bibliothecary 10.2.4 → 11.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 305a667de2b400a8b78c0dcc8159442ec94a0d0c05cca71b3eb2ed25be9ddec3
-  data.tar.gz: 42645beb4d9cfa6aab4837045541d7747370f14f791f96c8aca31594aa9b614e
+  metadata.gz: 78844f8813583a84df76e0ad0c72f9b8136b47d82aec8194e3e6766049ba721b
+  data.tar.gz: bb84e383f0bbded7361d7efbf4550f100d08281a294def960c95ddb1dca4f97c
 SHA512:
-  metadata.gz: 8ef33d46181f9d9b33c53ef28b197b3b28d1dae1c1b9f8842019a716b547696c3a69ffa8c4c26ccc64e9cbb078d2559ffd57ae3688f5fee9554265aa5d0f6c4e
-  data.tar.gz: dec4e3346c4b2a6ff8b64a61e90d5d8956977b6b3b19b3b49d1caab9921d7c2f1b6f71d7023a36f12fed2498a8fa705f4efc4699337aef665ddb9385d7389413
+  metadata.gz: f537a3fd368046789baf28c758b8f60d8832b7601f2ae78211a78d4d583ee7ddc4d4729f1ca3387e92958756586a6c1608099a4849db70c9e0a2a3b7405ff564
+  data.tar.gz: 8b9d7e93affe8df9d4e898bf4c128f912f16dd2e1c61ba7dfde0163690df91c173ed0a75c48717a702ddb45dfff2053527b5730c3d76738e7bf51b2344d09cff

data/.ruby-version

@@ -1 +1 @@
-3.0.7
+3.2.5

data/CHANGELOG.md

@@ -13,6 +13,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+
+## [11.0.1] - 2024-12-20
+
+### Changed
+
+- Alow retrieving maven versions from parent poms
+
+## [11.0.0] - 2024-11-22
+
+### Changed
+
+- Removed lockfile_requirement from Bibliothecary::Dependency
+
 ## [10.2.4] - 2024-11-06
 
 ### Changed

data/lib/bibliothecary/dependency.rb

@@ -16,8 +16,6 @@ module Bibliothecary
   #   where it did not match the resolved name. This can be used for features like aliasing.
   # @attr_reader [String] original_requirement The original requirement used to require the dependency,
   #   for cases where it did not match the resolved name. This can be used for features like aliasing.
-  # @attr_reader [String] lockfile_requirement The requirement found in the lockfile, e.g. "1.0.0" or "^1.0.0". This is
-  #   only returned from the yarn.lock parser and may not be used by downstream users. TODO: should this be deprecated?
   # @source [String] source An optional string to store the location of the manifest that contained this
   #   dependency, e.g. "src/package.json".
   class Dependency
@@ -25,7 +23,6 @@ module Bibliothecary
       :name,
       :requirement,
       :original_requirement,
-      :lockfile_requirement,
       :platform,
       :type,
       :direct,
@@ -42,7 +39,6 @@ module Bibliothecary
       name:,
       requirement:,
       original_requirement: nil,
-      lockfile_requirement: nil,
       platform: nil,
       type: nil,
       direct: nil,
@@ -56,8 +52,6 @@ module Bibliothecary
       @platform = platform
       @requirement = requirement || "*"
       @original_requirement = original_requirement
-      # TODO: maybe deprecate this field? Is it possible to replace it with original_requirement?
-      @lockfile_requirement = lockfile_requirement
       @type = type
       @direct = direct
       @deprecated = deprecated

data/lib/bibliothecary/multi_parsers/dependencies_csv.rb

@@ -37,13 +37,6 @@ module Bibliothecary
               /^name$/i,
             ],
           },
-          # Lockfiles have exact versions.
-          "lockfile_requirement" => {
-            match: [
-              /^(lockfile |)requirement$/i,
-              /^version$/i,
-            ],
-          },
           # Manifests have versions that can have operators.
           # However, since Bibliothecary only currently supports analyzing a
           # single file as a single thing (either manifest or lockfile)

data/lib/bibliothecary/parsers/maven.rb

@@ -294,48 +294,74 @@ module Bibliothecary
         parse_pom_manifest(file_contents, {}, options: options)
       end
 
-      # parent_properties is used by Libraries:
-      # https://github.com/librariesio/libraries.io/blob/e970925aade2596a03268b6e1be785eba8502c62/app/models/package_manager/maven.rb#L129
       def self.parse_pom_manifest(file_contents, parent_properties = {}, options: {}) # rubocop:disable Lint/UnusedMethodArgument
-        manifest = Ox.parse file_contents
-        xml = manifest.respond_to?("project") ? manifest.project : manifest
-        [].tap do |deps|
-          # <dependencyManagement> is a namespace to specify artifact configuration (e.g. version), but it doesn't
-          # actually add dependencies to your project. Grab these and keep them for reference while parsing <dependencies>
-          # Ref: https://maven.apache.org/pom.html#Dependency_Management
-          # Ref: https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#transitive-dependencies
-          dependencyManagement = xml.locate("dependencyManagement/dependencies/dependency").map do |dep|
-            {
-              groupId: extract_pom_dep_info(xml, dep, "groupId", parent_properties),
-              artifactId: extract_pom_dep_info(xml, dep, "artifactId", parent_properties),
-              version: extract_pom_dep_info(xml, dep, "version", parent_properties),
-              scope: extract_pom_dep_info(xml, dep, "scope", parent_properties),
-            }
-          end
-          # <dependencies> is the namespace that will add dependencies to your project.
-          xml.locate("dependencies/dependency").each do |dep|
-            groupId = extract_pom_dep_info(xml, dep, "groupId", parent_properties)
-            artifactId = extract_pom_dep_info(xml, dep, "artifactId", parent_properties)
-            version = extract_pom_dep_info(xml, dep, "version", parent_properties)
-            scope = extract_pom_dep_info(xml, dep, "scope", parent_properties)
-
-            # Use any dep configurations from <dependencyManagement> as fallbacks
-            if (depConfig = dependencyManagement.find { |d| d[:groupId] == groupId && d[:artifactId] == artifactId })
-              version ||= depConfig[:version]
-              scope ||= depConfig[:scope]
+        parse_pom_manifests([file_contents], parent_properties)
+      end
+
+      # @param files [Array<String>] Ordered array of strings containing the
+      # pom.xml bodies. The first element should be the child file.
+      # @param merged_properties [Hash]
+      def self.parse_pom_manifests(files, merged_properties)
+        documents = files.map do |file|
+          doc = Ox.parse(file)
+          doc.respond_to?("project") ? doc.project : doc
+        end
+
+        mergedDependencyManagements = {}
+        documents.each do |document|
+           document.locate("dependencyManagement/dependencies/dependency").each do |dep|
+              groupId = extract_pom_dep_info(document, dep, "groupId", merged_properties)
+              artifactId = extract_pom_dep_info(document, dep, "artifactId", merged_properties)
+              key = "#{groupId}:#{artifactId}"
+              mergedDependencyManagements[key] ||=
+                {
+                  groupId: groupId,
+                  artifactId: artifactId,
+                  version: extract_pom_dep_info(document, dep, "version", merged_properties),
+                  scope: extract_pom_dep_info(document, dep, "scope", merged_properties),
+                }
+           end
+        end
+
+        dep_hashes = {}
+        documents.each do |document|
+          document.locate("dependencies/dependency").each do |dep|
+            groupId = extract_pom_dep_info(document, dep, "groupId", merged_properties)
+            artifactId = extract_pom_dep_info(document, dep, "artifactId", merged_properties)
+            key = "#{groupId}:#{artifactId}"
+            unless dep_hashes.key?(key)
+              dep_hashes[key] = {
+                name: key,
+                requirement: nil,
+                type: nil,
+                optional: nil,
+              }
             end
+            dep_hash = dep_hashes[key]
+
+            dep_hash[:requirement] ||= extract_pom_dep_info(document, dep, "version", merged_properties)
+            dep_hash[:type] ||= extract_pom_dep_info(document, dep, "scope", merged_properties)
 
-            dep_hash = {
-              name: "#{groupId}:#{artifactId}",
-              requirement: version,
-              type: scope || "runtime",
-            }
             # optional field is, itself, optional, and will be either "true" or "false"
-            optional = extract_pom_dep_info(xml, dep, "optional", parent_properties)
-            dep_hash[:optional] = optional == "true" unless optional.nil?
-            deps.push(Dependency.new(**dep_hash))
+            optional = extract_pom_dep_info(document, dep, "optional", merged_properties)
+            if dep_hash[:optional].nil? && !optional.nil?
+              dep_hash[:optional] = optional == "true"
+            end
+          end
+        end
+
+        # Anything that wasn't covered by a dependency version, get from the
+        # dependencyManagements
+        dep_hashes.each do |key, dep_hash|
+          if (dependencyManagement = mergedDependencyManagements[key])
+            dep_hash[:requirement] ||= dependencyManagement[:version]
+            dep_hash[:type] ||= dependencyManagement[:scope]
           end
+
+          dep_hash[:type] ||= "runtime"
         end
+
+        dep_hashes.map{|key, dep_hash| Dependency.new(**dep_hash)}
       end
 
       def self.parse_gradle(file_contents, options: {}) # rubocop:disable Lint/UnusedMethodArgument

data/lib/bibliothecary/parsers/npm.rb

@@ -142,7 +142,6 @@ module Bibliothecary
             Dependency.new(
               name: dep[:name],
               requirement: dep[:version],
-              lockfile_requirement: dep[:requirement],
               type: dep[:type],
               local: dep[:requirement]&.start_with?("file:"),
             )
@@ -173,7 +172,6 @@ module Bibliothecary
             Dependency.new(
               name: name,
               requirement: metadata["version"],
-              lockfile_requirement: metadata.fetch("from", "").split("@").last,
               type: "runtime",
             ),
           ] + transform_tree_to_array(metadata.fetch("dependencies", {}))

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "10.2.4"
+  VERSION = "11.0.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 10.2.4
+  version: 11.0.1
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-11-06 00:00:00.000000000 Z
+date: 2024-12-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb
@@ -313,7 +313,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.33
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: Find and parse manifests