bibliothecary 8.7.6 → 8.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57b89f5321f44b47f940c8fe8be9e50e2007ad4176fd002744f1f44a2bd9cbe7
-  data.tar.gz: 742a28fbf8a17708e64736bf49039347af391db3b1ad4c62355df83f45459d5f
+  metadata.gz: d1780d8940244ee5e96aab6ad08266b28f1bfac65eabb9ae2fc811712ddbbb3a
+  data.tar.gz: ac03558d5e3f9f127664c8420f31273b3eacfefccc4c193c1aa6830f2b54f749
 SHA512:
-  metadata.gz: 7a86455347539c89417c398c19e99ff8cd4ea84d52057c4e67f991f6ac518083db567a733b83cc4044dbb326d4a7322dde9514b3a486ed1c7825bc6cf2fdad7c
-  data.tar.gz: a3c33ebc60114b4c9627d8dfd205d0579e32efd706c01fc84f00606d378db05c103f50655eb68c8b2f6383d0b50c9fcf7370a65d16d18c0dd1a9dd74241bbf45
+  metadata.gz: 0ba1a48525ff6a464715b4d8210d5edf6269a31a785d2038f9228e5b591e83c128ff9adb33bc12d427da134afafb5e1b3808092f272105a7896e1db8895e67f6
+  data.tar.gz: 3737f2812866ea2d79f94d5c1dfecfcfb822ec2496d8eb013319d72d3218e8e4deb988232b046886ee616688f9cebd6c5c131186f8db2289bd3b372eb3dd8a67

data/lib/bibliothecary/multi_parsers/cyclonedx.rb

@@ -81,11 +81,21 @@ module Bibliothecary
             parser: :parse_cyclonedx_json,
             ungroupable: true,
           },
+          match_extension("cdx.json") => {
+            kind: "lockfile",
+            parser: :parse_cyclonedx_json,
+            ungroupable: true,
+          },
           match_filename("cyclonedx.xml") => {
             kind: "lockfile",
             parser: :parse_cyclonedx_xml,
             ungroupable: true,
           },
+          match_extension(".cdx.xml") => {
+            kind: "lockfile",
+            parser: :parse_cyclonedx_xml,
+            ungroupable: true,
+          },
         }
       end
 

data/lib/bibliothecary/parsers/npm.rb

@@ -63,12 +63,18 @@ module Bibliothecary
         # "packages" is a flat object where each key is the installed location of the dep, e.g. node_modules/foo/node_modules/bar.
         manifest
           .fetch("packages")
-          .reject { |name, _dep| name == "" } # this is the lockfile's package itself
+          # there are a couple of scenarios where a package's name won't start with node_modules
+          #   1. name == "", this is the lockfile's package itself
+          #   2. when a package is a local path dependency, it will appear in package-lock.json twice.
+          #      * One occurrence has the node_modules/ prefix in the name (which we keep)
+          #      * The other occurrence's name is the path to the local dependency (which has less information, and is duplicative, so we discard)
+          .select { |name, _dep| name.start_with?("node_modules") }
           .map do |name, dep|
             {
               name: name.split("node_modules/").last,
-              requirement: dep["version"],
+              requirement: dep["version"] || "*",
               type: dep.fetch("dev", false) || dep.fetch("devOptional", false)  ? "development" : "runtime",
+              local: dep.fetch("link", false),
             }
           end
       end
@@ -101,6 +107,9 @@ module Bibliothecary
           map_dependencies(manifest, "devDependencies", "development")
         )
           .reject { |dep| dep[:name].start_with?("//") } # Omit comment keys. They are valid in package.json: https://groups.google.com/g/nodejs/c/NmL7jdeuw0M/m/yTqI05DRQrIJ
+          .each do |dep|
+            dep[:local] = dep[:requirement].start_with?("file:")
+          end
       end
 
       def self.parse_yarn_lock(file_contents, options: {}) # rubocop:disable Lint/UnusedMethodArgument
@@ -115,6 +124,7 @@ module Bibliothecary
             requirement: dep[:version],
             lockfile_requirement: dep[:requirement],
             type: dep[:type],
+            local: dep[:requirement]&.start_with?("file:"),
           }
         end
       end

data/lib/bibliothecary/parsers/pypi.rb

@@ -12,6 +12,7 @@ module Bibliothecary
 
       REQUIREMENTS_REGEXP = /^#{REQUIRE_REGEXP}/
       MANIFEST_REGEXP = /.*require[^\/]*(\/)?[^\/]*\.(txt|pip|in)$/
+      # TODO: can this be a more specific regexp so it doesn't match something like ".yarn/cache/create-require-npm-1.0.0.zip"?
       PIP_COMPILE_REGEXP = /.*require.*$/
 
       # Adapted from https://peps.python.org/pep-0508/#names

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.7.6"
+  VERSION = "8.8.0"
 end

data/lib/bibliothecary.rb

@@ -17,7 +17,8 @@ Dir[File.expand_path("../bibliothecary/parsers/*.rb", __FILE__)].each do |file|
 end
 
 module Bibliothecary
-  VERSION_OPERATORS = /[~^<>*"]/
+  VERSION_OPERATORS = /[~^<>*"]/.freeze
+  INVALID_UTF8_ERROR_REGEXP = /invalid byte sequence/.freeze
 
   def self.analyse(path, ignore_unparseable_files: true)
     runner.analyse(path, ignore_unparseable_files: ignore_unparseable_files)
@@ -81,6 +82,10 @@ module Bibliothecary
       .dup # ensure we don't have a frozen string
       .force_encoding("UTF-8") # treat all strings as utf8
       .sub(/^\xEF\xBB\xBF/, "") # remove any Byte Order Marks so JSON, etc don't fail while parsing them.
+  rescue ArgumentError => e
+    # Bibliothecary doesn't need to analyze non-UTF8 files like binary files, so just return blank.
+    return "" if e.message.match?(INVALID_UTF8_ERROR_REGEXP)
+    raise e
   end
 
   class << self

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.7.6
+  version: 8.8.0
 platform: ruby
 authors:
 - Andrew Nesbitt
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-01-11 00:00:00.000000000 Z
+date: 2024-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb
@@ -248,7 +248,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: 
+description:
 email:
 - andrewnez@gmail.com
 executables:
@@ -326,7 +326,7 @@ homepage: https://github.com/librariesio/bibliothecary
 licenses:
 - AGPL-3.0
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -341,8 +341,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.22
-signing_key: 
+rubygems_version: 3.1.6
+signing_key:
 specification_version: 4
 summary: Find and parse manifests
 test_files: []