Avoid using Pkg internals

[ericphanson]

functions like

PkgToSoftwareBOM.jl/src/packageInfo.jl

Line 3 in 938168a

function resolve_pkgsource!(package::SpdxPackageV2, packagedata::Pkg.API.PackageInfo, registrydata::Union{Nothing, Missing, PackageRegistryInfo})

are using Pkg internals, which have changed in the past.

One tool that can help is https://github.com/GunnarFarneback/RegistryInstances.jl which provides a public API for the RegistryInstances portion of what Pkg does. (See the Background section of the README there).

[SamuraiAku]

This package has no releases yet, but this is the functionality I am looking for. I’ll keep an eye on this. Thanks for the tip.

[ericphanson]

RegistryInstances actually does have a registered release in General: https://github.com/JuliaRegistries/General/blob/master/R/RegistryInstances/Package.toml. It doesn't have TagBot setup (fyi @GunnarFarneback), which is why nothing shows up as a github release. (I know since I'm using it in PackageAnalyzer.jl).