bibliothecary 12.1.6 → 12.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 28a553f3ccc80b401878d7d1f05d9b2ca1504e52fc0705b101759665391f8316
-  data.tar.gz: db49351f1c52f112c5936a787135fe185bc4b4b9aab6ea02376fbe85735db512
+  metadata.gz: 77ce2638e657925c2ce0457675ddafea27858758ec53f68f996667eb21ac290c
+  data.tar.gz: 7027d2ce73799ee52fdb6665fbaa115d2d630676cf777a740d62fae5ffa90534
 SHA512:
-  metadata.gz: a63120979de0f7f661383b6c7efafda1acc0787821eae36164bb7469fc35bf5f9028cab9cf1c53e1289d30103c57cbc064bdc9cffc91feb48745744359a0ac73
-  data.tar.gz: 802a1ee3a8031b6b47f29f369cf8cade92e835784cbb35e7abaf25a6035160bc35043fa8fb23b47c7720b6e54139eb0f607d176f772a40869ddc030687e95bd3
+  metadata.gz: 9f12ee44667a46ec862d620870f1372755efe70af26243320b785e854c37e6ed7047d0988eadbe9758a9194c32d5f85772f5b2f9d69ee2a9e19e13a9873f937a
+  data.tar.gz: 660b68966106543fbc7c8326a77ca5cc89947321dacf8f35a19aa1ee6818e4d077a1f1f0e86f1f8a7d6e52da6d377a7f8c90ac43d1b809158fe65c94dbaeb5c5

data/CHANGELOG.md

@@ -13,6 +13,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [12.1.8] - 2025-05-16
+
+### Added
+
+- Support multiple requirements for a single package in poetry.lock.
+
+### Changed
+
+### Removed
+
+## [12.1.7] - 2025-04-29
+
+### Added
+
+### Changed
+
+- Include "source" field in Dependency objects from pub files.
+- Include "source" field in Dependency objects from pnpm-lock.yaml files.
+
+### Removed
+
 ## [12.1.6] - 2025-04-29
 
 ### Added
@@ -84,7 +105,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Populate Bibliothecary::Dependency#source field in all parsers. This makes the source field useful when consuming 
+- Populate Bibliothecary::Dependency#source field in all parsers. This makes the source field useful when consuming
   from Bibliothecary, and removes a step from consumers having to populate this field themselves.
 
 ### Changed
@@ -127,9 +148,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Support parsing *.spdx.json files
+- Support parsing \*.spdx.json files
 
 ### Changed
+
 - `Bibliothecary::PURL_TYPE_MAPPING` has changed to `Bibliothecary::PurlUtil::PURL_TYPE_MAPPING`
 - `Bibliothecary::MultiParsers::CycloneDX::ManifestEntries.full_name_for_purl` has changed to `Bibliothecary::PurlUtil.full_name`
 

data/lib/bibliothecary/parsers/npm.rb

@@ -256,7 +256,7 @@ module Bibliothecary
           end
       end
 
-      def self.parse_v5_pnpm_lock(parsed_contents, _source = nil)
+      def self.parse_v5_pnpm_lock(parsed_contents, source = nil)
         dependency_mapping = parsed_contents.fetch("dependencies", {})
           .merge(parsed_contents.fetch("devDependencies", {}))
 
@@ -283,12 +283,13 @@ module Bibliothecary
               requirement: version,
               original_name: original_name,
               original_requirement: original_requirement,
-              type: is_dev ? "development" : "runtime"
+              type: is_dev ? "development" : "runtime",
+              source: source
             )
           end
       end
 
-      def self.parse_v6_pnpm_lock(parsed_contents, _source = nil)
+      def self.parse_v6_pnpm_lock(parsed_contents, source = nil)
         dependency_mapping = parsed_contents.fetch("dependencies", {})
           .merge(parsed_contents.fetch("devDependencies", {}))
 
@@ -318,12 +319,13 @@ module Bibliothecary
               requirement: version,
               original_name: original_name,
               original_requirement: original_requirement,
-              type: is_dev ? "development" : "runtime"
+              type: is_dev ? "development" : "runtime",
+              source: source
             )
           end
       end
 
-      def self.parse_v9_pnpm_lock(parsed_contents, _source = nil)
+      def self.parse_v9_pnpm_lock(parsed_contents, source = nil)
         dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("dependencies", {})
         dev_dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("devDependencies", {})
         dependency_mapping = dependencies.merge(dev_dependencies)
@@ -365,7 +367,8 @@ module Bibliothecary
               requirement: version,
               original_name: original_name,
               original_requirement: original_requirement,
-              type: is_dev ? "development" : "runtime"
+              type: is_dev ? "development" : "runtime",
+              source: source
             )
           end
       end
@@ -374,17 +377,17 @@ module Bibliothecary
       #   lockfileVersion: '9.0'
       #   lockfileVersion: '6.0'
       #   lockfileVersion: '5.4'
-      def self.parse_pnpm_lock(contents, _source = nil)
+      def self.parse_pnpm_lock(contents, options: {})
         parsed = YAML.load(contents)
         lockfile_version = parsed["lockfileVersion"].to_i
 
         case lockfile_version
         when 5
-          parse_v5_pnpm_lock(parsed)
+          parse_v5_pnpm_lock(parsed, options.fetch(:filename, nil))
         when 6
-          parse_v6_pnpm_lock(parsed)
+          parse_v6_pnpm_lock(parsed, options.fetch(:filename, nil))
         else # v9+
-          parse_v9_pnpm_lock(parsed)
+          parse_v9_pnpm_lock(parsed, options.fetch(:filename, nil))
         end
       end
 

data/lib/bibliothecary/parsers/pub.rb

@@ -22,19 +22,20 @@ module Bibliothecary
 
       add_multi_parser(Bibliothecary::MultiParsers::DependenciesCSV)
 
-      def self.parse_yaml_manifest(file_contents, options: {}) # rubocop:disable Lint/UnusedMethodArgument
+      def self.parse_yaml_manifest(file_contents, options: {})
         manifest = YAML.load file_contents
-        map_dependencies(manifest, "dependencies", "runtime") +
-          map_dependencies(manifest, "dev_dependencies", "development")
+        map_dependencies(manifest, "dependencies", "runtime", options.fetch(:filename, nil)) +
+          map_dependencies(manifest, "dev_dependencies", "development", options.fetch(:filename, nil))
       end
 
-      def self.parse_yaml_lockfile(file_contents, options: {}) # rubocop:disable Lint/UnusedMethodArgument
+      def self.parse_yaml_lockfile(file_contents, options: {})
         manifest = YAML.load file_contents
         manifest.fetch("packages", []).map do |name, dep|
           Dependency.new(
             name: name,
             requirement: dep["version"],
-            type: "runtime"
+            type: "runtime",
+            source: options.fetch(:filename, nil)
           )
         end
       end

data/lib/bibliothecary/parsers/pypi.rb

@@ -142,16 +142,31 @@ module Bibliothecary
       def self.map_dependencies(packages, type, source = nil)
         return [] unless packages
 
-        packages.map do |name, package_info|
+        packages.flat_map do |name, package_info|
           local = true if package_info.is_a?(Hash) && (package_info.key?("path") || package_info.key?("file"))
 
-          Dependency.new(
-            name: name,
-            requirement: map_requirements(package_info),
-            type: type,
-            source: source,
-            local: local
-          )
+          if package_info.is_a?(Array)
+            # Poetry supports multiple requirements with differing specifiers for the same
+            # package. Break these out into a separate dep per requirement.
+            # https://python-poetry.org/docs/dependency-specification/#multiple-constraints-dependencies
+            package_info.map do |info|
+              Dependency.new(
+                name: name,
+                requirement: map_requirements(info),
+                type: type,
+                source: source,
+                local: local
+              )
+            end
+          else
+            Dependency.new(
+              name: name,
+              requirement: map_requirements(package_info),
+              type: type,
+              source: source,
+              local: local
+            )
+          end
         end
       end
 
@@ -160,7 +175,7 @@ module Bibliothecary
           if info["version"]
             info["version"]
           elsif info["git"]
-            "#{info['git']}##{info['ref']}"
+            "#{info['git']}##{info['ref'] || info['tag']}"
           else
             "*"
           end
@@ -186,19 +201,25 @@ module Bibliothecary
         deps = []
         manifest["package"].each do |package|
           # next if group == "_meta"
-          group = case package["category"]
-                  when "dev"
-                    "develop"
-                  else
-                    "runtime"
-                  end
 
-          deps << Dependency.new(
-            name: package["name"],
-            requirement: map_requirements(package),
-            type: group,
-            source: options.fetch(:filename, nil)
-          )
+          # Poetry <1.2.0 used singular "category" for kind
+          # Poetry >=1.2.0 uses plural "groups" field for kind(s)
+          package.values_at("category", "groups").flatten.compact
+            .map do |g|
+              if g == "dev"
+                "develop"
+              else
+                (g == "main" ? "runtime" : g)
+              end
+            end
+            .each do |group|
+              deps << Dependency.new(
+                name: package["name"],
+                requirement: map_requirements(package),
+                type: group,
+                source: options.fetch(:filename, nil)
+              )
+            end
         end
         deps
       end

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "12.1.6"
+  VERSION = "12.1.8"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 12.1.6
+  version: 12.1.8
 platform: ruby
 authors:
 - Andrew Nesbitt
 bindir: bin
 cert_chain: []
-date: 2025-04-29 00:00:00.000000000 Z
+date: 2025-05-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander