bibliothecary 14.1.0 → 14.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8220f939e62ba68f9f9edebda8c1d5901d88f028c9caea6b173c2f9da14cb5b4
-  data.tar.gz: 2920b4cf85f4497bf1a2749e8c6c6b2cdfa5c0c0a9f3cb244bc86c7991041974
+  metadata.gz: 548767337e8898f61951f3e458310fd5299d88c81549a3332750c62427b93a28
+  data.tar.gz: 660e80fcdce7b4fc1ed9d498b4a8e39856498e709b16fbd0f3ffcdc5671a8942
 SHA512:
-  metadata.gz: 768d17a2954b4ccb4cad09da85074ef4958193fc10aea00cf33cbc8f7a309dc4d2b287a9d71e6b509b1861ddad06b0ad0508818fcd093147214cd836edd5cdf2
-  data.tar.gz: 4d345a0068501420508694bd5491de0584517e60021ff16e216486bc8329a1c5c7655c40df33a631e280c9977f8721d4b9a572f84f60fd6cf9e449134762b768
+  metadata.gz: 67d3cf0c77840be64458f50dac795a8a782e192db0138e316e21ef65fb9dd625a32fde8e5ef92fa4e47ce66bb666d5fd97d751930ad6eea4bd7a404836c03698
+  data.tar.gz: 4490815f18aac91bfa307349272699c16500f3452d88b0681ce2c927e4b7f6acc55e41afbb33299cfaa5d4330306c34b30598a42b092a732097b617de1f378a9

data/CHANGELOG.md

@@ -13,13 +13,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [14.2.0]
+
+### Added
+
+### Changed
+
+- Dependencies from yarn.lock will return a nil "type" instead of assuming "runtime".
+- In Nuget .csproj files, ignored <Reference> tags that don't have a version.
+
+### Removed
+
 ## [14.1.0] - 2025-10-01
 
 ### Added
 
 ### Changed
 
-- Dependencies from pom.xml without a scope will not return a "type" of nil instead of guessing "runtime".
+- Dependencies from pom.xml without a scope will now return a "type" of nil instead of guessing "runtime".
 
 ### Removed
 

data/lib/bibliothecary/parsers/npm.rb

@@ -187,7 +187,7 @@ module Bibliothecary
             original_name: dep[:original_name],
             requirement: dep[:version],
             original_requirement: dep[:original_requirement],
-            type: "runtime", # lockfile doesn't tell us more about the type of dep
+            type: nil, # yarn.lock doesn't report on the type of dependency
             local: dep[:requirements]&.first&.start_with?("file:"),
             source: options.fetch(:filename, nil),
             platform: platform_name

data/lib/bibliothecary/parsers/nuget.rb

@@ -153,6 +153,17 @@ module Bibliothecary
           .select { |dep| dep.respond_to? "Include" }
           .map do |dependency|
             vals = *dependency.Include.split(",").map(&:strip)
+
+            # Skip <Reference> dependencies that only have the name value. Reasoning:
+            # Builtin assemblies like "System.Web" or "Microsoft.CSharp" can be required from the framework or by
+            # downloading via Nuget, and we only want to report on packages that are downloaded from Nuget. We are
+            # pretty sure that if they don't have a version in <Reference> then they're likely from the framework
+            # itself, which means they won't show up in the lockfile and we want to omit them.
+            # Note: if we omit a false positive here it should still show up in the lockfile, and it should be
+            # safer guess like this since <Reference> is an older standard.
+            # Note: this strategy could also skip on-disk 3rd-party packages with a <HintPath> but no version in <Reference>
+            next nil if vals.size == 1
+
             name = vals.shift
             vals = vals.to_h { |r| r.split("=", 2) }
 
@@ -164,6 +175,7 @@ module Bibliothecary
               platform: platform_name
             )
           end
+          .compact
 
         dependencies = packages.uniq(&:name)
         ParserResult.new(dependencies: dependencies)

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "14.1.0"
+  VERSION = "14.2.0"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 14.1.0
+  version: 14.2.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 bindir: bin
 cert_chain: []
-date: 2025-10-01 00:00:00.000000000 Z
+date: 2025-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander