denoland/deno · error

package name must not contain dot path segments

Error message

package name must not contain dot path segments

What it means

`parse_package_name` path-safety check: each of the scope and package components is rejected if it is `.` or `..`. This prevents dot path segments that would escape or alias directories when the name is turned into registry URLs or file paths.

Source

Thrown at cli/registry.rs:246

  // Keep the explicit path-safety checks below even if the JSR grammar changes.
  let reference = JsrPackageReqReference::from_str(&format!("jsr:{name}@*"))
    .map_err(|_| {
      deno_core::anyhow::anyhow!(
        "package name must use the '@<scope>/<package>' format"
      )
    })?;
  if reference.sub_path().is_some() {
    bail!("package name must not contain additional path segments");
  }

  let Some((scope, package)) =
    name.strip_prefix('@').and_then(|name| name.split_once('/'))
  else {
    bail!("package name must use the '@<scope>/<package>' format");
  };
  for component in [scope, package] {
    if component == "." || component == ".." {
      bail!("package name must not contain dot path segments");
    }
    if component
      .chars()
      .any(|c| matches!(c, '/' | '\\' | '?' | '#' | '%'))
    {
      bail!("package name contains a URL path or delimiter character");
    }
  }
  Ok((scope, package))
}

/// Returns `true` if the given package version is already published to the
/// registry.
///
/// Only a `200 OK` response is treated as "already published". A `404` (and any
/// other non-success status) is treated as "not published" so that this
/// up-front optimization never blocks a legitimate publish because of a
/// transient registry error.

View on GitHub (pinned to f7822238ca)

Solutions

1. Replace any `.` or `..` segment with the real scope/package identifier
2. Resolve the relative path in your own code first, then use the resulting concrete package name
3. Validate user-supplied names before calling (reject `.`/`..` components early with a clear message)

Example fix

// before
parse_package_name("@my-scope/..")?;
// after
parse_package_name("@my-scope/my-package")?;

fn has_dot_segments(name: &str) -> bool {
  name.strip_prefix('@')
    .and_then(|r| r.split_once('/'))
    .map(|(s, p)| s == "." || s == ".." || p == "." || p == "..")
    .unwrap_or(true)
}
if has_dot_segments(name) {
  eprintln!("package name components cannot be '.' or '..'");
  return;
}
let (scope, package) = parse_package_name(name)?;

fn is_safe_jsr_name(name: &str) -> bool {
  !name.split('/').any(|c| c == "." || c == "..")
    && name.starts_with('@')
}

match parse_package_name(name) {
  Ok((scope, package)) => /* use scope/package */,
  Err(e) if e.to_string().contains("dot path segments") => {
    eprintln!("resolve relative path segments before naming the package");
  }
  Err(e) => return Err(e),
}

When it happens

Trigger: Passing a name where scope or package is exactly `.` or `..`, such as `@scope/..`, `@./pkg`, or `@../pkg`, into `parse_package_name`.

Common situations: Path manipulation or string concatenation bugs that leave `.`/`..` segments in the name; trying to reference a parent/relative location through a package name, which JSR does not allow.

Related errors

• Invalid package name '{}'. Package name must be in the forma
• refusing to write tarball with unsafe name derived from pack
• package name must not contain additional path segments
• package name must use the '@<scope>/<package>' format
• package name contains a URL path or delimiter character

AI-assisted analysis of denoland/deno@f7822238ca (2026-08-29). Data as JSON: /api/errors/14746297882dbb5c. Report an issue: GitHub.