Ignore and/or report invalid package names in github security advisories

[Ocramius]

See https://github.com/Roave/SecurityAdvisories/blob/2762ddacb0bf083e0bdc53eab51361fddced402d/composer.json#L200-L201

GHSA-6gw4-x63h-5499 caused this to break (I had to contact the folks at @Sylius directly to get it fixed).

Basically, sylius\sylius was entered instead of sylius/sylius.

I think we can do two things:

1. fail the build completely (good first step)
2. ignore the packages and raise a warning (problematic, as we won't really notice it)

[slash3b]

do you think it makes sense to implement a simple validator-corrector for package name ?

[Ocramius]

Thank you, @slash3b! \o/

[Ocramius]

do you think it makes sense to implement a simple validator-corrector for package name ?

This is already part of upstream composer tooling - I'm wondering if we should somehow notify github security about this problem in their feeds 🤔

[slash3b]

thank you, @Ocramius ^^

I did ask the one who published advisory to edit it. Waiting for a reply.

[slash3b]

It was corrected. We are good to go \o/

GHSA-6gw4-x63h-5499

[Ocramius]

Yup, the problem is that this will happen again 😅