bibliothecary 12.1.7 → 12.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18bfbedc4fbc53fe3e7f4ee02ee42ba27462dbc488efd3ee48a87e2ad12cd1e2
-  data.tar.gz: 5210a4d460815bf40f21639b0a2d887a59b9672fdb64d97981809ab87cbae744
+  metadata.gz: 38a42d90ccaf9bb96b2be9c736b5559a3c3fa81286bbea8c404a33f3a4cb89be
+  data.tar.gz: 36b09c415f331863ba6ab1a82eff0a78cc759b01ae0bad339c9e6cc80c6789c1
 SHA512:
-  metadata.gz: e0a2503b63e500193ba491ee1875ba0ded58a01d5fa6bed2eefae36cf2e4e6f0111a1f84dd1334b8bd3bf0b728065dcba299d19b7414d476f606554031840b7b
-  data.tar.gz: dd586eb81b390826b23021edf014ff2adc2f6738487c18a51a1e08dc9ad0b10a6b8d9e20b79219411b45f3323221b9d0c0f0c8bc977feb7e90d66af8ce329fda
+  metadata.gz: 769fe185aedefda6b8c95c6c66700a070a4b7448a0ee452c8b1cbaf1507e3443945f6bef6ff7ead4e17458c43f81afbc86b2e0f592bb779d6f603b379a09fed6
+  data.tar.gz: 05d1709b1cb6410ff3250ea2472cefa2eec4f7dff5eca9864d9eb5837f107ec6aaf3fc629f6ba476e49b382e9a05951fdb25abbe04099d1b95124219891bb149

data/CHANGELOG.md

@@ -13,6 +13,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [12.1.9] - 2025-05-16
+
+### Added
+
+### Changed
+
+- Fix 12.1.8 Poetry regression that ignored deps with no category or group.
+
+### Removed
+
+## [12.1.8] - 2025-05-16
+
+### Added
+
+- Support multiple requirements for a single package in poetry.lock.
+
+### Changed
+
+### Removed
+
 ## [12.1.7] - 2025-04-29
 
 ### Added
@@ -95,7 +115,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Populate Bibliothecary::Dependency#source field in all parsers. This makes the source field useful when consuming 
+- Populate Bibliothecary::Dependency#source field in all parsers. This makes the source field useful when consuming
   from Bibliothecary, and removes a step from consumers having to populate this field themselves.
 
 ### Changed
@@ -138,9 +158,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Support parsing *.spdx.json files
+- Support parsing \*.spdx.json files
 
 ### Changed
+
 - `Bibliothecary::PURL_TYPE_MAPPING` has changed to `Bibliothecary::PurlUtil::PURL_TYPE_MAPPING`
 - `Bibliothecary::MultiParsers::CycloneDX::ManifestEntries.full_name_for_purl` has changed to `Bibliothecary::PurlUtil.full_name`
 

data/lib/bibliothecary/parsers/pypi.rb

@@ -122,12 +122,6 @@ module Bibliothecary
         deps.uniq
       end
 
-      # TODO: this was deprecated in 8.6.0. Remove this in any major version bump >= 9.*
-      def self.parse_poetry(file_contents, options: {})
-        puts "Warning: parse_poetry() is deprecated, use parse_pyproject() instead."
-        parse_pyproject(file_contents, options)
-      end
-
       def self.parse_conda(file_contents, options: {})
         contents = YAML.safe_load(file_contents)
         return [] unless contents
@@ -142,16 +136,31 @@ module Bibliothecary
       def self.map_dependencies(packages, type, source = nil)
         return [] unless packages
 
-        packages.map do |name, package_info|
+        packages.flat_map do |name, package_info|
           local = true if package_info.is_a?(Hash) && (package_info.key?("path") || package_info.key?("file"))
 
-          Dependency.new(
-            name: name,
-            requirement: map_requirements(package_info),
-            type: type,
-            source: source,
-            local: local
-          )
+          if package_info.is_a?(Array)
+            # Poetry supports multiple requirements with differing specifiers for the same
+            # package. Break these out into a separate dep per requirement.
+            # https://python-poetry.org/docs/dependency-specification/#multiple-constraints-dependencies
+            package_info.map do |info|
+              Dependency.new(
+                name: name,
+                requirement: map_requirements(info),
+                type: type,
+                source: source,
+                local: local
+              )
+            end
+          else
+            Dependency.new(
+              name: name,
+              requirement: map_requirements(package_info),
+              type: type,
+              source: source,
+              local: local
+            )
+          end
         end
       end
 
@@ -160,7 +169,7 @@ module Bibliothecary
           if info["version"]
             info["version"]
           elsif info["git"]
-            "#{info['git']}##{info['ref']}"
+            "#{info['git']}##{info['ref'] || info['tag']}"
           else
             "*"
           end
@@ -186,19 +195,28 @@ module Bibliothecary
         deps = []
         manifest["package"].each do |package|
           # next if group == "_meta"
-          group = case package["category"]
-                  when "dev"
-                    "develop"
-                  else
-                    "runtime"
-                  end
 
-          deps << Dependency.new(
-            name: package["name"],
-            requirement: map_requirements(package),
-            type: group,
-            source: options.fetch(:filename, nil)
-          )
+          # Poetry <1.2.0 used singular "category" for kind
+          # Poetry >=1.2.0 uses plural "groups" field for kind(s)
+          groups = package.values_at("category", "groups").flatten.compact
+            .map do |g|
+              if g == "dev"
+                "develop"
+              else
+                (g == "main" ? "runtime" : g)
+              end
+            end
+
+          groups = ["runtime"] if groups.empty?
+
+          groups.each do |group|
+            deps << Dependency.new(
+              name: package["name"],
+              requirement: map_requirements(package),
+              type: group,
+              source: options.fetch(:filename, nil)
+            )
+          end
         end
         deps
       end

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "12.1.7"
+  VERSION = "12.1.9"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 12.1.7
+  version: 12.1.9
 platform: ruby
 authors:
 - Andrew Nesbitt
 bindir: bin
 cert_chain: []
-date: 2025-04-30 00:00:00.000000000 Z
+date: 2025-05-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander