERTION",
            "externalRefs": [
                {
                    "referenceCategory": "PACKAGE-MANAGER",
                    "referenceLocator": "pkg:npm/hardhat7",
                    "referenceType": "purl"
                }
            ]
        },

which appears to be trying to link to a non-existent npm package. Is there a way to specify a (Git(Hub)) URL as a dependency?

[teepeemm]

I've now also asked this question on StackOverflow: https://stackoverflow.com/q/78916084/2336725

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬