bibliothecary 8.4.6 → 8.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33e04a00975f760b9181b0abd40f0e95d16cd13be398a451b66fb23515df11fa
-  data.tar.gz: 697ee1d7cbebdb1a1cfbce80263ef1d3d9a7d68e154aca137988e14ba96a8c22
+  metadata.gz: 28eee333f0558f68657092d126ca5465eddbba371f1ad189a3007d4b43915063
+  data.tar.gz: 91cb04d35a821cd7a8af93688a7db430d445f37f805493f379c2eeccddca5f74
 SHA512:
-  metadata.gz: 792317a507641d26ec0903d59962c4e9949e253926346128c6c9d56c82a2716484163fe2c1cf626c10d967c19872c9c610fd12f9dcb7f2c5f27270be05a4ce29
-  data.tar.gz: 24795027d27690ea19467426cc9499ea93941d9eae184b02100900bfb6eb310f8f9de94e1baa24d2969e51f03b6a85c995bb16c53f5b77c4a011a9622309556e
+  metadata.gz: 8286430aba8f90efd0fc73b63f1fe31f57a7aa3759f88613fdecced517ad98a12a2ce62032bab0919c94f125c84953a71ba3862533a4a2e410ec11d1e4cf4a99
+  data.tar.gz: 310fa03c90fca4ee65fb46b2fb78b9f9276b082adeada8a4536cd9357441c7f33c54cbf016cd087a7b7c5f0b6517664ed8107d92cbe730e57538888e2e778fe6

data/lib/bibliothecary/parsers/maven.rb

@@ -322,6 +322,9 @@ module Bibliothecary
         extract_pom_dep_info(xml, xml, location, parent_properties)
       end
 
+      # TODO: it might be worth renaming parent_properties to parent_elements
+      # so that more can be inherited from the parent pom than just <properties>
+      # here (see https://maven.apache.org/pom.html#inheritance)
       def self.extract_pom_dep_info(xml, dependency, name, parent_properties = {})
         field = dependency.locate(name).first
         return nil if field.nil?
@@ -363,7 +366,10 @@ module Bibliothecary
         return "${#{property_name}}" if !xml.respond_to?("properties") && parent_properties.empty? && xml.locate(non_prop_name).empty?
 
         prop_field = xml.properties.locate(property_name).first if xml.respond_to?("properties")
-        parent_prop = parent_properties[property_name]
+        parent_prop = parent_properties[property_name] ||                 # e.g. "${foo}"
+          parent_properties[property_name.sub(/^project\./, '')] ||       # e.g. "${project.foo}"
+          parent_properties[property_name.sub(/^project\.parent\./, '')]  # e.g. "${project.parent.foo}"
+
         if prop_field
           prop_field.nodes.first
         elsif parent_prop

data/lib/bibliothecary/parsers/npm.rb

@@ -38,7 +38,15 @@ module Bibliothecary
 
       def self.parse_package_lock(file_contents, options: {})
         manifest = JSON.parse(file_contents)
-        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+        # https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json#lockfileversion
+        if manifest["lockfileVersion"].to_i <= 1
+          # lockfileVersion 1 uses the "dependencies" object
+          parse_package_lock_v1(manifest)
+        else
+          # lockfileVersion 2 has backwards-compatability by including both "packages" and the legacy "dependencies" object
+          # lockfileVersion 3 has no backwards-compatibility and only includes the "packages" object
+          parse_package_lock_v2(manifest)
+        end
       end
 
       class << self
@@ -46,6 +54,24 @@ module Bibliothecary
         alias_method :parse_shrinkwrap, :parse_package_lock
       end
 
+      def self.parse_package_lock_v1(manifest)
+        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+      end
+      
+      def self.parse_package_lock_v2(manifest)
+        # "packages" is a flat object where each key is the installed location of the dep, e.g. node_modules/foo/node_modules/bar. 
+        manifest
+          .fetch("packages")
+          .reject { |name, dep| name == "" } # this is the lockfile's package itself
+          .map do |name, dep|
+            {
+              name: name.split("node_modules/").last,
+              requirement: dep["version"],
+              type: dep.fetch("dev", false) || dep.fetch("devOptional", false)  ? "development" : "runtime"
+            }  
+          end
+      end
+
       def self.parse_package_lock_deps_recursively(dependencies, depth=1)
         dependencies.flat_map do |name, requirement|
           type = requirement.fetch("dev", false) ? 'development' : 'runtime'
@@ -55,7 +81,7 @@ module Bibliothecary
             []
           else
             parse_package_lock_deps_recursively(requirement.fetch('dependencies', []), depth + 1)
-                               end
+          end
 
           [{
             name: name,

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.4.6"
+  VERSION = "8.5.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.4.6
+  version: 8.5.1
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-11-08 00:00:00.000000000 Z
+date: 2023-01-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb