Handle requests for different spellings of a given version about deps.dev

[adg]

Thanks for the report.

This is a general issue that we intend to address: some package managers permit multiple spellings for a given version string (depending on many contextual factors), but we only match requests against a specific version string that we store in the database. We could instead convert the requested version into a canonical form, and use that to match versions in the database.

(We already do this for package names - for example, requests for either Cargo/clap-builder or Cargo/clap_builder will return data about the same package (because deps.dev observes cargo's rules on names)).

[adg]

We've rolled out some changes that canonicalize the requested versions, so the example you give now works:

$ curl -s https://api.deps.dev/v3alpha/systems/PYPI/packages/cryptography/versions/2.7 | jq
{
  "versionKey": {
    "system": "PYPI",
    "name": "cryptography",
    "version": "2.7.0"
  },
  "isDefault": false,
  "licenses": [
    "non-standard"
  ],
  "advisoryKeys": [
    {
      "id": "GHSA-hggm-jpg3-v476"
    },
    {
      "id": "GHSA-w7pp-m8wf-vj6r"
    },
    {
      "id": "GHSA-x4qr-2fvf-3mr5"
    },
    {
      "id": "PYSEC-2021-62"
    }
  ],
  "links": [
    {
      "label": "SOURCE_REPO",
      "url": "https://github.com/pyca/cryptography"
    }
  ]
}

@jamietanna Thanks again for the report. Please let us know if encounter other issues. :)