Failed resolution for `Appium-Python-Client` in requirements.txt — resolves as `appium-python` instead of `appium-python-client`

[SheikhJebran-Philips]

The package name Appium-Python-Client is incorrectly normalized to appium-python instead of appium-python-client.

Expected Behavior

The scanner should normalize Appium-Python-Client to appium-python-client (per PEP 503) and resolve it successfully from PyPI.

Environment

• osv-scanner version: v2.3.8
• OS: Ubuntu 24.04 (GitHub Actions runner)
• Invoked via: MegaLinter v9.6.0

PyPI Reference

• Package: https://pypi.org/project/Appium-Python-Client/
• Normalized name: appium-python-client
• Install command: pip install Appium-Python-Client

[jess-lowe]

can you please provide an example of an output where this occurs so I can figure out whether this is a scanner, API or data issue?

[SheikhJebran-Philips]

@jess-lowe

We see this while scanning our Python requirements.txt with OSV-Scanner v2.3.8, invoked by MegaLinter v9.6.0:

$ osv-scanner scan source --recursive .

Scanned /github/workspace/requirements.txt file and found 26 packages
failed resolution for github/workspace/requirements.txt: package System(7):appium-python: not found
Error during extraction: (extracting as transitivedependency/requirements) failed resolution for github/workspace/requirements.txt: package System(7):appium-python: not found
Filtered 23 local/unscannable package/s from the scan.

Total 0 packages affected by 0 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 0 Unknown) from 0 ecosystems.

The corresponding requirement is:

Appium-Python-Client

It is unpinned. The scanner appears to normalize it to appium-python and then fails to resolve that package. This occurs during requirements extraction, before any vulnerability result is produced, so it looks like a package-name resolution/data issue rather than a vulnerability finding.

[Ly-Joey]

Hello @SheikhJebran-Philips! Thank you for raising the issue and providing more details!
This behaviour has been fixed upstream at osv-scalibr@6ee2055 and will be included in the next release of osv-scanner.