bibliothecary 8.6.5 → 8.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58c0282aec64e81ed313f123670287697f3718e64276e1260030833d70baf892
-  data.tar.gz: be3e9107d5fb2a0968acca81878d4c0bab062bf5b9d994121af2d682a4e8d278
+  metadata.gz: 7f6b75ad41b078c913dc3170bba3fa22d3d885b17e3c27e961f9b5e084d539c7
+  data.tar.gz: 8354e96eb6e2473549e4cbae545a6a9d80fbb9dc49965a0cb75cc66a1e5aa5ca
 SHA512:
-  metadata.gz: 211d953af085e4495325cdd450816f6747ce42b1d8e9c55852e2a50786190466a885cd70b8c454ec1c5d6872ce55f6d8a8ecddd03be7ca2faa02450216f84242
-  data.tar.gz: 74ba743b92e5858c8cc6d7341bf2dda8ff9ce7fdabdff58f44e544554fbc538ae9909726cfcb588d222fa9e1b490d0db9e4ff45896f6f13c375fd1e4ea978f95
+  metadata.gz: f6ab5428cbf33ca11c0013b1af6b0c0314141af095cef19921ebddbbb2ada7db7d6534768be658ff2408a6cc8ce94b84cdf8038ecd75449a3bdc20860a329d62
+  data.tar.gz: 1c5ebfcbf76c589345a818b9a4f2a463a52aca2d2ed3fb0fb90d9b77644ac1b9a0262fb4a38c8f08fabfabb4561c1f2b14d4692e149e3fb0af0092d028b9d117

data/lib/bibliothecary/parsers/maven.rb

@@ -1,6 +1,10 @@
 require 'ox'
 require 'strings-ansi'
 
+# Known shortcomings and unimplemented Maven features:
+#   pom.xml
+#     <exclusions> cannot be taken into account (because it requires knowledge of transitive deps)
+#     <properties> are the only thing inherited from parent poms currenly
 module Bibliothecary
   module Parsers
     class Maven
@@ -270,18 +274,40 @@ module Bibliothecary
         manifest = Ox.parse file_contents
         xml = manifest.respond_to?('project') ? manifest.project : manifest
         [].tap do |deps|
-          ['dependencies/dependency', 'dependencyManagement/dependencies/dependency'].each do |deps_xpath|
-            xml.locate(deps_xpath).each do |dep|
-              dep_hash = {
-                name: "#{extract_pom_dep_info(xml, dep, 'groupId', parent_properties)}:#{extract_pom_dep_info(xml, dep, 'artifactId', parent_properties)}",
-                requirement: extract_pom_dep_info(xml, dep, 'version', parent_properties),
-                type: extract_pom_dep_info(xml, dep, 'scope', parent_properties) || 'runtime',
-              }
-              # optional field is, itself, optional, and will be either "true" or "false"
-              optional = extract_pom_dep_info(xml, dep, 'optional', parent_properties)
-              dep_hash[:optional] = optional == "true" unless optional.nil?
-              deps.push(dep_hash)
+          # <dependencyManagement> is a namespace to specify artifact configuration (e.g. version), but it doesn't
+          # actually add dependencies to your project. Grab these and keep them for reference while parsing <dependencies>
+          # Ref: https://maven.apache.org/pom.html#Dependency_Management
+          # Ref: https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#transitive-dependencies
+          dependencyManagement = xml.locate("dependencyManagement/dependencies/dependency").map do |dep|
+            {
+              groupId: extract_pom_dep_info(xml, dep, "groupId", parent_properties),
+              artifactId: extract_pom_dep_info(xml, dep, "artifactId", parent_properties),
+              version: extract_pom_dep_info(xml, dep, "version", parent_properties),
+              scope: extract_pom_dep_info(xml, dep, "scope", parent_properties),
+            }
+          end
+          # <dependencies> is the namespace that will add dependencies to your project.
+          xml.locate("dependencies/dependency").each do |dep|
+            groupId = extract_pom_dep_info(xml, dep, 'groupId', parent_properties)
+            artifactId = extract_pom_dep_info(xml, dep, 'artifactId', parent_properties)
+            version = extract_pom_dep_info(xml, dep, 'version', parent_properties)
+            scope = extract_pom_dep_info(xml, dep, 'scope', parent_properties)
+
+            # Use any dep configurations from <dependencyManagement> as fallbacks
+            if (depConfig = dependencyManagement.find { |d| d[:groupId] == groupId && d[:artifactId] == artifactId })
+              version ||= depConfig[:version]
+              scope ||= depConfig[:scope]
             end
+
+            dep_hash = {
+              name: "#{groupId}:#{artifactId}",
+              requirement: version,
+              type: scope || 'runtime',
+            }
+            # optional field is, itself, optional, and will be either "true" or "false"
+            optional = extract_pom_dep_info(xml, dep, 'optional', parent_properties)
+            dep_hash[:optional] = optional == "true" unless optional.nil?
+            deps.push(dep_hash)
           end
         end
       end

data/lib/bibliothecary/parsers/nuget.rb

@@ -65,15 +65,17 @@ module Bibliothecary
 
         frameworks = {}
         manifest.fetch('dependencies',[]).each do |framework, deps|
-          frameworks[framework] = deps.map do |name, details|
-            {
-              name: name,
-              # 'resolved' has been set in all examples so far
-              # so fallback to requested is pure paranoia
-              requirement: details.fetch('resolved', details.fetch('requested', '*')),
-              type: 'runtime'
-            }
-          end
+          frameworks[framework] = deps
+            .reject { |_name, details| details["type"] == "Project" } # Projects do not have versions
+            .map do |name, details|
+              {
+                name: name,
+                # 'resolved' has been set in all examples so far
+                # so fallback to requested is pure paranoia
+                requirement: details.fetch('resolved', details.fetch('requested', '*')),
+                type: 'runtime'
+              }
+            end
         end
 
         if frameworks.size > 0

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.6.5"
+  VERSION = "8.7.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.6.5
+  version: 8.7.1
 platform: ruby
 authors:
 - Andrew Nesbitt
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-10 00:00:00.000000000 Z
+date: 2023-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb
@@ -248,7 +248,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description:
+description: 
 email:
 - andrewnez@gmail.com
 executables:
@@ -326,7 +326,7 @@ homepage: https://github.com/librariesio/bibliothecary
 licenses:
 - AGPL-3.0
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -341,8 +341,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key:
+rubygems_version: 3.3.22
+signing_key: 
 specification_version: 4
 summary: Find and parse manifests
 test_files: []