bibliothecary 10.2.3 → 11.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7dfc5b2b87a91e11a42997699093f41438d326c32bb5f9e1d1a6f0fe53e14273
-  data.tar.gz: b913696a04f7cbc09e8c8f9fbf257f695ca9024e91714860b0da9e656ff111df
+  metadata.gz: ed25de135032f95b602569a3ad5c1476f36be42599c0cd1b29032ecf7de8a47b
+  data.tar.gz: 6401e84f7ce40b499b4da8274f775813fe1dcfa41843e7cbcc761293ff287c0d
 SHA512:
-  metadata.gz: c9b0b9fda708eee583ffe0a41e18b6cb3e50c723038f51d1320bc8b175be36737cf0df3c77bc98baa8cb0c220ad2b07d84e2d5d77306ac933c8029190bee3a79
-  data.tar.gz: 86d1f61c7ed98652aba0e36938ddfb5d39970358f7f4564cd35a1e4cf83560d3879732c4d5ee62f05a50f57b8d71e974c8079db87568a9e3cf444e0ce2f15b92
+  metadata.gz: 8f0cedd4ebe9e4248ac0151b4073fa2671466cb4c4e04b2b1dc7e9a8daecbfca34126fa870cab97d3e95e231dcc8f1e01295a7c3b9b907bf64db1443dfa2ff7e
+  data.tar.gz: c44115bb427765889d363e59685dfe3bd7fff63b27bca352f453b74da2ddf269d75a526453eb0bdfcfdb219d073cea5172fbfdc4731f38a1d86d8748a7c030b9

data/.ruby-version

@@ -1 +1 @@
-3.0.7
+3.2.5

data/.tidelift

@@ -0,0 +1 @@
+TIDELIFT_EXCLUDED_MANIFESTS=spec/fixtures

data/CHANGELOG.md

@@ -13,12 +13,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [11.0.0] - 2024-11-22
+
+### Changed
+
+- Removed lockfile_requirement from Bibliothecary::Dependency
+
+## [10.2.4] - 2024-11-06
+
+### Changed
+
+- Fixed parsing of pom files where parent properties within the file are required for dependencies
+
 ## [10.2.2] - 2024-09-25
 
 ### Added
 
 - Support parsing *.spdx.json files
 
+### Changed
+- `Bibliothecary::PURL_TYPE_MAPPING` has changed to `Bibliothecary::PurlUtil::PURL_TYPE_MAPPING`
+- `Bibliothecary::MultiParsers::CycloneDX::ManifestEntries.full_name_for_purl` has changed to `Bibliothecary::PurlUtil.full_name`
+
 ## [10.2.0] - 2024-08-27
 
 ### Changed

data/lib/bibliothecary/dependency.rb

@@ -16,8 +16,6 @@ module Bibliothecary
   #   where it did not match the resolved name. This can be used for features like aliasing.
   # @attr_reader [String] original_requirement The original requirement used to require the dependency,
   #   for cases where it did not match the resolved name. This can be used for features like aliasing.
-  # @attr_reader [String] lockfile_requirement The requirement found in the lockfile, e.g. "1.0.0" or "^1.0.0". This is
-  #   only returned from the yarn.lock parser and may not be used by downstream users. TODO: should this be deprecated?
   # @source [String] source An optional string to store the location of the manifest that contained this
   #   dependency, e.g. "src/package.json".
   class Dependency
@@ -25,7 +23,6 @@ module Bibliothecary
       :name,
       :requirement,
       :original_requirement,
-      :lockfile_requirement,
       :platform,
       :type,
       :direct,
@@ -42,7 +39,6 @@ module Bibliothecary
       name:,
       requirement:,
       original_requirement: nil,
-      lockfile_requirement: nil,
       platform: nil,
       type: nil,
       direct: nil,
@@ -56,8 +52,6 @@ module Bibliothecary
       @platform = platform
       @requirement = requirement || "*"
       @original_requirement = original_requirement
-      # TODO: maybe deprecate this field? Is it possible to replace it with original_requirement?
-      @lockfile_requirement = lockfile_requirement
       @type = type
       @direct = direct
       @deprecated = deprecated

data/lib/bibliothecary/multi_parsers/dependencies_csv.rb

@@ -37,13 +37,6 @@ module Bibliothecary
               /^name$/i,
             ],
           },
-          # Lockfiles have exact versions.
-          "lockfile_requirement" => {
-            match: [
-              /^(lockfile |)requirement$/i,
-              /^version$/i,
-            ],
-          },
           # Manifests have versions that can have operators.
           # However, since Bibliothecary only currently supports analyzing a
           # single file as a single thing (either manifest or lockfile)

data/lib/bibliothecary/parsers/maven.rb

@@ -425,7 +425,6 @@ module Bibliothecary
         # the xml root is <project> so lookup the non property name in the xml
         # this converts ${project/group.id} -> ${group/id}
         non_prop_name = property_name.gsub(".", "/").gsub("project/", "")
-        return "${#{property_name}}" if !xml.respond_to?("properties") && parent_properties.empty? && xml.locate(non_prop_name).empty?
 
         prop_field = xml.properties.locate(property_name).first if xml.respond_to?("properties")
         parent_prop = parent_properties[property_name] ||                 # e.g. "${foo}"

data/lib/bibliothecary/parsers/npm.rb

@@ -142,7 +142,6 @@ module Bibliothecary
             Dependency.new(
               name: dep[:name],
               requirement: dep[:version],
-              lockfile_requirement: dep[:requirement],
               type: dep[:type],
               local: dep[:requirement]&.start_with?("file:"),
             )
@@ -173,7 +172,6 @@ module Bibliothecary
             Dependency.new(
               name: name,
               requirement: metadata["version"],
-              lockfile_requirement: metadata.fetch("from", "").split("@").last,
               type: "runtime",
             ),
           ] + transform_tree_to_array(metadata.fetch("dependencies", {}))

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "10.2.3"
+  VERSION = "11.0.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 10.2.3
+  version: 11.0.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-25 00:00:00.000000000 Z
+date: 2024-11-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb
@@ -237,7 +237,7 @@ files:
 - ".rspec"
 - ".rubocop.yml"
 - ".ruby-version"
-- ".tidelift.yml"
+- ".tidelift"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
@@ -313,7 +313,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.33
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: Find and parse manifests

data/.tidelift.yml

@@ -1,2 +0,0 @@
-ci:
-  extra_ignore_directories: [ spec/fixtures ]