Patched code sample

import os
import re
import hashlib
import tempfile
from typing import Optional
from urllib.parse import urlparse
import requests
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.util.retry import Retry

def download_package(
    package_name: str,
    version: str,
    output_dir: Optional[str] = None
) -> str:
    
    try:
        if not re.match(r'^[a-zA-Z0-9_-]+$', package_name):
            raise ValueError("Invalid package name")
            
        if not re.match(r'^[a-zA-Z0-9_.-]+$', version):
            raise ValueError("Invalid version")
            
        session = requests.Session()
        retry = Retry(
            total=3,
            backoff_factor=0.5,
            status_forcelist=[500, 502, 503, 504]
        )
        adapter = HTTPAdapter(max_retries=retry)
        session.mount('https://', adapter)
        
        info_url = f"https://pypi.org/pypi/{package_name}/{version}/json"
        response = session.get(info_url, timeout=10)
        response.raise_for_status()
        
        info = response.json()
        urls = info.get('urls', [])
        if not urls:
            raise ValueError("No package URLs found")
            
        package_info = None
        for url_info in urls:
            if url_info['packagetype'] in {'bdist_wheel', 'sdist'}:
                package_info = url_info
                break
                
        if not package_info:
            raise ValueError("No suitable package format found")
            
        package_url = package_info['url']
        expected_hash = package_info['digests']['sha256']
        
        parsed_url = urlparse(package_url)
        if parsed_url.scheme != 'https' or not parsed_url.netloc.endswith('.pypi.org'):
            raise ValueError("Invalid package URL")
            
        with tempfile.NamedTemporaryFile(delete=False) as temp_file:
            response = session.get(package_url, stream=True, timeout=30)
            response.raise_for_status()
            
            sha256 = hashlib.sha256()
            for chunk in response.iter_content(chunk_size=8192):
                sha256.update(chunk)
                temp_file.write(chunk)
                
        if sha256.hexdigest() != expected_hash:
            os.unlink(temp_file.name)
            raise ValueError("Package integrity check failed")
            
        output_dir = output_dir or os.getcwd()
        output_path = os.path.join(
            output_dir,
            os.path.basename(package_url)
        )
        
        os.replace(temp_file.name, output_path)
        return output_path
        
    except requests.exceptions.RequestException as e:
        raise ValueError(f"Download failed: {str(e)}")
    except Exception as e:
        raise ValueError(f"Error downloading package: {str(e)}")