Swift: a Package.resolved location with a trailing slash gives a PURL with no name, and trivy convert fails

[wils0ns]

Description

Xcode keeps a package's URL as it was entered, so a Package.resolved location can end in a slash, as https://github.com/sparkle-project/Sparkle/ does in a real app's lockfile. Trivy's Swift parser trims https:// and .git from the location but not a trailing /, so the package name ends in / and its PURL has an empty name: pkg:swift/github.com/sparkle-project/Sparkle/@2.9.6. The scan itself succeeds, but trivy convert on its JSON report fails with purl is missing name, so a JSON report cannot be turned into SARIF or CycloneDX.

Desired Behavior

The package is named github.com/sparkle-project/Sparkle, the same as a location without the slash, and trivy convert succeeds.

Actual Behavior

The name is github.com/sparkle-project/Sparkle/, the PURL is pkg:swift/github.com/sparkle-project/Sparkle/@2.9.6, and trivy convert --format sarif (or --format cyclonedx) exits 1 with json decode error: purl is missing name.

Reproduction Steps

# 1. A directory holding only this Package.resolved
{
  "pins" : [
    {
      "identity" : "sparkle",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/sparkle-project/Sparkle/",
      "state" : {
        "revision" : "ac2def288cbff5cfc7df3ffef6abdf45b72bcb0a",
        "version" : "2.9.6"
      }
    }
  ],
  "version" : 2
}

# 2. Scan to JSON (succeeds)
$ trivy fs --format json --output result.json .

# 3. Convert (fails)
$ trivy convert --format sarif result.json
FATAL	Fatal error	json decode error: purl is missing name

Target

Filesystem

Scanner

Vulnerability

Output Format

SARIF

Mode

Standalone

Debug Output

$ trivy convert --debug --format sarif result.json
2026-11-06T17:21:39-06:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2026-11-06T17:21:39-06:00	DEBUG	Cache dir	dir="~/.cache/trivy"
2026-11-06T17:21:39-06:00	DEBUG	Cache dir	dir="~/.cache/trivy"
2026-11-06T17:21:39-06:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-11-06T17:21:39-06:00	FATAL	Fatal error
  - json decode error:
    github.com/aquasecurity/trivy/pkg/commands/convert.Run
        /home/runner/work/trivy/trivy/pkg/commands/convert/run.go:35
  - purl is missing name

Operating System

Ubuntu 24.04.5 LTS

Version

Version: 0.76.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @wils0ns
Thanks for your report!

Created #11608

Regards, Dmitriy