bibliothecary 7.2.0 → 7.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac170521ce85ef87c25442284632da0d641709136108e15f2b5b4e3050f9f56e
-  data.tar.gz: b97db15b605b8f39687c10b70dd46023ce2ebfb8a1d7b9076a5151b81f871c8b
+  metadata.gz: 5dece4dd0ba501561d36353606c81211a31727e01168effc7bbfdf0dc9ceec19
+  data.tar.gz: 4aa63636cf6e4697e9c35c2965f7cfe16bbe82f408d28f37c10fed678a1e893f
 SHA512:
-  metadata.gz: ac11fca807e0d45f9dff9984d180577853f238446112e9c65f8e298c26d26f100ad5b0071eba00d02bebbd7b84976aac497ec3cbf6c860839524730ef2945569
-  data.tar.gz: ac4fb797dc8a121e93b85a05dc087cd2ed01114da5fbec082b704c3ae9201e5727434bd731338175d46fc1ea56fbfb5b8935e0c2fd9aa829c5c9e686855520da
+  metadata.gz: 0e3aa9619424e7ddc658a61779463d92a21ce7c80b364c61da52c4e05ae82f00aa3e792385f3552dbf5be0a240a4ae5cdee1b413b6b5412ffc2c038cd69a82c9
+  data.tar.gz: df88033afb288b0dcff8babb62eccda691aebc74aa1f19f209c6407c6cdddab4caf39420b23d012c51540988f7f7ffc9a81aa562724cf0dfe5eb6465e3801524

data/README.md

@@ -53,8 +53,6 @@ All available config options are in: https://github.com/librariesio/bibliothecar
 
 ## Supported package manager file formats
 
-- Hackage
-  - \*.cabal
 - npm
   - package.json
   - package-lock.json
@@ -151,7 +149,7 @@ All available config options are in: https://github.com/librariesio/bibliothecar
 - Haxelib
   - haxelib.json
 - Hackage
-  - *.cabal
+  - \*.cabal
   - cabal.config
 
 ## Development

data/lib/bibliothecary/parsers/maven.rb

@@ -127,10 +127,12 @@ module Bibliothecary
 
           split = gradle_dep_match.captures[0]
 
-          # org.springframework.boot:spring-boot-starter-web:2.1.0.M3 (*)
-          # Lines can end with (c), (n), or (*)
-          # to indicate that something was a dependency constraint (c), not resolved (n), or resolved previously (*).
-          dep = line.split(split)[1].sub(/(\((c|n|\*)\))$/, "").sub(" -> ", ":").strip.split(":")
+
+          dep = line
+            .split(split)[1].sub(/(\((c|n|\*)\))$/, "") # line ending legend: (c) means a dependency constraint, (n) means not resolved, or (*) means resolved previously, e.g. org.springframework.boot:spring-boot-starter-web:2.1.0.M3 (*)
+            .sub(/ FAILED$/, "") # dependency could not be resolved (but still may have a version)
+            .sub(" -> ", ":") # handle version arrow syntax
+            .strip.split(":")
 
           # A testImplementation line can look like this so just skip those
           # \--- org.springframework.security:spring-security-test (n)

data/lib/bibliothecary/parsers/npm.rb

@@ -5,6 +5,9 @@ module Bibliothecary
     class NPM
       include Bibliothecary::Analyser
 
+      # Max depth to recurse into the "dependencies" property of package-lock.json
+      PACKAGE_LOCK_JSON_MAX_DEPTH = 10
+
       def self.mapping
         {
           match_filename("package.json") => {
@@ -43,26 +46,25 @@ module Bibliothecary
 
       def self.parse_package_lock(file_contents)
         manifest = JSON.parse(file_contents)
-        manifest.fetch('dependencies',[]).map do |name, requirement|
-          if requirement.fetch("dev", false)
-            type = 'development'
-          else
-            type = 'runtime'
-          end
-
-          version = nil
-
-          if requirement.key?("from")
-            version = requirement["from"][/#(?:semver:)?v?(.*)/, 1]
-          end
+        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+      end
 
+      def self.parse_package_lock_deps_recursively(dependencies, depth=1)
+        dependencies.flat_map do |name, requirement|
+          type = requirement.fetch("dev", false) ? 'development' : 'runtime'
+          version = requirement.key?("from") ? requirement["from"][/#(?:semver:)?v?(.*)/, 1] : nil
           version ||= requirement["version"].split("#").last
+          child_dependencies = if depth >= PACKAGE_LOCK_JSON_MAX_DEPTH
+            []
+          else
+            parse_package_lock_deps_recursively(requirement.fetch('dependencies', []), depth + 1)
+          end
 
-          {
+          [{
             name: name,
             requirement: version,
             type: type
-          }
+          }] + child_dependencies
         end
       end
 
@@ -95,6 +97,18 @@ module Bibliothecary
         transform_tree_to_array(manifest.fetch('dependencies', {}))
       end
 
+      def self.lockfile_preference_order(file_infos)
+        files = file_infos.each_with_object({}) do |file_info, obj|
+          obj[File.basename(file_info.full_path)] = file_info
+        end
+
+        if files["npm-shrinkwrap.json"]
+          [files["npm-shrinkwrap.json"]] + files.values.reject { |fi| File.basename(fi.full_path) == "npm-shrinkwrap.json" }
+        else
+          files.values
+        end
+      end
+
       private_class_method def self.transform_tree_to_array(deps_by_name)
         deps_by_name.map do |name, metadata|
           [

data/lib/bibliothecary/parsers/pypi.rb

@@ -26,6 +26,10 @@ module Bibliothecary
             parser: :parse_requirements_txt,
             can_have_lockfile: false
           },
+          match_filename('requirements.frozen') => { # pattern exists to store frozen deps in requirements.frozen
+            parser: :parse_requirements_txt,
+            kind: 'lockfile',
+          },
           match_filename('pip-resolved-dependencies.txt') => { # Inferred from pip
             kind: 'lockfile',
             parser: :parse_requirements_txt,

data/lib/bibliothecary/related_files_info.rb

@@ -19,6 +19,9 @@ module Bibliothecary
 
     def initialize(file_infos)
       package_manager = file_infos.first.package_manager
+      if package_manager.respond_to?(:lockfile_preference_order)
+        file_infos = package_manager.lockfile_preference_order(file_infos)
+      end
       @platform = package_manager.platform_name
       @path = Pathname.new(File.dirname(file_infos.first.relative_path)).cleanpath.to_path
       # `package_manager.determine_kind_from_info(info)` can be an Array, so use include? which also works for string

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "7.2.0"
+  VERSION = "7.3.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 7.2.0
+  version: 7.3.2
 platform: ruby
 authors:
 - Andrew Nesbitt
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-10-04 00:00:00.000000000 Z
+date: 2021-11-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb
@@ -206,7 +206,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description:
+description: 
 email:
 - andrewnez@gmail.com
 executables:
@@ -274,7 +274,7 @@ homepage: https://github.com/librariesio/bibliothecary
 licenses:
 - AGPL-3.0
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -290,7 +290,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.2
-signing_key:
+signing_key: 
 specification_version: 4
 summary: Find and parse manifests
 test_files: []