bibliothecary 12.1.3 → 12.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b061a0f0ac234c87fb6821f0575ecb1f4fe7b9a217fdeec726cf5d9389a6264a
-  data.tar.gz: f4479d3b94254de19b34f0e0773ef6fdd4459b7fe388fe80a1567686b70c2a34
+  metadata.gz: e8b70e5a827feb678f61dc5d2f3760be0b627ad948556ccb22dc74521df046c9
+  data.tar.gz: de4f2d64c252570088d1c223002d6942247c45a18f3382e88448338e097273e9
 SHA512:
-  metadata.gz: 8ba28c715feabd5561329e72361c7b01aae12987ddd1bd338c77d31e079b220c2ec0f08e8d03ac9386c08196b3d77a4bd8a5b01a18bff1c432efcae9034d00b8
-  data.tar.gz: 97d7c4fadc853771ca46a4a08da9d79c393d8c7048fc0dc867685115d632e0178fdc18fc6964e8aa9ad5c737d706ac4ba0ca0425ef7bdf483b9c8b6191d1ce98
+  metadata.gz: cda3bfcd8d209364d5d8c6fe5b062f308437863f6e09ec05e05f473c486a425c6e0d68eaed3a8a8716119db7cb1ce65ee0921c781f9bacb1e927dd5a17bc7d58
+  data.tar.gz: efacaa12ee9cb7e88b876b4ea8fabf48bfa72ff2da49c4ee637d98bf4ad0f80219d3ad106c5cdc49560557dca078304729592fc89b79a9082ae501446a1d4236

data/CHANGELOG.md

@@ -13,6 +13,62 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [12.1.5] - 2025-03-17
+
+### Added
+
+- Adds alias support for PNPM lockfiles.
+- Add support for bun.lock files
+
+### Changed
+
+### Removed
+
+## [12.1.4] - 2025-03-14
+
+### Added
+
+- Add support for PNPM lockfiles (lockfile versions 5, 6, and 9).
+- Add 'parser_options' arg to Bilbiothecary::Runner constructor.
+
+### Changed
+
+### Removed
+
+## [12.1.3] - 2025-02-26
+
+### Added
+
+- Add 'local' property to dependencies from Pipfile and Pipfile.lock
+
+### Changed
+
+- Handle aliases and NPM and Yarn, and ignore patched dependencies.
+- Fix a PyPI parser's regex to exclude false positive "require" names.
+- Drop all sub-projects from list of deps in a Maven maven-dependency-tree.txt.
+
+### Removed
+
+## [12.1.2] - 2025-02-26
+
+### Added
+
+- Add 'local' property to dependencies from Pipfile and Pipfile.lock
+
+### Changed
+
+### Removed
+
+## [12.1.1] - 2025-02-21
+
+### Added
+
+- Add test coverage for Go 1.24's new "tool" directive.
+
+### Changed
+
+### Removed
+
 ## [12.1.0] - 2025-01-30
 
 ### Added

data/bibliothecary.gemspec

@@ -23,6 +23,7 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "commander"
   spec.add_dependency "deb_control"
+  spec.add_dependency "json", "~> 2.8"
   spec.add_dependency "librariesio-gem-parser"
   spec.add_dependency "ox", ">= 2.8.1"
   spec.add_dependency "packageurl-ruby"

data/lib/bibliothecary/parsers/npm.rb

@@ -16,10 +16,6 @@ module Bibliothecary
             kind: "manifest",
             parser: :parse_manifest,
           },
-          match_filename("npm-shrinkwrap.json") => {
-            kind: "lockfile",
-            parser: :parse_shrinkwrap,
-          },
           match_filename("yarn.lock") => {
             kind: "lockfile",
             parser: :parse_yarn_lock,
@@ -28,10 +24,22 @@ module Bibliothecary
             kind: "lockfile",
             parser: :parse_package_lock,
           },
+          match_filename("pnpm-lock.yaml") => {
+            kind: "lockfile",
+            parser: :parse_pnpm_lock,
+          },
           match_filename("npm-ls.json") => {
             kind: "lockfile",
             parser: :parse_ls,
           },
+          match_filename("npm-shrinkwrap.json") => {
+            kind: "lockfile",
+            parser: :parse_shrinkwrap,
+          },
+          match_filename("bun.lock") => {
+            kind: "lockfile",
+            parser: :parse_bun_lock,
+          },
         }
       end
 
@@ -248,12 +256,167 @@ module Bibliothecary
           end
       end
 
+      def self.parse_v5_pnpm_lock(parsed_contents, _source = nil)
+        dependency_mapping = parsed_contents.fetch("dependencies", {})
+          .merge(parsed_contents.fetch("devDependencies", {}))
+
+        parsed_contents["packages"]
+          .map do |name_version, details|
+            # e.g. "/debug/2.6.9:"
+            name, version = name_version.sub(/^\//, "").split("/", 2)
+
+            # e.g. "/debug/2.2.0_supports-color@1.2.0:"
+            version = version.split("_", 2)[0]
+
+            # e.g. "alias-package: /zod/3.24.2"
+            original_name = nil
+            original_requirement = nil
+            if (alias_dep = dependency_mapping.find { |_n, v| v.start_with?("/#{name}/") })
+              original_name = alias_dep[0]
+              original_requirement = alias_dep[1].split("/", 3)[2] # e.g. "/zod/3.24.2"
+            end
+
+            is_dev = details["dev"] == true
+
+            Dependency.new(
+              name: name,
+              requirement: version,
+              original_name: original_name,
+              original_requirement: original_requirement,
+              type: is_dev ? "development" : "runtime"
+            )
+          end
+      end
+
+      def self.parse_v6_pnpm_lock(parsed_contents, _source = nil)
+        dependency_mapping = parsed_contents.fetch("dependencies", {})
+          .merge(parsed_contents.fetch("devDependencies", {}))
+
+        parsed_contents["packages"]
+          .map do |name_version, details|
+            # e.g. "/debug@2.6.9:"
+            name, version = name_version.sub(/^\//, "").split("@", 2)
+
+            # e.g. "debug@2.2.0(supports-color@1.2.0)"
+            version = version.split("(", 2).first
+
+            # e.g.
+            #  alias-package:
+            #    specifier: npm:zod
+            #    version: /zod@3.24.2
+            original_name = nil
+            original_requirement = nil
+            if (alias_dep = dependency_mapping.find { |_n, info| info["specifier"] == "npm:#{name}" })
+              original_name = alias_dep[0]
+              original_requirement = alias_dep[1]["version"].sub(/^\//, "").split("@", 2)[1]
+            end
+
+            is_dev = details["dev"] == true
+
+            Dependency.new(
+              name: name,
+              requirement: version,
+              original_name: original_name,
+              original_requirement: original_requirement,
+              type: is_dev ? "development" : "runtime"
+            )
+          end
+      end
+
+      def self.parse_v9_pnpm_lock(parsed_contents, _source = nil)
+        dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("dependencies")
+        dev_dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("devDependencies")
+        dependency_mapping = dependencies.merge(dev_dependencies)
+
+        # "dependencies" is in "packages" for < v9 and in "snapshots" for >= v9
+        # as of https://github.com/pnpm/pnpm/pull/7700.
+        parsed_contents["snapshots"]
+          .map do |name_version, _details|
+            # e.g. "debug@2.6.9:"
+            name, version = name_version.split("@", 2)
+
+            # e.g. "debug@2.2.0(supports-color@1.2.0)"
+            version = version.split("(", 2).first
+
+            # e.g.
+            #  alias-package:
+            #    specifier: npm:zod
+            #    version: zod@3.24.2
+            original_name = nil
+            original_requirement = nil
+            if (alias_dep = dependency_mapping.find { |_n, info| info["specifier"] == "npm:#{name}" })
+              original_name = alias_dep[0]
+              original_requirement = alias_dep[1]["version"].split("@", 2)[1]
+            end
+
+            # TODO: the "dev" field was removed in v9 lockfiles (https://github.com/pnpm/pnpm/pull/7808)
+            # The proper way to set this for v9+ is to build a lookup of deps to
+            # their "dependencies", and then recurse through each package's
+            # parents. If the direct dep(s) that required them are all
+            # "devDependencies" then we can consider them "dev == true". This
+            # should be done using a DAG data structure, though, to be efficient
+            # and avoid cycles.
+            is_dev ||= dev_dependencies.any? do |dev_name, dev_details|
+              dev_name == name && dev_details["version"] == version
+            end
+
+            Dependency.new(
+              name: name,
+              requirement: version,
+              original_name: original_name,
+              original_requirement: original_requirement,
+              type: is_dev ? "development" : "runtime"
+            )
+          end
+      end
+
+      # This method currently has been tested to support:
+      #   lockfileVersion: '9.0'
+      #   lockfileVersion: '6.0'
+      #   lockfileVersion: '5.4'
+      def self.parse_pnpm_lock(contents, _source = nil)
+        parsed = YAML.load(contents)
+        lockfile_version = parsed["lockfileVersion"].to_i
+
+        case lockfile_version
+        when 5
+          parse_v5_pnpm_lock(parsed)
+        when 6
+          parse_v6_pnpm_lock(parsed)
+        else # v9+
+          parse_v9_pnpm_lock(parsed)
+        end
+      end
+
       def self.parse_ls(file_contents, options: {})
         manifest = JSON.parse(file_contents)
 
         transform_tree_to_array(manifest.fetch("dependencies", {}), options.fetch(:filename, nil))
       end
 
+      def self.parse_bun_lock(file_contents, options: {})
+        manifest = JSON.parse(file_contents, allow_trailing_comma: true)
+        source = options.fetch(:filename, nil)
+
+        dev_deps = manifest.dig("workspaces", "", "devDependencies")&.keys&.to_set
+
+        manifest.fetch("packages", []).map do |name, info|
+          info_name, _, version = info.first.rpartition("@")
+          is_local = version&.start_with?("file:")
+          is_alias = info_name != name
+
+          Dependency.new(
+            name: info_name,
+            original_name: is_alias ? name : nil,
+            requirement: version,
+            original_requirement: is_alias ? version : nil,
+            type: dev_deps&.include?(name) ? "development" : "runtime",
+            local: is_local,
+            source: source
+          )
+        end
+      end
+
       def self.lockfile_preference_order(file_infos)
         files = file_infos.each_with_object({}) do |file_info, obj|
           obj[File.basename(file_info.full_path)] = file_info

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "12.1.3"
+  VERSION = "12.1.5"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 12.1.3
+  version: 12.1.5
 platform: ruby
 authors:
 - Andrew Nesbitt
 bindir: bin
 cert_chain: []
-date: 2025-03-14 00:00:00.000000000 Z
+date: 2025-03-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander
@@ -37,6 +37,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.8'
 - !ruby/object:Gem::Dependency
   name: librariesio-gem-parser
   requirement: !ruby/object:Gem::Requirement