bibliothecary 12.1.3 → 12.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b061a0f0ac234c87fb6821f0575ecb1f4fe7b9a217fdeec726cf5d9389a6264a
-  data.tar.gz: f4479d3b94254de19b34f0e0773ef6fdd4459b7fe388fe80a1567686b70c2a34
+  metadata.gz: bbe2270af80c93aaa2613434faa3c801337ec316a68bdd25d4b6d92d9979398a
+  data.tar.gz: ee84bbf8cb2bd2beae91c080e480fe5fc3f0c2773a305743388cf3f225355eb2
 SHA512:
-  metadata.gz: 8ba28c715feabd5561329e72361c7b01aae12987ddd1bd338c77d31e079b220c2ec0f08e8d03ac9386c08196b3d77a4bd8a5b01a18bff1c432efcae9034d00b8
-  data.tar.gz: 97d7c4fadc853771ca46a4a08da9d79c393d8c7048fc0dc867685115d632e0178fdc18fc6964e8aa9ad5c737d706ac4ba0ca0425ef7bdf483b9c8b6191d1ce98
+  metadata.gz: 0ac214d1af05ecf0f156a81dc751421cbbe1d94c6306420d0aeb87c7dabf96eca819a0b199705d40d408b3a22b73227a523bb06e121c1e60c7dfbbb2f74dff10
+  data.tar.gz: 52d620bcd946c7197f129ebd59f2ba68676e67152dbeac297a4cdd5d72f74e9f3dc32c6c11b11f513443040721ccaa18b2c322e7b77162fb775fa7827fe3edd6

data/CHANGELOG.md

@@ -13,6 +13,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [12.1.4] - 2025-03-14
+
+### Added
+
+- Add support for PNPM lockfiles (lockfile versions 5, 6, and 9).
+- Add 'parser_options' arg to Bilbiothecary::Runner constructor.
+
+### Changed
+
+### Removed
+
+## [12.1.3] - 2025-02-26
+
+### Added
+
+- Add 'local' property to dependencies from Pipfile and Pipfile.lock
+
+### Changed
+
+- Handle aliases and NPM and Yarn, and ignore patched dependencies.
+- Fix a PyPI parser's regex to exclude false positive "require" names.
+- Drop all sub-projects from list of deps in a Maven maven-dependency-tree.txt.
+
+### Removed
+
+## [12.1.2] - 2025-02-26
+
+### Added
+
+- Add 'local' property to dependencies from Pipfile and Pipfile.lock
+
+### Changed
+
+### Removed
+
+## [12.1.1] - 2025-02-21
+
+### Added
+
+- Add test coverage for Go 1.24's new "tool" directive.
+
+### Changed
+
+### Removed
+
 ## [12.1.0] - 2025-01-30
 
 ### Added

data/lib/bibliothecary/parsers/npm.rb

@@ -16,10 +16,6 @@ module Bibliothecary
             kind: "manifest",
             parser: :parse_manifest,
           },
-          match_filename("npm-shrinkwrap.json") => {
-            kind: "lockfile",
-            parser: :parse_shrinkwrap,
-          },
           match_filename("yarn.lock") => {
             kind: "lockfile",
             parser: :parse_yarn_lock,
@@ -28,10 +24,18 @@ module Bibliothecary
             kind: "lockfile",
             parser: :parse_package_lock,
           },
+          match_filename("pnpm-lock.yaml") => {
+            kind: "lockfile",
+            parser: :parse_pnpm_lock,
+          },
           match_filename("npm-ls.json") => {
             kind: "lockfile",
             parser: :parse_ls,
           },
+          match_filename("npm-shrinkwrap.json") => {
+            kind: "lockfile",
+            parser: :parse_shrinkwrap,
+          },
         }
       end
 
@@ -248,6 +252,65 @@ module Bibliothecary
           end
       end
 
+      # This method currently has been tested to support:
+      #   lockfileVersion: '9.0'
+      #   lockfileVersion: '6.0'
+      #   lockfileVersion: '5.4'
+      def self.parse_pnpm_lock(contents, _source = nil)
+        parsed = YAML.load(contents)
+        lockfile_version = parsed["lockfileVersion"].to_i
+
+        dev_dependencies = parsed.dig("importers", ".", "devDependencies") # <= v9
+        dev_dependencies ||= parsed["devDependencies"] # <v9
+
+        # "dependencies" is in "packages" for < v9 and in "snapshots" for >= v9
+        # as of https://github.com/pnpm/pnpm/pull/7700.
+        (parsed["snapshots"] || parsed["packages"])
+          .map do |name_version, details|
+            name, version = case lockfile_version
+                            when 5
+                              # e.g. '/debug/2.6.9:'
+                              n, v = name_version.sub(/^\//, "").split("/", 2)
+                              # e.g. '/debug/2.2.0_supports-color@1.2.0:'
+                              v = v.split("_", 2)[0]
+                              [n, v] # rubocop:disable Style/IdenticalConditionalBranches
+                            when 6
+                              # e.g. '/debug@2.6.9:'
+                              n, v = name_version.sub(/^\//, "").split("@", 2)
+                              # e.g. "debug@2.2.0(supports-color@1.2.0)"
+                              v = v.split("(", 2).first
+                              [n, v] # rubocop:disable Style/IdenticalConditionalBranches
+                            else
+                              # e.g. 'debug@2.6.9:'
+                              n, v = name_version.split("@", 2)
+                              # e.g. "debug@2.2.0(supports-color@1.2.0)"
+                              v = v.split("(", 2).first
+                              [n, v] # rubocop:disable Style/IdenticalConditionalBranches
+                            end
+
+            # TODO: the "dev" field was removed in v9 lockfiles (https://github.com/pnpm/pnpm/pull/7808)
+            # so this will only exist in v6 and below and might be unreliable.
+            # The proper way to set this for v9+ is to build a lookup of deps to
+            # their "dependencies", and then recurse through each package's
+            # parents. If the direct dep(s) that required them are all
+            # "devDependencies" then we can consider them "dev == true". This
+            # should be done using a DAG data structure, though, to be efficient
+            # and avoid cycles.
+            is_dev = details["dev"] == true
+
+            # Fallback for v9+: this only detects dev deps that are direct.
+            is_dev ||= dev_dependencies.any? do |dev_name, dev_details|
+              dev_name == name && dev_details["version"] == version
+            end
+
+            Dependency.new(
+              name: name,
+              requirement: version,
+              type: is_dev ? "development" : "runtime"
+            )
+          end
+      end
+
       def self.parse_ls(file_contents, options: {})
         manifest = JSON.parse(file_contents)
 

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "12.1.3"
+  VERSION = "12.1.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 12.1.3
+  version: 12.1.4
 platform: ruby
 authors:
 - Andrew Nesbitt