bibliothecary 12.1.9 → 12.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 38a42d90ccaf9bb96b2be9c736b5559a3c3fa81286bbea8c404a33f3a4cb89be
-  data.tar.gz: 36b09c415f331863ba6ab1a82eff0a78cc759b01ae0bad339c9e6cc80c6789c1
+  metadata.gz: 37cce0e70366df9eeaaf3d134ba139335359ed2b484ce78c737e8f155d4606b7
+  data.tar.gz: b23e369a3077301e8f3078a179f474b3afc83af926e445370988d170d998ae19
 SHA512:
-  metadata.gz: 769fe185aedefda6b8c95c6c66700a070a4b7448a0ee452c8b1cbaf1507e3443945f6bef6ff7ead4e17458c43f81afbc86b2e0f592bb779d6f603b379a09fed6
-  data.tar.gz: 05d1709b1cb6410ff3250ea2472cefa2eec4f7dff5eca9864d9eb5837f107ec6aaf3fc629f6ba476e49b382e9a05951fdb25abbe04099d1b95124219891bb149
+  metadata.gz: b46141115f05919f3d4f16b0e1cf03a0baf0060e972e5ec044c791c2f0124e0e0bcc34e87eec715298d207252cfbf8960c68edfc533ff5ee7290ad358af76ccb
+  data.tar.gz: a302ac6a16b775df78f2eef640feac02e624b2be6b8165f75492922c34e1c218de449bdfb6e3992e7f8b3941cf2d42c6457eb4d2025266b5abec05f553219902

data/CHANGELOG.md

@@ -13,6 +13,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [12.2.0] - 2025-05-30
+
+### Added
+
+- Maven parser support for maven-dependency-tree.dot file.
+
+### Changed
+
+### Removed
+
+## [12.1.10] - 2025-05-23
+
+### Added
+
+### Changed
+
+- Normalize package names in Poetry manifests, storing the original in
+  Dependency#original_name if it differs. This is because Poetry normalizes/canoncalizes
+  names in its lockfile according to PyPa's rules, but doesn't provide the original name.
+  Storing the original_name will provide a connection from manifest to lockfile.
+
+### Removed
+
 ## [12.1.9] - 2025-05-16
 
 ### Added

data/lib/bibliothecary/parsers/maven.rb

@@ -11,6 +11,10 @@ module Bibliothecary
     class Maven
       include Bibliothecary::Analyser
 
+      # Matches digraph contents from the Maven dependency tree .dot file format.
+      MAVEN_DOT_PROJECT_REGEXP = /digraph\s+"([^\"]+)"\s+{/
+      MAVEN_DOT_RELATIONSHIP_REGEXP = /"([^\"]+)"\s+->\s+"([^\"]+)"/
+
       # e.g. "annotationProcessor - Annotation processors and their dependencies for source set 'main'."
       GRADLE_TYPE_REGEXP = /^(\w+)/
 
@@ -113,10 +117,19 @@ module Bibliothecary
             kind: "lockfile",
             parser: :parse_sbt_update_full,
           },
+          # maven-dependency-tree.txt is the output of `mvn dependency:tree` as a single command.
+          # The tree lines contain "[INFO]" prefix and uses 2-space indentation.
           match_filename("maven-dependency-tree.txt", case_insensitive: true) => {
             kind: "lockfile",
             parser: :parse_maven_tree,
           },
+          # maven-dependency-tree.dot is the output of this command:
+          # `mvn dependency:tree -DoutputType=dot -DoutputFile=maven-dependency-tree.dot`
+          # It doesn't have the "[INFO]" prefix, and is in graphviz .dot format.
+          match_filename("maven-dependency-tree.dot", case_insensitive: true) => {
+            kind: "lockfile",
+            parser: :parse_maven_tree_dot,
+          },
         }
       end
 
@@ -303,23 +316,24 @@ module Bibliothecary
 
         raise "found no lines with deps in maven-dependency-tree.txt" if items.empty?
 
-        projects = {}
+        projects_to_exclude = {}
 
         if keep_subprojects
           # traditional behavior: we only exclude the root project, and only if we parsed multiple lines
           (root_name, root_version, _root_type) = parse_maven_tree_dependency(items.shift[1])
           unless items.empty?
-            projects[root_name] = Set.new
-            projects[root_name].add(root_version)
+            projects_to_exclude[root_name] = Set.new
+            projects_to_exclude[root_name].add(root_version)
           end
         end
 
         unique_items = items.map do |(depth, item)|
+          # new behavior: we exclude root and subprojects (depth 0 items)
           (name, version, type) = parse_maven_tree_dependency(item)
           if depth == 0 && !keep_subprojects
             # record and then remove the depth 0
-            projects[name] ||= Set.new
-            projects[name].add(version)
+            projects_to_exclude[name] ||= Set.new
+            projects_to_exclude[name].add(version)
             nil
           else
             [name, version, type]
@@ -328,7 +342,7 @@ module Bibliothecary
 
         unique_items
           # drop the projects and subprojects
-          .reject { |(name, version, _type)| projects[name]&.include?(version) }
+          .reject { |(name, version, _type)| projects_to_exclude[name]&.include?(version) }
           .map do |(name, version, type)|
             Bibliothecary::Dependency.new(
               name: name,
@@ -339,6 +353,32 @@ module Bibliothecary
           end
       end
 
+      def self.parse_maven_tree_dot(file_contents, options: {})
+        # Project could be either the root project or a sub-module.
+        project = file_contents.match(MAVEN_DOT_PROJECT_REGEXP)[1]
+        relationships = file_contents.scan(MAVEN_DOT_RELATIONSHIP_REGEXP)
+
+        direct_names_to_versions = relationships.each.with_object({}) do |(parent, child), obj|
+          next unless parent == project
+
+          name, version, _type = parse_maven_tree_dependency(child)
+          obj[name] ||= Set.new
+          obj[name].add(version)
+        end
+
+        relationships.map do |(_parent, child)|
+          child_name, child_version, child_type = parse_maven_tree_dependency(child)
+
+          Dependency.new(
+            name: child_name,
+            requirement: child_version,
+            type: child_type,
+            direct: direct_names_to_versions[child_name]&.include?(child_version) || false,
+            source: options.fetch(:filename, nil)
+          )
+        end.uniq
+      end
+
       def self.parse_resolved_dep_line(line, options: {})
         # filter out anything that doesn't look like a
         # resolved dep line

data/lib/bibliothecary/parsers/pypi.rb

@@ -119,7 +119,15 @@ module Bibliothecary
 
         # We're combining both poetry+PEP621 deps instead of making them mutually exclusive, until we
         # find a reason not to ingest them both.
-        deps.uniq
+        deps = deps.uniq
+
+        # Poetry normalizes names in lockfiles but doesn't provide the original, so we need to keep
+        # track of the original name so the dep is connected between manifest+lockfile.
+        deps.map do |dep|
+          normalized_name = normalize_name(dep.name)
+          Dependency.new(**dep.to_h, name: normalized_name,
+                                     original_name: normalized_name == dep.name ? nil : dep.name)
+        end
       end
 
       def self.parse_conda(file_contents, options: {})
@@ -210,8 +218,12 @@ module Bibliothecary
           groups = ["runtime"] if groups.empty?
 
           groups.each do |group|
+            # Poetry lockfiles should already contain normalizated names, but we'll
+            # apply it here as well just to be consistent with pyproject.toml parsing.
+            normalized_name = normalize_name(package["name"])
             deps << Dependency.new(
-              name: package["name"],
+              name: normalized_name,
+              original_name: normalized_name == package["name"] ? nil : package["name"],
               requirement: map_requirements(package),
               type: group,
               source: options.fetch(:filename, nil)
@@ -332,6 +344,12 @@ module Bibliothecary
         requirement = "*" if requirement == ""
         [name, requirement]
       end
+
+      # Apply PyPa's name normalization rules to the package name
+      # https://packaging.python.org/en/latest/specifications/name-normalization/#name-normalization
+      def self.normalize_name(name)
+        name.downcase.gsub(/[-_.]+/, "-")
+      end
     end
   end
 end

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "12.1.9"
+  VERSION = "12.2.0"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 12.1.9
+  version: 12.2.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 bindir: bin
 cert_chain: []
-date: 2025-05-17 00:00:00.000000000 Z
+date: 2025-05-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander