bibliothecary 12.1.5 → 12.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e8b70e5a827feb678f61dc5d2f3760be0b627ad948556ccb22dc74521df046c9
-  data.tar.gz: de4f2d64c252570088d1c223002d6942247c45a18f3382e88448338e097273e9
+  metadata.gz: 18bfbedc4fbc53fe3e7f4ee02ee42ba27462dbc488efd3ee48a87e2ad12cd1e2
+  data.tar.gz: 5210a4d460815bf40f21639b0a2d887a59b9672fdb64d97981809ab87cbae744
 SHA512:
-  metadata.gz: cda3bfcd8d209364d5d8c6fe5b062f308437863f6e09ec05e05f473c486a425c6e0d68eaed3a8a8716119db7cb1ce65ee0921c781f9bacb1e927dd5a17bc7d58
-  data.tar.gz: efacaa12ee9cb7e88b876b4ea8fabf48bfa72ff2da49c4ee637d98bf4ad0f80219d3ad106c5cdc49560557dca078304729592fc89b79a9082ae501446a1d4236
+  metadata.gz: e0a2503b63e500193ba491ee1875ba0ded58a01d5fa6bed2eefae36cf2e4e6f0111a1f84dd1334b8bd3bf0b728065dcba299d19b7414d476f606554031840b7b
+  data.tar.gz: dd586eb81b390826b23021edf014ff2adc2f6738487c18a51a1e08dc9ad0b10a6b8d9e20b79219411b45f3323221b9d0c0f0c8bc977feb7e90d66af8ce329fda

data/CHANGELOG.md

@@ -13,6 +13,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [12.1.7] - 2025-04-29
+
+### Added
+
+### Changed
+
+- Include "source" field in Dependency objects from pub files.
+- Include "source" field in Dependency objects from pnpm-lock.yaml files.
+
+### Removed
+
+## [12.1.6] - 2025-04-29
+
+### Added
+
+### Changed
+
+- Use JSON.parser.parse() in bun.lock parser to work around overriden JSON.parse() method.
+- Don't raise an error in pnpm-lock.yaml v9 parser if devDependencies isn't found.
+
+### Removed
+
 ## [12.1.5] - 2025-03-17
 
 ### Added

data/lib/bibliothecary/parsers/npm.rb

@@ -256,7 +256,7 @@ module Bibliothecary
           end
       end
 
-      def self.parse_v5_pnpm_lock(parsed_contents, _source = nil)
+      def self.parse_v5_pnpm_lock(parsed_contents, source = nil)
         dependency_mapping = parsed_contents.fetch("dependencies", {})
           .merge(parsed_contents.fetch("devDependencies", {}))
 
@@ -283,12 +283,13 @@ module Bibliothecary
               requirement: version,
               original_name: original_name,
               original_requirement: original_requirement,
-              type: is_dev ? "development" : "runtime"
+              type: is_dev ? "development" : "runtime",
+              source: source
             )
           end
       end
 
-      def self.parse_v6_pnpm_lock(parsed_contents, _source = nil)
+      def self.parse_v6_pnpm_lock(parsed_contents, source = nil)
         dependency_mapping = parsed_contents.fetch("dependencies", {})
           .merge(parsed_contents.fetch("devDependencies", {}))
 
@@ -318,14 +319,15 @@ module Bibliothecary
               requirement: version,
               original_name: original_name,
               original_requirement: original_requirement,
-              type: is_dev ? "development" : "runtime"
+              type: is_dev ? "development" : "runtime",
+              source: source
             )
           end
       end
 
-      def self.parse_v9_pnpm_lock(parsed_contents, _source = nil)
-        dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("dependencies")
-        dev_dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("devDependencies")
+      def self.parse_v9_pnpm_lock(parsed_contents, source = nil)
+        dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("dependencies", {})
+        dev_dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("devDependencies", {})
         dependency_mapping = dependencies.merge(dev_dependencies)
 
         # "dependencies" is in "packages" for < v9 and in "snapshots" for >= v9
@@ -365,7 +367,8 @@ module Bibliothecary
               requirement: version,
               original_name: original_name,
               original_requirement: original_requirement,
-              type: is_dev ? "development" : "runtime"
+              type: is_dev ? "development" : "runtime",
+              source: source
             )
           end
       end
@@ -374,17 +377,17 @@ module Bibliothecary
       #   lockfileVersion: '9.0'
       #   lockfileVersion: '6.0'
       #   lockfileVersion: '5.4'
-      def self.parse_pnpm_lock(contents, _source = nil)
+      def self.parse_pnpm_lock(contents, options: {})
         parsed = YAML.load(contents)
         lockfile_version = parsed["lockfileVersion"].to_i
 
         case lockfile_version
         when 5
-          parse_v5_pnpm_lock(parsed)
+          parse_v5_pnpm_lock(parsed, options.fetch(:filename, nil))
         when 6
-          parse_v6_pnpm_lock(parsed)
+          parse_v6_pnpm_lock(parsed, options.fetch(:filename, nil))
         else # v9+
-          parse_v9_pnpm_lock(parsed)
+          parse_v9_pnpm_lock(parsed, options.fetch(:filename, nil))
         end
       end
 
@@ -395,7 +398,11 @@ module Bibliothecary
       end
 
       def self.parse_bun_lock(file_contents, options: {})
-        manifest = JSON.parse(file_contents, allow_trailing_comma: true)
+        # The stdlib JSON gem 2.8+ supports trailing commas.
+        # The Oj gem does not support them as of writing, and will override
+        # JSON.parse() if Oj.mimic_json/optimize_rails has been called. Luckily
+        # JSON.parser is not overridden by Oj, so use it to call parse directly.
+        manifest = JSON.parser.parse(file_contents, allow_trailing_comma: true)
         source = options.fetch(:filename, nil)
 
         dev_deps = manifest.dig("workspaces", "", "devDependencies")&.keys&.to_set

data/lib/bibliothecary/parsers/pub.rb

@@ -22,19 +22,20 @@ module Bibliothecary
 
       add_multi_parser(Bibliothecary::MultiParsers::DependenciesCSV)
 
-      def self.parse_yaml_manifest(file_contents, options: {}) # rubocop:disable Lint/UnusedMethodArgument
+      def self.parse_yaml_manifest(file_contents, options: {})
         manifest = YAML.load file_contents
-        map_dependencies(manifest, "dependencies", "runtime") +
-          map_dependencies(manifest, "dev_dependencies", "development")
+        map_dependencies(manifest, "dependencies", "runtime", options.fetch(:filename, nil)) +
+          map_dependencies(manifest, "dev_dependencies", "development", options.fetch(:filename, nil))
       end
 
-      def self.parse_yaml_lockfile(file_contents, options: {}) # rubocop:disable Lint/UnusedMethodArgument
+      def self.parse_yaml_lockfile(file_contents, options: {})
         manifest = YAML.load file_contents
         manifest.fetch("packages", []).map do |name, dep|
           Dependency.new(
             name: name,
             requirement: dep["version"],
-            type: "runtime"
+            type: "runtime",
+            source: options.fetch(:filename, nil)
           )
         end
       end

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "12.1.5"
+  VERSION = "12.1.7"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 12.1.5
+  version: 12.1.7
 platform: ruby
 authors:
 - Andrew Nesbitt
 bindir: bin
 cert_chain: []
-date: 2025-03-18 00:00:00.000000000 Z
+date: 2025-04-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander