bibliothecary 8.7.5 → 8.7.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3fbd83e689755fcae99771b12a88ce74a9c31c22d60b11b40fcb552987628f45
-  data.tar.gz: deb85d3948752fd0a3142bb41d5cd07bde78b4604b95a77eb652b2d7a6d2634b
+  metadata.gz: 9c0af4f20a3dda13587bef4ed23446be465960fb69970f0f6b928b01dedb5599
+  data.tar.gz: ac0b2b21d35c70ff4c58c9470691a1dcd9f9080ece1a0e4d7606b39292d4022b
 SHA512:
-  metadata.gz: f72d8392eae9835fa51ce423d76f2664592e666964dbf921d25b03d0edef6c5f79adb64e3527c89a2f0ecc9c88958e51de223c93b405a70d28e1a1ca73626dcf
-  data.tar.gz: d9928f3e5181293c015bbf72985bd7baf50f5126655e96cbb5d64d0abbe88c0a061b37a672ce7ea06869d6c1aedcec68fa02ea89fc7a4bc0ba45e32ad692b35d
+  metadata.gz: b2cbe6f624584fded45298b635105e68c41cf7e857472f94ac47582bdd57273339373c21c18982c87bd1556c559f2f58fb1949c25f21cffb04ae082efc16d46e
+  data.tar.gz: 8d35a25784b49e90f639ba0678be9d802e77f66b9e81376d042ce5d7e79af68f5101922bc35b2fff8233c56b9a90759b64dbc492a8bf4104643099bc8fc66eab

data/lib/bibliothecary/multi_parsers/cyclonedx.rb

@@ -81,11 +81,21 @@ module Bibliothecary
             parser: :parse_cyclonedx_json,
             ungroupable: true,
           },
+          match_extension("cdx.json") => {
+            kind: "lockfile",
+            parser: :parse_cyclonedx_json,
+            ungroupable: true,
+          },
           match_filename("cyclonedx.xml") => {
             kind: "lockfile",
             parser: :parse_cyclonedx_xml,
             ungroupable: true,
           },
+          match_extension(".cdx.xml") => {
+            kind: "lockfile",
+            parser: :parse_cyclonedx_xml,
+            ungroupable: true,
+          },
         }
       end
 

data/lib/bibliothecary/parsers/go.rb

@@ -129,8 +129,12 @@ module Bibliothecary
 
         deps = categorized_deps["require"]
           .map do |dep|
-            # A "replace" directive doesn't add the dep to the module graph unless the original dep is also in a "require" directive,
+            # NOTE: A "replace" directive doesn't add the dep to the module graph unless the original dep is also in a "require" directive,
             # so we need to track down replacements here and use those instead of the originals, if present.
+            #
+            # NOTE: The "replace" directive doesn't actually change the version reported from Go (e.g. "go mod graph"), it only changes
+            # the *source code*. So by replacing the deps here, we're giving more honest results than you'd get when asking go
+            # about the versions used.
             replaced_dep = categorized_deps["replace"]
               .find do |replacement_dep| 
                 replacement_dep[:original_name] == dep[:name] && 
@@ -187,7 +191,18 @@ module Bibliothecary
       def self.parse_go_resolved(file_contents, options: {}) # rubocop:disable Lint/UnusedMethodArgument
         JSON.parse(file_contents)
           .select { |dep| dep["Main"] != "true" }
-          .map { |dep| { name: dep["Path"], requirement: dep["Version"], type: dep.fetch("Scope") { "runtime" } } }
+          .map do |dep| 
+            if dep["Replace"].is_a?(String) && dep["Replace"] != "<nil>" && dep["Replace"] != ""
+              # NOTE: The "replace" directive doesn't actually change the version reported from Go (e.g. "go mod graph"), it only changes
+              # the *source code*. So by replacing the deps here, we're giving more honest results than you'd get when asking go
+              # about the versions used.
+              name, requirement = dep["Replace"].split(" ", 2)
+              requirement = "*" if requirement.to_s.strip == ""
+              { name: name, requirement: requirement, original_name: dep["Path"], original_requirement: dep["Version"], type: dep.fetch("Scope") { "runtime" } }
+            else
+              { name: dep["Path"], requirement: dep["Version"], type: dep.fetch("Scope") { "runtime" } }
+            end
+          end
       end
 
       def self.map_dependencies(manifest, attr_name, dep_attr_name, version_attr_name, type)

data/lib/bibliothecary/parsers/pypi.rb

@@ -12,6 +12,7 @@ module Bibliothecary
 
       REQUIREMENTS_REGEXP = /^#{REQUIRE_REGEXP}/
       MANIFEST_REGEXP = /.*require[^\/]*(\/)?[^\/]*\.(txt|pip|in)$/
+      # TODO: can this be a more specific regexp so it doesn't match something like ".yarn/cache/create-require-npm-1.0.0.zip"?
       PIP_COMPILE_REGEXP = /.*require.*$/
 
       # Adapted from https://peps.python.org/pep-0508/#names

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.7.5"
+  VERSION = "8.7.7"
 end

data/lib/bibliothecary.rb

@@ -17,7 +17,8 @@ Dir[File.expand_path("../bibliothecary/parsers/*.rb", __FILE__)].each do |file|
 end
 
 module Bibliothecary
-  VERSION_OPERATORS = /[~^<>*"]/
+  VERSION_OPERATORS = /[~^<>*"]/.freeze
+  INVALID_UTF8_ERROR_REGEXP = /invalid byte sequence/.freeze
 
   def self.analyse(path, ignore_unparseable_files: true)
     runner.analyse(path, ignore_unparseable_files: ignore_unparseable_files)
@@ -81,6 +82,10 @@ module Bibliothecary
       .dup # ensure we don't have a frozen string
       .force_encoding("UTF-8") # treat all strings as utf8
       .sub(/^\xEF\xBB\xBF/, "") # remove any Byte Order Marks so JSON, etc don't fail while parsing them.
+  rescue ArgumentError => e
+    # Bibliothecary doesn't need to analyze non-UTF8 files like binary files, so just return blank.
+    return "" if e.message.match?(INVALID_UTF8_ERROR_REGEXP)
+    raise e
   end
 
   class << self

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.7.5
+  version: 8.7.7
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-01-08 00:00:00.000000000 Z
+date: 2024-03-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb