bibliothecary 14.0.2 → 14.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bded2f923188e40707913d6539d5e876d2ff0334233985528a1b4caa3e686037
-  data.tar.gz: 49f76a339d1141d4b8f0940ad4dc66eb3533773e37d288825c71685f8f78ca3e
+  metadata.gz: 548767337e8898f61951f3e458310fd5299d88c81549a3332750c62427b93a28
+  data.tar.gz: 660e80fcdce7b4fc1ed9d498b4a8e39856498e709b16fbd0f3ffcdc5671a8942
 SHA512:
-  metadata.gz: 3f9e93bbf8341d3a27b22a2661a79225ae64721f3ea63348364d215ca4b73e19bbce6b3a8409cb590851f332fc9c404b1dd18bd0c621418cd139f216e9ed509c
-  data.tar.gz: 8483dc5f0ff491a9259f909e1cc8734a2c159c408733736e50d11c71b07810e0632e00d75bc8f05b5ab342389bfa0f271b430a6ea2ab74e80b3e3fdb9f05a26c
+  metadata.gz: 67d3cf0c77840be64458f50dac795a8a782e192db0138e316e21ef65fb9dd625a32fde8e5ef92fa4e47ce66bb666d5fd97d751930ad6eea4bd7a404836c03698
+  data.tar.gz: 4490815f18aac91bfa307349272699c16500f3452d88b0681ce2c927e4b7f6acc55e41afbb33299cfaa5d4330306c34b30598a42b092a732097b617de1f378a9

data/.circleci/config.yml

@@ -1,6 +1,6 @@
 version: 2.1
 orbs:
-  ruby: circleci/ruby@2.1.3
+  ruby: circleci/ruby@2.5.4
 
 executors:
   bibliothecary:

data/CHANGELOG.md

@@ -13,6 +13,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [14.2.0]
+
+### Added
+
+### Changed
+
+- Dependencies from yarn.lock will return a nil "type" instead of assuming "runtime".
+- In Nuget .csproj files, ignored <Reference> tags that don't have a version.
+
+### Removed
+
+## [14.1.0] - 2025-10-01
+
+### Added
+
+### Changed
+
+- Dependencies from pom.xml without a scope will now return a "type" of nil instead of guessing "runtime".
+
+### Removed
+
 ## [14.0.2] - 2025-07-29
 
 ### Added

data/lib/bibliothecary/dependency.rb

@@ -9,7 +9,8 @@ module Bibliothecary
   #   it's implicit in most parser results, and the analyzer returns the platform name itself. One
   #   exception are multi-parsers like DependenciesCSV, because they may return deps from multiple platforms.
   #   Bibliothecary could start returning this field for *all* deps in future, and make it required. (default: nil)
-  # @attr_reader [String] type The type of dependency, e.g. "runtime" or "test"
+  # @attr_reader [String] type The type or scope of dependency, e.g. "runtime" or "test". In some ecosystems a
+  #   default may be set and in other ecosystems it may make sense to return nil when not found.
   # @attr_reader [Boolean] direct Is this dependency a direct dependency (vs transitive dependency)? (default: nil)
   # @attr_reader [Boolean] deprecated Is this dependency deprecated? (default: nil)
   # @attr_reader [Boolean] local Is this dependency local? (default: nil)

data/lib/bibliothecary/parsers/cran.rb

@@ -7,7 +7,7 @@ module Bibliothecary
     class CRAN
       include Bibliothecary::Analyser
 
-      REQUIRE_REGEXP = /([a-zA-Z0-9\-_\.]+)\s?\(?([><=\s\d\.,]+)?\)?/
+      REQUIRE_REGEXP = /([a-zA-Z0-9\-_.]+)\s?\(?([><=\s\d.,]+)?\)?/
 
       def self.mapping
         {

data/lib/bibliothecary/parsers/maven.rb

@@ -12,8 +12,8 @@ module Bibliothecary
       include Bibliothecary::Analyser
 
       # Matches digraph contents from the Maven dependency tree .dot file format.
-      MAVEN_DOT_PROJECT_REGEXP = /digraph\s+"([^\"]+)"\s+{/
-      MAVEN_DOT_RELATIONSHIP_REGEXP = /"([^\"]+)"\s+->\s+"([^\"]+)"/
+      MAVEN_DOT_PROJECT_REGEXP = /digraph\s+"([^"]+)"\s+{/
+      MAVEN_DOT_RELATIONSHIP_REGEXP = /"([^"]+)"\s+->\s+"([^"]+)"/
 
       # e.g. "annotationProcessor - Annotation processors and their dependencies for source set 'main'."
       GRADLE_TYPE_REGEXP = /^(\w+)/
@@ -286,7 +286,7 @@ module Bibliothecary
           .encode(universal_newline: true)
           # capture two groups; one is the ASCII art telling us the tree depth,
           # and two is the actual dependency
-          .scan(/^\[INFO\]\s((?:[-+|\\]|\s)*)((?:[\w\.-]+:)+[\w\.\-${}]+)/)
+          .scan(/^\[INFO\]\s((?:[-+|\\]|\s)*)((?:[\w.-]+:)+[\w.\-${}]+)/)
           # lines that start with "-" aren't part of the tree, example: "[INFO] --- dependency:3.8.1:tree"
           .reject { |(tree_ascii_art, _dep_info)| tree_ascii_art.start_with?("-") }
           .map do |(tree_ascii_art, dep_info)|
@@ -491,7 +491,6 @@ module Bibliothecary
             dep_hash[:type] ||= dependency_management[:scope]
           end
 
-          dep_hash[:type] ||= "runtime"
           dep_hash[:source] = source
         end
 

data/lib/bibliothecary/parsers/npm.rb

@@ -187,7 +187,7 @@ module Bibliothecary
             original_name: dep[:original_name],
             requirement: dep[:version],
             original_requirement: dep[:original_requirement],
-            type: "runtime", # lockfile doesn't tell us more about the type of dep
+            type: nil, # yarn.lock doesn't report on the type of dependency
             local: dep[:requirements]&.first&.start_with?("file:"),
             source: options.fetch(:filename, nil),
             platform: platform_name

data/lib/bibliothecary/parsers/nuget.rb

@@ -153,6 +153,17 @@ module Bibliothecary
           .select { |dep| dep.respond_to? "Include" }
           .map do |dependency|
             vals = *dependency.Include.split(",").map(&:strip)
+
+            # Skip <Reference> dependencies that only have the name value. Reasoning:
+            # Builtin assemblies like "System.Web" or "Microsoft.CSharp" can be required from the framework or by
+            # downloading via Nuget, and we only want to report on packages that are downloaded from Nuget. We are
+            # pretty sure that if they don't have a version in <Reference> then they're likely from the framework
+            # itself, which means they won't show up in the lockfile and we want to omit them.
+            # Note: if we omit a false positive here it should still show up in the lockfile, and it should be
+            # safer guess like this since <Reference> is an older standard.
+            # Note: this strategy could also skip on-disk 3rd-party packages with a <HintPath> but no version in <Reference>
+            next nil if vals.size == 1
+
             name = vals.shift
             vals = vals.to_h { |r| r.split("=", 2) }
 
@@ -164,6 +175,7 @@ module Bibliothecary
               platform: platform_name
             )
           end
+          .compact
 
         dependencies = packages.uniq(&:name)
         ParserResult.new(dependencies: dependencies)
@@ -189,7 +201,7 @@ module Bibliothecary
 
       def self.parse_paket_lock(file_contents, options: {})
         lines = file_contents.split("\n")
-        package_version_re = /\s+(?<name>\S+)\s\((?<version>\d+\.\d+[\.\d+[\.\d+]*]*)\)/
+        package_version_re = /\s+(?<name>\S+)\s\((?<version>\d+\.\d+[.\d+[.\d+]*]*)\)/
         packages = lines.select { |line| package_version_re.match(line) }.map { |line| package_version_re.match(line) }.map do |match|
           Dependency.new(
             name: match[:name].strip,

data/lib/bibliothecary/parsers/pypi.rb

@@ -10,7 +10,7 @@ module Bibliothecary
       # Capture Group 1 is package.
       # Optional Group 2 is [extras].
       # Capture Group 3 is Version
-      REQUIRE_REGEXP = /([a-zA-Z0-9]+[a-zA-Z0-9\-_\.]+)(?:\[.*?\])*([><=\w\.,]+)?/
+      REQUIRE_REGEXP = /([a-zA-Z0-9]+[a-zA-Z0-9\-_.]+)(?:\[.*?\])*([><=\w.,]+)?/
       REQUIREMENTS_REGEXP = /^#{REQUIRE_REGEXP}/
 
       MANIFEST_REGEXP = /.*require[^\/]*\.(txt|pip|in)$/
@@ -332,7 +332,7 @@ module Bibliothecary
         uri = URI.parse(url)
         raise NoEggSpecified, "No egg specified in #{url}" unless uri.fragment
 
-        name = uri.fragment[/^egg=([^&]+)([&]|$)/, 1]
+        name = uri.fragment[/^egg=([^&]+)(&|$)/, 1]
         raise NoEggSpecified, "No egg specified in #{url}" unless name
 
         requirement = uri.path[/@(.+)$/, 1]

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "14.0.2"
+  VERSION = "14.2.0"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 14.0.2
+  version: 14.2.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 bindir: bin
 cert_chain: []
-date: 2025-07-29 00:00:00.000000000 Z
+date: 2025-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander