bibliothecary 8.1.0 → 8.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ed029f460ea32073ccc2d06f6fb297926686064554b1447a7014ff8588382f1
-  data.tar.gz: 70482eb3f0cfe7afb13124904b1e713596d92e92d90cd6267153ff4319e9d356
+  metadata.gz: 9768b5d4829b90bc0bda13059ae884a0f6339621b85b7fcfa8bfa472439200e5
+  data.tar.gz: 3a34cc4b9f483502a6a0dbe0750ebe379379e2fbfde7acfb8c5d00d29d904ccc
 SHA512:
-  metadata.gz: b8a243cb926cf8e49835f11db86199f8fe8d45dc53b1f80a17c9b3c941bb5935e4c8b8c1a897b40704d8c6c3ddc271fd5d3139aa9373a8328eea3a538c383fac
-  data.tar.gz: d6dd8f873e0ce3cabf3f526e4e50393c36c1e3c6aacb7b1581bc7720bc022670ecd0cc96114df8d3dcc561341e3ee920d401a578eaf7fe5b066f64a33306d730
+  metadata.gz: 4eed23508e442acb7957a4e3022a0ba42eb7ce199572a04d7ab9e3c77055d259e57ade2c294ad79b21ed2e55225ac6b6bb3dc58e55db33be74100643b226b689
+  data.tar.gz: b94e436900019c1f5f8adeca6da6ada27131e275fdfd005d3c0d2d6a003ec89292a5631a11cc40391abcba7ee53ceb88506246faca297c1b49d0a55bb8fc9973

data/lib/bibliothecary/multi_parsers/cyclonedx.rb

@@ -45,7 +45,7 @@ module Bibliothecary
           # Instead of recursing, we'll work through a queue of components
           # to process, letting the different parser add components to the
           # queue however they need to  pull them from the source document.
-          @parse_queue = parse_queue
+          @parse_queue = parse_queue.dup
         end
 
         def <<(purl)

data/lib/bibliothecary/parsers/maven.rb

@@ -12,6 +12,18 @@ module Bibliothecary
       # "|    \\--- com.google.guava:guava:23.5-jre (*)"
       GRADLE_DEP_REGEX = /(\+---|\\---){1}/
 
+      # Builtin methods: https://docs.gradle.org/current/userguide/java_plugin.html#tab:configurations
+      GRADLE_KTS_DEPENDENCY_METHODS = %w(api compile compileOnlyApi implementation runtimeOnly testCompileOnly testImplementation testRuntimeOnly)
+      
+      # An intentionally overly-simplified regex to scrape deps from build.gradle.kts files. 
+      # To be truly useful bibliothecary would need a full Kotlin parser that speaks Gradle, 
+      # because the Kotlin DSL has many dynamic ways of declaring dependencies.
+      
+      GRADLE_KTS_VERSION_REGEX = /[\w.-]+/ # e.g. '1.2.3'
+      GRADLE_KTS_INTERPOLATED_VERSION_REGEX = /\$\{.*\}/ # e.g. '${my-project-settings["version"]}'
+      GRADLE_KTS_GAV_REGEX = /([\w.-]+)\:([\w.-]+)(?:\:(#{GRADLE_KTS_VERSION_REGEX}|#{GRADLE_KTS_INTERPOLATED_VERSION_REGEX}))?/
+      GRADLE_KTS_SIMPLE_REGEX = /(#{GRADLE_KTS_DEPENDENCY_METHODS.join('|')})\s*\(\s*"#{GRADLE_KTS_GAV_REGEX}"\s*\)\s*$/m # e.g. "group:artifactId:1.2.3"
+
       MAVEN_PROPERTY_REGEX = /\$\{(.+?)\}/
       MAX_DEPTH = 5
 
@@ -236,8 +248,16 @@ module Bibliothecary
       end
 
       def self.parse_gradle_kts(file_contents, options: {})
-        # TODO: the gradle-parser side needs to be implemented for this, coming soon.
-        []
+        file_contents
+          .scan(GRADLE_KTS_SIMPLE_REGEX)                                                  # match 'implementation("group:artifactId:version")'
+          .reject { |(_type, group, artifactId, _version)| group.nil? || artifactId.nil? } # remove any matches with missing group/artifactId
+          .map { |(type, group, artifactId, version)|
+            {
+              name: [group, artifactId].join(":"),
+              requirement: version || "*",
+              type: type
+            }
+          }
       end
 
       def self.gradle_dependency_name(group, name)

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.1.0"
+  VERSION = "8.2.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.1.0
+  version: 8.2.1
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-28 00:00:00.000000000 Z
+date: 2022-05-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb