bibliothecary 15.0.0 → 15.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f0d3fafafd92ac4eac18f89f709733c655b0f05a803f9fcb2c1ef8b26690c584
-  data.tar.gz: b89c725a5bbbcc8139a8ebac579f610a84839e3eaaf356dd04fe4d371294ad03
+  metadata.gz: 2c1e74940c87a46f8d7faee1b0cfc0abb6352d021c895c3be3ea06d6f491cdc5
+  data.tar.gz: abe103cdfcac6b56544fa983fe24e16f67441753a0cd1d8b348b864cc4d3f355
 SHA512:
-  metadata.gz: 9b8caae9ff6a85ee12a1860f048e69c2910e7f48128a6621fc1c2d14ca587a79ca9478a14b5f092005edb02cc6ff00ee2819d6788a6a7f8fa95d5f10f1addf67
-  data.tar.gz: 408d3891213550d27395f65587010ee0c4a49da47fb290e3805971dbe7f41b7fe2add33c3d3c4dbe646e084b6536e4a33c15928e8560d32ffaa8fde45332b14b
+  metadata.gz: 03baf459e89fd2761c74b8b1cce7d59f007c00699c95472bbaf91a1baeb9de358f649c13c87f7d00a6febc66481d33d9f876e78ac122087f9781441d79f5d6c3
+  data.tar.gz: 2688993b02d2f4f673b2a7c82050ae34e61f03f143494cf16030b74909ed92ab5eb91393c1609f8a6cc1d45bdda8dc12b73d1272c3b92173439d1b5e1dbd2fa7

data/CHANGELOG.md

@@ -13,6 +13,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [15.1.0]
+
+### Added
+
+- Add initial support for SPDX 3.0 JSON files
+
+### Changed
+
+- Treat "cyclonedx.json" and "cyclonedx.xml" matchers as suffixes instead of filenames.
+- Fix Nuget parser so it returns all target frameworks' dependencies from packages.lock.json instead of an arbitrary target framework's dependencies.
+
 ## [15.0.0]
 
 15.0.0 includes some breaking changes, so please see UPGRADING_TO_15_0_0.md to migrate your code.

data/lib/bibliothecary/multi_parsers/cyclonedx.rb

@@ -63,7 +63,7 @@ module Bibliothecary
 
       def self.mapping
         {
-          match_filename("cyclonedx.json") => {
+          match_extension("cyclonedx.json") => {
             kind: "lockfile",
             parser: :parse_cyclonedx_json,
             ungroupable: true,
@@ -73,7 +73,7 @@ module Bibliothecary
             parser: :parse_cyclonedx_json,
             ungroupable: true,
           },
-          match_filename("cyclonedx.xml") => {
+          match_extension("cyclonedx.xml") => {
             kind: "lockfile",
             parser: :parse_cyclonedx_xml,
             ungroupable: true,

data/lib/bibliothecary/multi_parsers/spdx.rb

@@ -120,9 +120,19 @@ module Bibliothecary
       end
 
       def self.parse_spdx_json_file_contents(file_contents, source = nil)
-        entries = Set.new
         manifest = JSON.parse(file_contents)
 
+        if manifest.key?("spdxVersion")
+          parse_spdx_2_json_file_contents(manifest, source)
+        elsif manifest.key?("@context")
+          parse_spdx_3_json_file_contents(manifest, source)
+        else
+          Set.new
+        end
+      end
+
+      def self.parse_spdx_2_json_file_contents(manifest, source)
+        entries = Set.new
         manifest["packages"]&.each do |package|
           spdx_name = package["name"]
           spdx_version = package["versionInfo"]
@@ -139,6 +149,47 @@ module Bibliothecary
                     spdx_name: spdx_name, purl_version: purl_version, spdx_version: spdx_version,
                     source: source, purl_type: purl_type)
         end
+        entries
+      end
+
+      def self.parse_spdx_3_json_file_contents(manifest, source)
+        entries = Set.new
+        manifest.fetch("@graph", [])
+          .select do |element|
+            types = Array(element["type"] || element["@type"])
+            # "software_Package" is the common one, but these may differ and include namespaces
+            types.any? { |t| t.to_s.match?(/Package$/i) }
+          end
+          .each do |element|
+            spdx_name = element["name"]
+            spdx_version = element["software_packageVersion"] || element["packageVersion"] || element["versionInfo"]
+
+            purl_string = element["externalIdentifier"]&.find do |ext_id|
+              ext_id_type = ext_id["externalIdentifierType"] || ext_id["identifierType"]
+              ext_id_type&.match?(/purl/i)
+            end&.dig("identifier")
+
+            purl_string ||= element.fetch("externalRef", [])
+              .map { |ref| ref.fetch("locator", nil) }
+              .compact
+              .map(&:first)
+              .find { |locator| locator.start_with?("pkg:") }
+
+            purl_string ||= element.fetch("software_packageUrl", nil)
+
+            next unless purl_string
+
+            purl = PackageURL.parse(purl_string)
+            purl_type = purl&.type
+            # Use the mapped purl->bibliothecary platform, or else fall back to original platform itself.
+            platform = PurlUtil::PURL_TYPE_MAPPING.fetch(purl_type, purl_type)
+            purl_name = PurlUtil.full_name(purl)
+            purl_version = purl&.version
+
+            add_entry(entries: entries, platform: platform, purl_name: purl_name,
+                      spdx_name: spdx_name, purl_version: purl_version, spdx_version: spdx_version,
+                      source: source, purl_type: purl_type)
+          end
 
         entries
       end

data/lib/bibliothecary/parsers/nuget.rb

@@ -64,32 +64,32 @@ module Bibliothecary
       def self.parse_packages_lock_json(file_contents, options: {})
         manifest = JSON.parse file_contents
 
-        frameworks = {}
-        manifest.fetch("dependencies", []).each do |framework, deps|
-          frameworks[framework] = deps
-            .reject { |_name, details| details["type"] == "Project" } # Projects do not have versions
-            .map do |name, details|
-              Dependency.new(
-                name: name,
-                # 'resolved' has been set in all examples so far
-                # so fallback to requested is pure paranoia
-                requirement: details.fetch("resolved", details.fetch("requested", "*")),
-                type: "runtime",
-                source: options.fetch(:filename, nil),
-                platform: platform_name
-              )
-            end
-        end
-
-        unless frameworks.empty?
-          # we should really return multiple manifests, but bibliothecary doesn't
-          # do that yet so at least pick deterministically.
+        # NOTE: here we are merging dependencies from potentially >1 target framework. The versions
+        # across target frameworks in package.lock.json are not guaranteed to be the same, so e.g. a
+        # single packages.lock.json may include both "Newtonsoft.Json@13.01" and "Newtonsoft.Json@12.0.3". This
+        # should be more comprehensive than just returning one arbitrary framework's deps, but we're losing the
+        # fidelity of which target framework a given dependency was used in. Someday, bibliothecary could
+        # include a new Dependency field like "architecture" or "framework" and add the metadata for each dep there.
+        dependencies = manifest
+          .fetch("dependencies", [])
+          .flat_map do |_framework, framework_dependencies|
+            framework_dependencies
+              .reject { |_name, details| details["type"] == "Project" } # Projects do not have versions
+              .map do |name, details|
+                Dependency.new(
+                  name: name,
+                  # 'resolved' has been set in all examples so far
+                  # so fallback to requested is pure paranoia
+                  requirement: details.fetch("resolved", details.fetch("requested", "*")),
+                  type: "runtime",
+                  source: options.fetch(:filename, nil),
+                  platform: platform_name
+                )
+              end
+          end
+          .uniq
 
-          # Note, frameworks can be empty, so remove empty ones and then return the last sorted item if any
-          frameworks.delete_if { |_k, v| v.empty? }
-          return ParserResult.new(dependencies: frameworks[frameworks.keys.max]) unless frameworks.empty?
-        end
-        ParserResult.new(dependencies: [])
+        ParserResult.new(dependencies: dependencies)
       end
 
       def self.parse_packages_config(file_contents, options: {})

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "15.0.0"
+  VERSION = "15.1.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 15.0.0
+  version: 15.1.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-12-03 00:00:00.000000000 Z
+date: 2025-12-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander