Update implementation for spec changes

Author: jdalton

src/encode.js

@@ -57,7 +57,7 @@ function encodeSubpath(subpath) {
 
 function encodeVersion(version) {
   return isNonEmptyString(version)
-    ? encodeComponent(version).replace(/%3A/g, ':').replace(/%2B/g, '+')
+    ? encodeComponent(version).replace(/%3A/g, ':')
     : ''
 }
 

src/validate.js

@@ -136,7 +136,7 @@ function validateType(type, throws) {
     return false
   }
   // The package type is composed only of ASCII letters and numbers,
-  // '.', '+' and '-' (period, plus, and dash)
+  // '.' (period), and '-' (dash).
   for (let i = 0, { length } = type; i < length; i += 1) {
     const code = type.charCodeAt(i)
     // biome-ignore format: newlines
@@ -147,7 +147,6 @@ function validateType(type, throws) {
           (code >= 65 && code <= 90) || // A-Z
           (code >= 97 && code <= 122) || // a-z
           code === 46 || // .
-          code === 43 || // +
           code === 45
         ) // -
       )

test/data/contrib-tests.json

@@ -1,8 +1,8 @@
 [
   {
-    "description": "debian can have debian versions as part of version with plus sign",
-    "purl": "pkg:deb/debian/[email protected]+deb10u3?arch=amd64&distro=debian-10",
-    "canonical_purl": "pkg:deb/debian/[email protected]+deb10u3?arch=amd64&distro=debian-10",
+    "description": "debian versions with plus signs are percent-encoded",
+    "purl": "pkg:deb/debian/[email protected]%2Bdeb10u3?arch=amd64&distro=debian-10",
+    "canonical_purl": "pkg:deb/debian/[email protected]%2Bdeb10u3?arch=amd64&distro=debian-10",
     "type": "deb",
     "namespace": "debian",
     "name": "libssl1.1",