bibliothecary 13.0.1 → 14.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b41280265bf9f99394621a32e95fc736518aa4cb517042bed3f3fb14de11141e
-  data.tar.gz: 5abfea8b948e94d88e2b1a0ef48309b4783b63b9d8e1e2920ebee3af590fb42c
+  metadata.gz: b9a3de29330d7e021cacaf0e4533ad7e0f32f3d904b1a3d7972a0b47839fd003
+  data.tar.gz: f69421671f4cd8415fb5dfa19195c903991b3eeb8174dddfe7b6fa33bf4fddd2
 SHA512:
-  metadata.gz: 36207ae0ca54c2e132a651ebf656c0fef5d9e9a0954053a115c8f829ecebda97ccd295b7a11dacb53acd290cb621016b3f7d3c98b9f0ba47c6e7d41a34196b1c
-  data.tar.gz: e7f22290925ceec3db16011048991c5ef8c1a86e70673d9d1c720f2d41c246eb13802d637170e25f163beca8f32435a11e08297d67473647918943981a2306f3
+  metadata.gz: 7108853a7c073ab5b70d70932ce035d1b789502d86dcae3c797c294ec4ef6493b7684ad4eb4747824f75c040f02a1947027e6402f300f99243aed2c5c20faa7a
+  data.tar.gz: c2d490660288a54ef31c14dff0a8857c86dcc82c6e6cd49c203bfe6b4b66fcf5d029400ab442d8c1267b3cc4cff54dc431af189a17ae47f42a62779ad9acf13d

data/CHANGELOG.md

@@ -13,6 +13,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [14.0.0] - 2025-07-24
+
+### Added
+
+- Added Bibliothecary::ParserResult class, which wraps the parsed dependencies along with the project name, if it was found in the manifest. 
+
+### Changed
+
+- Breaking: parser methods now return Bibliothecary::ParserResult instead of an Array of Bibliothecary::Dependency
+- Return project_name for maven-dependency-tree.txt and maven-dependency-tree.dot results
+- Breaking: require the "platform" argument to be passed to Bibliothecary::Dependency, and update the parsers to do so.
+
+### Removed
+
+- Removed unused generic parser code.
+
+## [13.0.2] - 2025-07-21
+
+### Changed
+
+- Handle scoped dependencies in PNPM lockfiles.
+
 ## [13.0.1] - 2025-07-03
 
 ### Changed

data/lib/bibliothecary/analyser/analysis.rb

@@ -40,36 +40,15 @@ module Bibliothecary
         # If your Parser needs to return multiple responses for one file, please override this method
         # For example see conda.rb
         kind = determine_kind_from_info(info)
-        dependencies = parse_file(info.relative_path, info.contents, options: options)
+        parser_result = parse_file(info.relative_path, info.contents, options: options)
+        parser_result = ParserResult.new if parser_result.nil? # work around any legacy parsers that return nil
 
-        dependencies_to_analysis(info, kind, dependencies)
+        Bibliothecary::Analyser.create_analysis(platform_name, info.relative_path, kind, parser_result)
       rescue Bibliothecary::FileParsingError => e
         Bibliothecary::Analyser.create_error_analysis(platform_name, info.relative_path, kind, e.message, e.location)
       end
       alias analyze_contents_from_info analyse_contents_from_info
 
-      def dependencies_to_analysis(info, kind, dependencies)
-        dependencies ||= [] # work around any legacy parsers that return nil
-        if generic?
-          grouped = dependencies.group_by { |dep| dep[:platform] }
-          all_analyses = grouped.keys.map do |platform|
-            deplatformed_dependencies = grouped[platform].map do |d|
-              d.delete(:platform)
-              d
-            end
-            Bibliothecary::Analyser.create_analysis(platform, info.relative_path, kind, deplatformed_dependencies)
-          end
-          # this is to avoid a larger refactor for the time being. The larger refactor
-          # needs to make analyse_contents return multiple analysis, or add another
-          # method that can return multiple and deprecate analyse_contents, perhaps.
-          raise "File contains zero or multiple platforms, currently must have exactly one" if all_analyses.length != 1
-
-          all_analyses.first
-        else
-          Bibliothecary::Analyser.create_analysis(platform_name, info.relative_path, kind, dependencies)
-        end
-      end
-
       # Call the matching parse class method for this file with
       # these contents
       def parse_file(filename, contents, options: {})

data/lib/bibliothecary/analyser.rb

@@ -18,11 +18,12 @@ module Bibliothecary
       }
     end
 
-    def self.create_analysis(platform_name, relative_path, kind, dependencies)
+    def self.create_analysis(platform_name, relative_path, kind, parser_result)
       {
         platform: platform_name,
         path: relative_path,
-        dependencies: dependencies,
+        project_name: parser_result.project_name,
+        dependencies: parser_result.dependencies,
         kind: kind,
         success: true,
       }
@@ -50,17 +51,14 @@ module Bibliothecary
     end
 
     module ClassMethods
-      def generic?
-        platform_name == "generic"
-      end
-
       def platform_name
-        name.to_s.split("::").last.downcase
+        @platform_name ||= name.to_s.split("::").last.downcase.freeze
       end
 
       def map_dependencies(hash, key, type, source = nil)
         hash.fetch(key, []).map do |name, requirement|
           Dependency.new(
+            platform: platform_name,
             name: name,
             requirement: requirement,
             type: type,

data/lib/bibliothecary/dependency.rb

@@ -40,8 +40,8 @@ module Bibliothecary
     def initialize(
       name:,
       requirement:,
+      platform:,
       original_requirement: nil,
-      platform: nil,
       type: nil,
       direct: nil,
       deprecated: nil,

data/lib/bibliothecary/multi_parsers/bundler_like_manifest.rb

@@ -5,9 +5,10 @@ module Bibliothecary
     module BundlerLikeManifest
       # this takes parsed Bundler and Bundler-like (CocoaPods)
       # manifests and turns them into a list of dependencies.
-      def parse_ruby_manifest(manifest, source = nil)
+      def parse_ruby_manifest(manifest, platform, source = nil)
         manifest.dependencies.inject([]) do |deps, dep|
           deps.push(Dependency.new(
+                      platform: platform,
                       name: dep.name,
                       requirement: dep
                         .requirement

data/lib/bibliothecary/multi_parsers/cyclonedx.rb

@@ -38,6 +38,7 @@ module Bibliothecary
           @manifests[mapping] << Dependency.new(
             name: PurlUtil.full_name(purl),
             requirement: purl.version,
+            platform: mapping.to_s,
             type: "lockfile",
             source: source
           )
@@ -105,7 +106,7 @@ module Bibliothecary
           component["purl"]
         end
 
-        entries[platform_name.to_sym]
+        ParserResult.new(dependencies: entries[platform_name.to_sym])
       end
 
       def parse_cyclonedx_xml(file_contents, options: {})
@@ -130,7 +131,7 @@ module Bibliothecary
           component.locate("purl").first&.text
         end
 
-        entries[platform_name.to_sym]
+        ParserResult.new(dependencies: entries[platform_name.to_sym])
       end
     end
   end

data/lib/bibliothecary/multi_parsers/dependencies_csv.rb

@@ -139,7 +139,7 @@ module Bibliothecary
           raw_csv_file
         end
 
-        csv_file
+        dependencies = csv_file
           .result
           .find_all { |dependency| dependency[:platform] == platform_name.to_s }
           .map do |dep_kvs|
@@ -147,6 +147,8 @@ module Bibliothecary
               **dep_kvs, source: options.fetch(:filename, nil)
             )
           end
+
+        ParserResult.new(dependencies: dependencies)
       end
     end
   end

data/lib/bibliothecary/multi_parsers/json_runtime.rb

@@ -5,14 +5,17 @@ module Bibliothecary
     # Provide JSON Runtime Manifest parsing
     module JSONRuntime
       def parse_json_runtime_manifest(file_contents, options: {})
-        JSON.parse(file_contents).fetch("dependencies", []).map do |name, requirement|
+        dependencies = JSON.parse(file_contents).fetch("dependencies", []).map do |name, requirement|
           Dependency.new(
+            platform: platform_name,
             name: name,
             requirement: requirement,
             type: "runtime",
             source: options.fetch(:filename, nil)
           )
         end
+
+        ParserResult.new(dependencies: dependencies)
       end
     end
   end

data/lib/bibliothecary/multi_parsers/spdx.rb

@@ -137,6 +137,7 @@ module Bibliothecary
 
         entries[platform.to_sym] ||= []
         entries[platform.to_sym] << Dependency.new(
+          platform: platform.to_s,
           name: package_name,
           requirement: package_version,
           type: "lockfile",

data/lib/bibliothecary/parser_result.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Bibliothecary
+  # ParserResult bundles together a list of dependencies and the project name.
+  #
+  # @attr_reader [Array<Dependency>] dependencies The list of Dependency objects
+  # @attr_reader [String,nil] project_name The name of the project
+  class ParserResult
+    FIELDS = %i[
+      dependencies
+      project_name
+    ].freeze
+
+    attr_reader(*FIELDS)
+
+    def initialize(
+      dependencies:,
+      project_name: nil
+    )
+      @dependencies = dependencies
+      @project_name = project_name
+    end
+
+    def eql?(other)
+      FIELDS.all? { |f| public_send(f) == other.public_send(f) }
+    end
+    alias == eql?
+
+    def to_h
+      FIELDS.to_h { |f| [f, public_send(f)] }
+    end
+
+    def hash
+      FIELDS.map { |f| public_send(f) }.hash
+    end
+  end
+end

data/lib/bibliothecary/parsers/bower.rb

@@ -20,8 +20,9 @@ module Bibliothecary
 
       def self.parse_manifest(file_contents, options: {})
         json = JSON.parse(file_contents)
-        map_dependencies(json, "dependencies", "runtime", options.fetch(:filename, nil)) +
-          map_dependencies(json, "devDependencies", "development", options.fetch(:filename, nil))
+        dependencies = map_dependencies(json, "dependencies", "runtime", options.fetch(:filename, nil)) +
+                       map_dependencies(json, "devDependencies", "development", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
     end
   end

data/lib/bibliothecary/parsers/cargo.rb

@@ -37,27 +37,31 @@ module Bibliothecary
               name: name,
               requirement: requirement,
               type: index.zero? ? "runtime" : "development",
-              source: options.fetch(:filename, nil)
+              source: options.fetch(:filename, nil),
+              platform: platform_name
             )
           end
         end
 
-        parsed_dependencies.flatten.compact
+        dependencies = parsed_dependencies.flatten.compact
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_lockfile(file_contents, options: {})
         manifest = Tomlrb.parse(file_contents)
-        manifest.fetch("package", []).map do |dependency|
+        dependencies = manifest.fetch("package", []).map do |dependency|
           next if !dependency["source"] || !dependency["source"].start_with?("registry+")
 
           Dependency.new(
             name: dependency["name"],
             requirement: dependency["version"],
             type: "runtime",
-            source: options.fetch(:filename, nil)
+            source: options.fetch(:filename, nil),
+            platform: platform_name
           )
         end
           .compact
+        ParserResult.new(dependencies: dependencies)
       end
     end
   end

data/lib/bibliothecary/parsers/cocoapods.rb

@@ -39,38 +39,44 @@ module Bibliothecary
 
       def self.parse_podfile_lock(file_contents, options: {})
         manifest = YAML.load file_contents
-        manifest["PODS"].map do |row|
+        dependencies = manifest["PODS"].map do |row|
           pod = row.is_a?(String) ? row : row.keys.first
           match = pod.match(/(.+?)\s\((.+?)\)/i)
           Dependency.new(
+            platform: platform_name,
             name: match[1].split("/").first,
             requirement: match[2],
             type: "runtime",
             source: options.fetch(:filename, nil)
           )
         end.compact
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_podspec(file_contents, options: {})
         manifest = Gemnasium::Parser.send(:podspec, file_contents)
-        parse_ruby_manifest(manifest, options.fetch(:filename, nil))
+        dependencies = parse_ruby_manifest(manifest, platform_name, options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_podfile(file_contents, options: {})
         manifest = Gemnasium::Parser.send(:podfile, file_contents)
-        parse_ruby_manifest(manifest, options.fetch(:filename, nil))
+        dependencies = parse_ruby_manifest(manifest, platform_name, options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_json_manifest(file_contents, options: {})
         manifest = JSON.parse(file_contents)
-        manifest["dependencies"].inject([]) do |deps, dep|
+        dependencies = manifest["dependencies"].inject([]) do |deps, dep|
           deps.push(Dependency.new(
+                      platform: platform_name,
                       name: dep[0],
                       requirement: dep[1],
                       type: "runtime",
                       source: options.fetch(:filename, nil)
                     ))
         end.uniq
+        ParserResult.new(dependencies: dependencies)
       end
     end
   end

data/lib/bibliothecary/parsers/conda.rb

@@ -27,12 +27,18 @@ module Bibliothecary
       def self.parse_conda(file_contents, options: {})
         manifest = YAML.load(file_contents)
         deps = manifest["dependencies"]
-        deps.map do |dep|
+        dependencies = deps.map do |dep|
           next unless dep.is_a? String # only deal with strings to skip parsing pip stuff
 
           parsed = parse_name_requirement_from_matchspec(dep)
-          Dependency.new(**parsed, type: "runtime", source: options.fetch(:filename, nil))
+          Dependency.new(
+            **parsed,
+            type: "runtime",
+            source: options.fetch(:filename, nil),
+            platform: platform_name
+          )
         end.compact
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_name_requirement_from_matchspec(matchspec)

data/lib/bibliothecary/parsers/cpan.rb

@@ -25,14 +25,16 @@ module Bibliothecary
 
       def self.parse_json_manifest(file_contents, options: {})
         manifest = JSON.parse file_contents
-        manifest["prereqs"].map do |_group, deps|
+        dependencies = manifest["prereqs"].map do |_group, deps|
           map_dependencies(deps, "requires", "runtime", options.fetch(:filename, nil))
         end.flatten
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_yaml_manifest(file_contents, options: {})
         manifest = YAML.load file_contents
-        map_dependencies(manifest, "requires", "runtime", options.fetch(:filename, nil))
+        dependencies = map_dependencies(manifest, "requires", "runtime", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
     end
   end

data/lib/bibliothecary/parsers/cran.rb

@@ -24,10 +24,11 @@ module Bibliothecary
 
       def self.parse_description(file_contents, options: {})
         manifest = DebControl::ControlFileBase.parse(file_contents)
-        parse_section(manifest, "Depends", options.fetch(:filename, nil)) +
-          parse_section(manifest, "Imports", options.fetch(:filename, nil)) +
-          parse_section(manifest, "Suggests", options.fetch(:filename, nil)) +
-          parse_section(manifest, "Enhances", options.fetch(:filename, nil))
+        dependencies = parse_section(manifest, "Depends", options.fetch(:filename, nil)) +
+                       parse_section(manifest, "Imports", options.fetch(:filename, nil)) +
+                       parse_section(manifest, "Suggests", options.fetch(:filename, nil)) +
+                       parse_section(manifest, "Enhances", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_section(manifest, name, source = nil)
@@ -40,7 +41,8 @@ module Bibliothecary
             name: dep[1],
             requirement: dep[2],
             type: name.downcase,
-            source: source
+            source: source,
+            platform: platform_name
           )
         end
       end

data/lib/bibliothecary/parsers/dub.rb

@@ -25,7 +25,9 @@ module Bibliothecary
       add_multi_parser(Bibliothecary::MultiParsers::DependenciesCSV)
 
       def self.parse_sdl_manifest(file_contents, options: {})
-        SdlParser.new(:runtime, file_contents, options.fetch(:filename, nil)).dependencies
+        ParserResult.new(
+          dependencies: SdlParser.new(:runtime, file_contents, platform_name, options.fetch(:filename, nil)).dependencies
+        )
       end
     end
   end

data/lib/bibliothecary/parsers/elm.rb

@@ -25,14 +25,16 @@ module Bibliothecary
 
       def self.parse_json_lock(file_contents, options: {})
         manifest = JSON.parse file_contents
-        manifest.map do |name, requirement|
+        dependencies = manifest.map do |name, requirement|
           Dependency.new(
             name: name,
             requirement: requirement,
             type: "runtime",
-            source: options.fetch(:filename, nil)
+            source: options.fetch(:filename, nil),
+            platform: platform_name
           )
         end
+        ParserResult.new(dependencies: dependencies)
       end
     end
   end

data/lib/bibliothecary/parsers/go.rb

@@ -78,7 +78,8 @@ module Bibliothecary
 
       def self.parse_godep_json(file_contents, options: {})
         manifest = JSON.parse file_contents
-        map_dependencies(manifest, "Deps", "ImportPath", "Rev", "runtime", options.fetch(:filename, nil))
+        dependencies = map_dependencies(manifest, "Deps", "ImportPath", "Rev", "runtime", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_gpm(file_contents, options: {})
@@ -91,48 +92,55 @@ module Bibliothecary
             name: match[1].strip,
             requirement: match[2].strip,
             type: "runtime",
-            source: options.fetch(:filename, nil)
+            source: options.fetch(:filename, nil),
+            platform: platform_name
           )
         end
-        deps
+        ParserResult.new(dependencies: deps)
       end
 
       def self.parse_govendor(file_contents, options: {})
         manifest = JSON.parse file_contents
-        map_dependencies(manifest, "package", "path", "revision", "runtime", options.fetch(:filename, nil))
+        dependencies = map_dependencies(manifest, "package", "path", "revision", "runtime", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_glide_yaml(file_contents, options: {})
         manifest = YAML.load file_contents
-        map_dependencies(manifest, "import", "package", "version", "runtime", options.fetch(:filename, nil)) +
-          map_dependencies(manifest, "devImports", "package", "version", "development", options.fetch(:filename, nil))
+        dependencies = map_dependencies(manifest, "import", "package", "version", "runtime", options.fetch(:filename, nil)) +
+                       map_dependencies(manifest, "devImports", "package", "version", "development", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_glide_lockfile(file_contents, options: {})
         # glide.lock files contain an "updated" Time field, but Ruby 3.2+ requires us to safelist that class
         manifest = YAML.load file_contents, permitted_classes: [Time]
-        map_dependencies(manifest, "imports", "name", "version", "runtime", options.fetch(:filename, nil))
+        dependencies = map_dependencies(manifest, "imports", "name", "version", "runtime", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_gb_manifest(file_contents, options: {})
         manifest = JSON.parse file_contents
-        map_dependencies(manifest, "dependencies", "importpath", "revision", "runtime", options.fetch(:filename, nil))
+        dependencies = map_dependencies(manifest, "dependencies", "importpath", "revision", "runtime", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_dep_toml(file_contents, options: {})
         manifest = Tomlrb.parse file_contents
-        map_dependencies(manifest, "constraint", "name", "version", "runtime", options.fetch(:filename, nil))
+        dependencies = map_dependencies(manifest, "constraint", "name", "version", "runtime", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_dep_lockfile(file_contents, options: {})
         manifest = Tomlrb.parse file_contents
-        map_dependencies(manifest, "projects", "name", "revision", "runtime", options.fetch(:filename, nil))
+        dependencies = map_dependencies(manifest, "projects", "name", "revision", "runtime", options.fetch(:filename, nil))
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_go_mod(file_contents, options: {})
         categorized_deps = parse_go_mod_categorized_deps(file_contents, options.fetch(:filename, nil))
 
-        categorized_deps["require"]
+        dependencies = categorized_deps["require"]
           .map do |dep|
             # NOTE: A "replace" directive doesn't add the dep to the module graph unless the original dep is also in a "require" directive,
             # so we need to track down replacements here and use those instead of the originals, if present.
@@ -148,6 +156,7 @@ module Bibliothecary
 
             replaced_dep || dep
           end
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_go_mod_categorized_deps(file_contents, source)
@@ -186,14 +195,16 @@ module Bibliothecary
             name: match[1].strip,
             requirement: match[2].strip.split("/").first,
             type: "runtime",
-            source: options.fetch(:filename, nil)
+            source: options.fetch(:filename, nil),
+            platform: platform_name
           )
         end
-        deps.uniq
+        dependencies = deps.uniq
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_go_resolved(file_contents, options: {})
-        JSON.parse(file_contents)
+        dependencies = JSON.parse(file_contents)
           .reject { |dep| dep["Main"] == "true" }
           .map do |dep|
             if dep["Replace"].is_a?(String) && dep["Replace"] != "<nil>" && dep["Replace"] != ""
@@ -203,19 +214,21 @@ module Bibliothecary
               name, requirement = dep["Replace"].split(" ", 2)
               requirement = "*" if requirement.to_s.strip == ""
               Dependency.new(
-                name: name, requirement: requirement, original_name: dep["Path"], original_requirement: dep["Version"], type: dep.fetch("Scope", "runtime"), source: options.fetch(:filename, nil)
+                platform: platform_name, name: name, requirement: requirement, original_name: dep["Path"], original_requirement: dep["Version"], type: dep.fetch("Scope", "runtime"), source: options.fetch(:filename, nil)
               )
             else
               Dependency.new(
-                name: dep["Path"], requirement: dep["Version"], type: dep.fetch("Scope", "runtime"), source: options.fetch(:filename, nil)
+                platform: platform_name, name: dep["Path"], requirement: dep["Version"], type: dep.fetch("Scope", "runtime"), source: options.fetch(:filename, nil)
               )
             end
           end
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.map_dependencies(manifest, attr_name, dep_attr_name, version_attr_name, type, source = nil)
         manifest.fetch(attr_name, []).map do |dependency|
           Dependency.new(
+            platform: platform_name,
             name: dependency[dep_attr_name],
             requirement: dependency[version_attr_name],
             type: type,
@@ -231,6 +244,7 @@ module Bibliothecary
           replacement_dep = line.split(GOMOD_REPLACEMENT_SEPARATOR_REGEXP, 2).last
           replacement_match = replacement_dep.match(GOMOD_DEP_REGEXP)
           Dependency.new(
+            platform: platform_name,
             original_name: match[:name],
             original_requirement: match[:requirement],
             name: replacement_match[:name],
@@ -241,6 +255,7 @@ module Bibliothecary
           )
         when "retract"
           Dependency.new(
+            platform: platform_name,
             name: match[:name],
             requirement: match[:requirement],
             type: "runtime",
@@ -250,6 +265,7 @@ module Bibliothecary
           )
         else
           Dependency.new(
+            platform: platform_name,
             name: match[:name],
             requirement: match[:requirement],
             type: "runtime",

data/lib/bibliothecary/parsers/julia.rb

@@ -36,10 +36,11 @@ module Bibliothecary
             name: name,
             requirement: reqs,
             type: "runtime",
-            source: options.fetch(:filename, nil)
+            source: options.fetch(:filename, nil),
+            platform: platform_name
           )
         end
-        deps
+        ParserResult.new(dependencies: deps)
       end
     end
   end