[purl-associator-app]

Automated refresh of mappings/auto.json from the latest conda-forge package metadata. 421 mapping changes this run.

bucket	count
🆕 new packages	12
🗑 removed packages	0
🔀 changed primary PURL	7
✎ changed alternates	22
⬆ version bump (PURL unchanged)	380

New-package ecosystems: pypi 8, github 3, unmapped 1

🆕 New packages (12)

• aiqclib v0.15.2 → pkg:pypi/aiqclib
• asyncmy v0.2.18 → pkg:pypi/asyncmy
• cloudini v1.4.0 → pkg:github/facontidavide/cloudini
• copernicusmarine-delivery v0.5.0 → pkg:pypi/copernicusmarine-delivery
• cwevals v0.0.1b1 → pkg:pypi/cwevals
• elenctic v1.0.0 → pkg:pypi/elenctic
• formerly v0.1.0 → pkg:pypi/formerly
• frostwork v0.2.2 → pkg:pypi/frostwork
• gotcha v1.0.8 → pkg:github/llnl/gotcha
• polyphys v1.0.0 → pkg:pypi/polyphys
• rust-std-i686-pc-windows-msvc v1.99.1 → unmapped
• tabiew v0.15.1 → pkg:github/shshemi/tabiew

🔀 Changed primary PURL (7)

• cmor: pkg:github/pcmdi/cmor → pkg:pypi/cmor
• conda: pkg:github/conda/conda → pkg:pypi/conda
• cuda-core: pkg:pypi/cuda-core → pkg:github/nvidia/cuda-python
• hugin: pkg:pypi/hugin → unmapped
• hugin-base: pkg:pypi/hugin-base → unmapped
• libsecret: pkg:pypi/libsecret → unmapped
• sen4cap-client: pkg:github/sen4cap/sen4cap-client → pkg:pypi/sen4cap-client

✎ Changed alternates (22)

• bline: +pkg:git/gitlab.com/earthscope/public/epic/passoft/bline
• calday: +pkg:git/gitlab.com/earthscope/public/epic/passoft/calday
• ckmseed: +pkg:git/gitlab.com/earthscope/public/epic/passoft/ckMseed
• coverplot: +pkg:git/gitlab.com/earthscope/public/epic/passoft/coverplot
• data2passcal: +pkg:git/gitlab.com/earthscope/public/epic/passoft/data2passcal
• e2h: +pkg:git/gitlab.com/earthscope/public/epic/passoft/e2h
• fixhdr: +pkg:git/gitlab.com/earthscope/public/epic/passoft/fixhdr
• fnox: +pkg:npm/fnox
• h2e: +pkg:git/gitlab.com/earthscope/public/epic/passoft/h2e
• lemi2seed: +pkg:git/gitlab.com/earthscope/public/epic/mt/lemi2seed
• libfranka: −pkg:github/frankarobotics/libfranka-common
• lopt: +pkg:git/gitlab.com/earthscope/public/epic/passoft/lopt
• metplus: −pkg:github/dtcenter/met
• mseedpeek: +pkg:git/gitlab.com/earthscope/public/epic/passoft/mseedpeek
• nrl-lib: −pkg:git/gitlab.com/earthscope/public/epic/nrl-lib +pkg:github/earthscope/nrl-lib
• nvidia-dali-python: +pkg:pypi/nvidia-dali-cuda130
• phoenix2seed: +pkg:git/gitlab.com/earthscope/public/epic/mt/phoenix2seed
• refscrub: +pkg:git/gitlab.com/earthscope/public/epic/passoft/refscrub
• rt2ms: +pkg:git/gitlab.com/earthscope/public/epic/passoft/rt2ms_py3
• sohviewer: +pkg:git/gitlab.com/earthscope/public/epic/passoft/sohstationviewer
• warpx: +pkg:pypi/pywarpx
• xeus-sql: −pkg:github/jupyter-xeus/xeus-xsql

⬆ Version bump only (380)

• _pypdf-with-full-tests: v7.0.0 → v7.0.1
• ada-cpp: v0.37.0 → v0.40.0
• ada-py: v0.139.2 → v0.143.0
• ada-py-core: v0.139.2 → v0.143.0
• ada-py-desktop: v0.139.2 → v0.143.0
• agent-browser: v0.41.2 → v0.42.0
• algoliasearch: v4.48.0 → v4.51.0
• amazon-braket-schemas: v1.32.1.post0 → v1.32.2
• amazon_sagemaker_sql_editor: v0.2.8 → v1.0.0
• amzn-sagemaker-aiops-jupyterlab-extension: v1.0.6 → v2.0.0
• … and 370 more

---

This PR is opened by the scheduled automap workflow. Review the diff for unexpected churn and merge to publish the new mappings.

Primary-PURL coverage

Metric	Before	After	Delta
Total packages	34,953	34,965	+12
Primary PURL present	32,278	32,286	+8
Explicit no-primary-PURL decisions	1,154	1,154	0
Classified with reason	1,148	1,148	0
Legacy decisions needing review	6	6	0
Unresolved (existing queue)	1,521	1,525	+4
Existing queue (legacy actionable_missing)	1,521	1,525	+4
Primary PURL missing	2,675	2,679	+4

Primary-PURL coverage: 92.34%.

No-primary-PURL decisions are not security-negative findings. CDT repackages can contain identifiable upstream code; their distro/component mapping is deferred, not resolved. Legacy decisions still need review. Packaging-only decisions reflect recorded evidence, not certification of every version/platform. Identity counts are not vulnerability coverage.

Explicit no-PURL review cohorts

Known downloads are snapshot totals, not vulnerability exposure; missing download counts are listed separately.

Cohort	Packages	Known downloads	Packages with unknown downloads
Packaging-only decisions (recorded evidence)	38	2,387,961	0
CDT: distro/component mapping deferred	1,110	1,713,983	0
Legacy decisions needing review	6	5,023,154	0

Reviewed no-PURL classifications

Reason	Before	After	Delta
CDT/RPM: distro/component mapping deferred	1,110	1,110	0
Dependency-only metapackage	25	25	0
Toolchain selector	8	8	0
Environment mutex	3	3	0
Pinning metadata	1	1	0
Compatibility shim	1	1	0

Unresolved diagnostics

Diagnostic	Before	After	Delta
Recorded processing error	0	0	0
Alternative PURL only	0	3	+3
No parseable source host	77	77	0
URL evidence without primary PURL	1,444	1,445	+1

Top unresolved source hosts (15)

Host counts are non-exclusive; each host is counted once per unresolved package.

Source host	Packages
developer.download.nvidia.com	191
developer.nvidia.com	160
www.gnu.org	106
msys2-sources.continuum.io	97
ftp.gnu.org	90
git.ligo.org	80
www.x.org	79
gitlab.freedesktop.org	58
sourceforge.net	58
wiki.ligo.org	57
downloads.sourceforge.net	44
download.kde.org	37
api.kde.org	36
cgit.kde.org	36
software.repos.intel.com	36