fix(gitlab): separate namespace and name with a slash, not a colon

Reverts the separator introduced two commits ago. It rested on a report that the
slash form does not resolve, which has since failed to reproduce: every affected
link in that report loads, and the report's own screenshots show a working
slash-form link.

The defect those links actually exhibit is a namespace and name fused with no
separator at all, which yields one path segment that cannot be split back into
two. A slash fixes that and matches what the other package construction path has
always emitted.

The missing-namespace warning is kept and re-aimed: an absent namespace is what
produces the unsplittable single segment, so that is the case worth surfacing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

CHANGELOG.md

@@ -6,10 +6,10 @@
 
 - Full-scan package identities and Socket links now preserve namespaced packages
   when the SDK returns enum-backed ecosystem values.
-- Maven package links use the `groupId:artifactId` form the Socket dashboard
-  expects. The slash-separated form returned a 404 for every Maven package, on
-  both the full-scan and diff code paths. Purl strings are unchanged and keep the
-  slash form the purl spec defines.
+- Namespaced package links separate the namespace from the name instead of
+  concatenating them, so Maven links no longer fuse groupId and artifactId into a
+  single unresolvable path segment. A namespaced package whose namespace is
+  missing now logs a warning rather than emitting a broken link silently.
 - GitLab dependency-scanning reports emit CVE and GHSA identifiers from current
   API fields while remaining compatible with legacy CVE data.
 - Implicit diff baselines are selected from the same workspace, scan type,

socketsecurity/core/classes.py

@@ -14,13 +14,10 @@
 
 log = logging.getLogger("socketdev")
 
-# Separator between namespace and name in a socket.dev package URL. Socket addresses
-# Maven artifacts as "groupId:artifactId" -- the slash form 404s, and the dashboard's
-# Maven handler raises "Maven package must have a colon" on it. Every other ecosystem
-# uses a path segment per component (npm "@scope/name", golang "github.com/org/repo").
-URL_NAMESPACE_SEPARATORS = {
-    "maven": ":",
-}
+# Ecosystems whose package pages cannot be addressed by name alone. A Maven
+# coordinate is a groupId plus an artifactId; with no namespace the URL collapses to
+# one path segment that cannot be split back into two, and the page does not resolve.
+NAMESPACE_REQUIRED_TYPES = frozenset({"maven"})
 
 __all__ = [
     "Report",
@@ -168,8 +165,7 @@ def socket_url(package_type, namespace: Optional[str], name: str, version: str)
         """
         Builds the socket.dev package overview URL for a package.
 
-        The namespace separator is ecosystem-dependent; see URL_NAMESPACE_SEPARATORS.
-        Purl strings are not, and keep the "/" form everywhere.
+        Namespace and name are separate path segments, the same form purl strings use.
 
         Args:
             package_type: Ecosystem, as a string or SocketPURL_Type member
@@ -182,17 +178,13 @@ def socket_url(package_type, namespace: Optional[str], name: str, version: str)
         """
         package_type = Package.normalize_type(package_type)
         namespace = (namespace or "").strip("/")
-        separator = URL_NAMESPACE_SEPARATORS.get(package_type, "/")
-        if separator != "/" and not namespace:
-            # An ecosystem with its own separator cannot be addressed without the
-            # namespace half of the coordinate. The link is emitted anyway so the
-            # finding still reports, but it will not resolve.
+        if not namespace and package_type in NAMESPACE_REQUIRED_TYPES:
+            # The link is still emitted so the finding reports, but it cannot resolve.
             log.warning(
                 f"{package_type} package {name}@{version} has no namespace, so its "
-                f"Socket link cannot use the '{separator}' separator the dashboard "
-                "requires and will not resolve"
+                "Socket link collapses to a single path segment and will not resolve"
             )
-        package_path = f"{namespace}{separator}{name}" if namespace else name
+        package_path = "/".join(part for part in (namespace, name) if part)
         return f"https://socket.dev/{package_type}/package/{package_path}/overview/{version}"
 
     @classmethod

tests/core/test_package_and_alerts.py

@@ -123,11 +123,11 @@ def test_full_scan_package_normalizes_enum_type_and_namespace_url(self):
         assert package.type == "maven"
         assert package.purl == "maven/com.example/example-core@1.2.3"
         assert package.url == (
-            "https://socket.dev/maven/package/com.example:example-core/overview/1.2.3"
+            "https://socket.dev/maven/package/com.example/example-core/overview/1.2.3"
         )
 
-    def test_maven_package_url_uses_colon_between_group_and_artifact(self):
-        """Socket addresses Maven artifacts as groupId:artifactId; the slash form 404s"""
+    def test_maven_package_url_separates_group_and_artifact(self):
+        """groupId and artifactId are distinct path segments, not one fused string"""
         artifact = SocketArtifact.from_dict({
             "id": "pkg:maven/org.apache.logging.log4j/log4j-api@2.17.2",
             "type": "maven",
@@ -143,7 +143,7 @@ def test_maven_package_url_uses_colon_between_group_and_artifact(self):
         package = Package.from_socket_artifact(asdict(artifact))
 
         assert package.url == (
-            "https://socket.dev/maven/package/org.apache.logging.log4j:log4j-api"
+            "https://socket.dev/maven/package/org.apache.logging.log4j/log4j-api"
             "/overview/2.17.2"
         )
         # The purl keeps the "/" form, which is what the purl spec and the purl API want.
@@ -189,7 +189,7 @@ def test_diff_path_builds_the_same_maven_url_as_the_full_scan_path(self):
         package = Core.update_package_values(package)
 
         assert package.url == (
-            "https://socket.dev/maven/package/com.google.code.gson:gson/overview/2.8.6"
+            "https://socket.dev/maven/package/com.google.code.gson/gson/overview/2.8.6"
         )
 
     def test_create_packages_dict_with_transitives(self, core):