bibliothecary 8.4.6 → 8.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33e04a00975f760b9181b0abd40f0e95d16cd13be398a451b66fb23515df11fa
-  data.tar.gz: 697ee1d7cbebdb1a1cfbce80263ef1d3d9a7d68e154aca137988e14ba96a8c22
+  metadata.gz: ac52b349e3c70feee32a4866adc7d81a850467dcc167cd0227c20dadafcb78a9
+  data.tar.gz: 7127e1e85bf737dacbfaf84d91fd3c8e0ea527d7337e0381d1ca36a8677289c3
 SHA512:
-  metadata.gz: 792317a507641d26ec0903d59962c4e9949e253926346128c6c9d56c82a2716484163fe2c1cf626c10d967c19872c9c610fd12f9dcb7f2c5f27270be05a4ce29
-  data.tar.gz: 24795027d27690ea19467426cc9499ea93941d9eae184b02100900bfb6eb310f8f9de94e1baa24d2969e51f03b6a85c995bb16c53f5b77c4a011a9622309556e
+  metadata.gz: 476ced972f0f89192fb42fa2d9a12bc279ef8635211040e3e9c73cd0ab242e997193fae9f21c4a305956f5f8b188b12cf3a67fd054200a589202e6337755d990
+  data.tar.gz: 8167b963298ad218bbbc0b7666f3e8a0622781321a64c2558c816946ddfd69c284cf4842bb8c99681c5ea84edf1d665ce8a2291753f16a6447ab388a5982f7ce

data/lib/bibliothecary/parsers/npm.rb

@@ -38,7 +38,15 @@ module Bibliothecary
 
       def self.parse_package_lock(file_contents, options: {})
         manifest = JSON.parse(file_contents)
-        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+        # https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json#lockfileversion
+        if manifest["lockfileVersion"].to_i <= 1
+          # lockfileVersion 1 uses the "dependencies" object
+          parse_package_lock_v1(manifest)
+        else
+          # lockfileVersion 2 has backwards-compatability by including both "packages" and the legacy "dependencies" object
+          # lockfileVersion 3 has no backwards-compatibility and only includes the "packages" object
+          parse_package_lock_v2(manifest)
+        end
       end
 
       class << self
@@ -46,6 +54,24 @@ module Bibliothecary
         alias_method :parse_shrinkwrap, :parse_package_lock
       end
 
+      def self.parse_package_lock_v1(manifest)
+        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+      end
+      
+      def self.parse_package_lock_v2(manifest)
+        # "packages" is a flat object where each key is the installed location of the dep, e.g. node_modules/foo/node_modules/bar. 
+        manifest
+          .fetch("packages")
+          .reject { |name, dep| name == "" } # this is the lockfile's package itself
+          .map do |name, dep|
+            {
+              name: name.split("node_modules/").last,
+              requirement: dep["version"],
+              type: dep.fetch("dev", false) || dep.fetch("devOptional", false)  ? "development" : "runtime"
+            }  
+          end
+      end
+
       def self.parse_package_lock_deps_recursively(dependencies, depth=1)
         dependencies.flat_map do |name, requirement|
           type = requirement.fetch("dev", false) ? 'development' : 'runtime'
@@ -55,7 +81,7 @@ module Bibliothecary
             []
           else
             parse_package_lock_deps_recursively(requirement.fetch('dependencies', []), depth + 1)
-                               end
+          end
 
           [{
             name: name,

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.4.6"
+  VERSION = "8.5.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.4.6
+  version: 8.5.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-11-08 00:00:00.000000000 Z
+date: 2022-11-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb