bibliothecary 8.4.5 → 8.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f96049ef42a355a057a20317490f01d21221f7404f2902ba6a79553bf747bfaf
-  data.tar.gz: ae2d328f4518584aba8c7b7f4da20f6e57dbf1bd0537114c2415eaf87c99f3f9
+  metadata.gz: ac52b349e3c70feee32a4866adc7d81a850467dcc167cd0227c20dadafcb78a9
+  data.tar.gz: 7127e1e85bf737dacbfaf84d91fd3c8e0ea527d7337e0381d1ca36a8677289c3
 SHA512:
-  metadata.gz: f2f081d723f5bce1294f82de0300af497ea1b94ffa932567f5d74cd3b382578f576f4272648d2144c68aea7ca9eae49d835fd1e884786a820bef9659c54f5baf
-  data.tar.gz: 58d93cbf354ed74b1d1c0e93ab3a4f6f8231ac8ce72060856147ce5eff5f6e830b2a01bdc0964be0d1c04f1d8b93acdc08ece1657dc1d4deb6f7cb8711870a8e
+  metadata.gz: 476ced972f0f89192fb42fa2d9a12bc279ef8635211040e3e9c73cd0ab242e997193fae9f21c4a305956f5f8b188b12cf3a67fd054200a589202e6337755d990
+  data.tar.gz: 8167b963298ad218bbbc0b7666f3e8a0622781321a64c2558c816946ddfd69c284cf4842bb8c99681c5ea84edf1d665ce8a2291753f16a6447ab388a5982f7ce

data/lib/bibliothecary/file_info.rb

@@ -17,8 +17,7 @@ module Bibliothecary
             # file that's actually on the filesystem
             nil
           else
-            # Remove any Byte Order Marks so JSON, etc don't fail while parsing them.
-            File.open(@full_path).read.sub(/^\xEF\xBB\xBF/, '')
+            contents = Bibliothecary.utf8_string(File.open(@full_path).read)
           end
         end
     end

data/lib/bibliothecary/parsers/npm.rb

@@ -38,7 +38,15 @@ module Bibliothecary
 
       def self.parse_package_lock(file_contents, options: {})
         manifest = JSON.parse(file_contents)
-        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+        # https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json#lockfileversion
+        if manifest["lockfileVersion"].to_i <= 1
+          # lockfileVersion 1 uses the "dependencies" object
+          parse_package_lock_v1(manifest)
+        else
+          # lockfileVersion 2 has backwards-compatability by including both "packages" and the legacy "dependencies" object
+          # lockfileVersion 3 has no backwards-compatibility and only includes the "packages" object
+          parse_package_lock_v2(manifest)
+        end
       end
 
       class << self
@@ -46,6 +54,24 @@ module Bibliothecary
         alias_method :parse_shrinkwrap, :parse_package_lock
       end
 
+      def self.parse_package_lock_v1(manifest)
+        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+      end
+      
+      def self.parse_package_lock_v2(manifest)
+        # "packages" is a flat object where each key is the installed location of the dep, e.g. node_modules/foo/node_modules/bar. 
+        manifest
+          .fetch("packages")
+          .reject { |name, dep| name == "" } # this is the lockfile's package itself
+          .map do |name, dep|
+            {
+              name: name.split("node_modules/").last,
+              requirement: dep["version"],
+              type: dep.fetch("dev", false) || dep.fetch("devOptional", false)  ? "development" : "runtime"
+            }  
+          end
+      end
+
       def self.parse_package_lock_deps_recursively(dependencies, depth=1)
         dependencies.flat_map do |name, requirement|
           type = requirement.fetch("dev", false) ? 'development' : 'runtime'
@@ -55,7 +81,7 @@ module Bibliothecary
             []
           else
             parse_package_lock_deps_recursively(requirement.fetch('dependencies', []), depth + 1)
-                               end
+          end
 
           [{
             name: name,

data/lib/bibliothecary/runner/multi_manifest_filter.rb

@@ -71,8 +71,7 @@ module Bibliothecary
 
       def each_analysis_and_rfis
         @multiple_file_entries.each do |file|
-          # Remove any Byte Order Marks so JSON, etc don't fail while parsing them.
-          contents = File.read(File.join(@path, file)).sub(/^\xEF\xBB\xBF/, '')
+          contents = Bibliothecary.utf8_string(File.read(File.join(@path, file)))
           analysis = @runner.analyse_file(file, contents)
           rfis_for_file = @related_files_info_entries.find_all { |rfi| rfi.lockfiles.include?(file) }
 

data/lib/bibliothecary/runner.rb

@@ -116,8 +116,7 @@ module Bibliothecary
 
     # Read a manifest file and extract the list of dependencies from that file.
     def analyse_file(file_path, contents)
-      # Remove any Byte Order Marks so JSON, etc don't fail while parsing them.
-      contents = contents.sub(/^\xEF\xBB\xBF/, '')
+      contents = Bibliothecary.utf8_string(contents)
 
       package_managers.select { |pm| pm.match?(file_path, contents) }.map do |pm|
         pm.analyse_contents(file_path, contents, options: @options)

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.4.5"
+  VERSION = "8.5.0"
 end

data/lib/bibliothecary.rb

@@ -75,6 +75,12 @@ module Bibliothecary
     configuration.ignored_files
   end
 
+  def self.utf8_string(string)
+    string
+      .force_encoding("UTF-8") # treat all strings as utf8
+      .sub(/^\xEF\xBB\xBF/, '') # remove any Byte Order Marks so JSON, etc don't fail while parsing them.
+  end
+
   class << self
     attr_writer :configuration
     alias analyze analyse

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.4.5
+  version: 8.5.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-11-07 00:00:00.000000000 Z
+date: 2022-11-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb