bibliothecary 8.7.7 → 8.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c0af4f20a3dda13587bef4ed23446be465960fb69970f0f6b928b01dedb5599
-  data.tar.gz: ac0b2b21d35c70ff4c58c9470691a1dcd9f9080ece1a0e4d7606b39292d4022b
+  metadata.gz: dc9dd3ee94e4de1a66c6dabac392832a1ba6805dbef22398665697a85bc8a420
+  data.tar.gz: 800a427c7e9fbe6d12d116c1c0e57373136421dd99b6fc272218fad3c47db72d
 SHA512:
-  metadata.gz: b2cbe6f624584fded45298b635105e68c41cf7e857472f94ac47582bdd57273339373c21c18982c87bd1556c559f2f58fb1949c25f21cffb04ae082efc16d46e
-  data.tar.gz: 8d35a25784b49e90f639ba0678be9d802e77f66b9e81376d042ce5d7e79af68f5101922bc35b2fff8233c56b9a90759b64dbc492a8bf4104643099bc8fc66eab
+  metadata.gz: d8da425a16d0378c3a73658df752804af3f9c78d31eccb7a26e0abf0b469f0dfa9c8a1d17f907c77255015499e9f947b1b63823641762be161cb4248afb8a2b6
+  data.tar.gz: 16d78e7dc17c53d79a6b634dde2ca7b73d8cccaa9db4435956ef752de6fa7c73a6d92a8486576beab838bc12a328016274ca850f2b54ed7e875110c1e38f0a74

data/lib/bibliothecary/parsers/npm.rb

@@ -63,12 +63,18 @@ module Bibliothecary
         # "packages" is a flat object where each key is the installed location of the dep, e.g. node_modules/foo/node_modules/bar.
         manifest
           .fetch("packages")
-          .reject { |name, _dep| name == "" } # this is the lockfile's package itself
+          # there are a couple of scenarios where a package's name won't start with node_modules
+          #   1. name == "", this is the lockfile's package itself
+          #   2. when a package is a local path dependency, it will appear in package-lock.json twice.
+          #      * One occurrence has the node_modules/ prefix in the name (which we keep)
+          #      * The other occurrence's name is the path to the local dependency (which has less information, and is duplicative, so we discard)
+          .select { |name, _dep| name.start_with?("node_modules") }
           .map do |name, dep|
             {
               name: name.split("node_modules/").last,
-              requirement: dep["version"],
+              requirement: dep["version"] || "*",
               type: dep.fetch("dev", false) || dep.fetch("devOptional", false)  ? "development" : "runtime",
+              local: dep.fetch("link", false),
             }
           end
       end
@@ -101,6 +107,9 @@ module Bibliothecary
           map_dependencies(manifest, "devDependencies", "development")
         )
           .reject { |dep| dep[:name].start_with?("//") } # Omit comment keys. They are valid in package.json: https://groups.google.com/g/nodejs/c/NmL7jdeuw0M/m/yTqI05DRQrIJ
+          .each do |dep|
+            dep[:local] = dep[:requirement].start_with?("file:")
+          end
       end
 
       def self.parse_yarn_lock(file_contents, options: {}) # rubocop:disable Lint/UnusedMethodArgument
@@ -115,6 +124,7 @@ module Bibliothecary
             requirement: dep[:version],
             lockfile_requirement: dep[:requirement],
             type: dep[:type],
+            local: dep[:requirement]&.start_with?("file:"),
           }
         end
       end

data/lib/bibliothecary/parsers/pypi.rb

@@ -9,8 +9,8 @@ module Bibliothecary
       # Optional Group 2 is [extras].
       # Capture Group 3 is Version
       REQUIRE_REGEXP = /([a-zA-Z0-9]+[a-zA-Z0-9\-_\.]+)(?:\[.*?\])*([><=\w\.,]+)?/
-
       REQUIREMENTS_REGEXP = /^#{REQUIRE_REGEXP}/
+
       MANIFEST_REGEXP = /.*require[^\/]*(\/)?[^\/]*\.(txt|pip|in)$/
       # TODO: can this be a more specific regexp so it doesn't match something like ".yarn/cache/create-require-npm-1.0.0.zip"?
       PIP_COMPILE_REGEXP = /.*require.*$/
@@ -45,6 +45,10 @@ module Bibliothecary
             kind: "lockfile",
             parser: :parse_requirements_txt,
           },
+          match_filename("pip-dependency-graph.json") => { # Exported from pipdeptree --json
+            kind: "lockfile",
+            parser: :parse_dependency_tree_json,
+          },
           match_filename("setup.py") => {
             kind: "manifest",
             parser: :parse_setup_py,
@@ -226,6 +230,18 @@ module Bibliothecary
       # should be treated as.
       NoEggSpecified = Class.new(ArgumentError)
 
+      def self.parse_dependency_tree_json(file_contents, options: {})
+        JSON.parse(file_contents)
+          .map do |pkg|
+            {
+                name: pkg.dig("package", "package_name"),
+                requirement: pkg.dig("package", "installed_version"),
+                type: "runtime",
+              }
+          end
+          .uniq
+      end
+
       # Parses a requirements.txt file, following the
       # https://pip.pypa.io/en/stable/cli/pip_install/#requirement-specifiers
       # and https://pip.pypa.io/en/stable/topics/vcs-support/#git.
@@ -252,10 +268,7 @@ module Bibliothecary
             deps << result.merge(
               type: type
             )
-          else
-            match = line.delete(" ").match(REQUIREMENTS_REGEXP)
-            next unless match
-
+          elsif (match = line.delete(" ").match(REQUIREMENTS_REGEXP))
             deps << {
               name: match[1],
               requirement: match[-1] || "*",
@@ -263,7 +276,8 @@ module Bibliothecary
             }
           end
         end
-        deps
+
+        deps.uniq
       end
 
       def self.parse_requirements_txt_url(url)

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.7.7"
+  VERSION = "8.8.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.7.7
+  version: 8.8.1
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-03-12 00:00:00.000000000 Z
+date: 2024-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb