bibliothecary 12.1.7 → 12.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18bfbedc4fbc53fe3e7f4ee02ee42ba27462dbc488efd3ee48a87e2ad12cd1e2
-  data.tar.gz: 5210a4d460815bf40f21639b0a2d887a59b9672fdb64d97981809ab87cbae744
+  metadata.gz: 77ce2638e657925c2ce0457675ddafea27858758ec53f68f996667eb21ac290c
+  data.tar.gz: 7027d2ce73799ee52fdb6665fbaa115d2d630676cf777a740d62fae5ffa90534
 SHA512:
-  metadata.gz: e0a2503b63e500193ba491ee1875ba0ded58a01d5fa6bed2eefae36cf2e4e6f0111a1f84dd1334b8bd3bf0b728065dcba299d19b7414d476f606554031840b7b
-  data.tar.gz: dd586eb81b390826b23021edf014ff2adc2f6738487c18a51a1e08dc9ad0b10a6b8d9e20b79219411b45f3323221b9d0c0f0c8bc977feb7e90d66af8ce329fda
+  metadata.gz: 9f12ee44667a46ec862d620870f1372755efe70af26243320b785e854c37e6ed7047d0988eadbe9758a9194c32d5f85772f5b2f9d69ee2a9e19e13a9873f937a
+  data.tar.gz: 660b68966106543fbc7c8326a77ca5cc89947321dacf8f35a19aa1ee6818e4d077a1f1f0e86f1f8a7d6e52da6d377a7f8c90ac43d1b809158fe65c94dbaeb5c5

data/CHANGELOG.md

@@ -13,6 +13,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
+## [12.1.8] - 2025-05-16
+
+### Added
+
+- Support multiple requirements for a single package in poetry.lock.
+
+### Changed
+
+### Removed
+
 ## [12.1.7] - 2025-04-29
 
 ### Added
@@ -95,7 +105,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Populate Bibliothecary::Dependency#source field in all parsers. This makes the source field useful when consuming 
+- Populate Bibliothecary::Dependency#source field in all parsers. This makes the source field useful when consuming
   from Bibliothecary, and removes a step from consumers having to populate this field themselves.
 
 ### Changed
@@ -138,9 +148,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Support parsing *.spdx.json files
+- Support parsing \*.spdx.json files
 
 ### Changed
+
 - `Bibliothecary::PURL_TYPE_MAPPING` has changed to `Bibliothecary::PurlUtil::PURL_TYPE_MAPPING`
 - `Bibliothecary::MultiParsers::CycloneDX::ManifestEntries.full_name_for_purl` has changed to `Bibliothecary::PurlUtil.full_name`
 

data/lib/bibliothecary/parsers/pypi.rb

@@ -142,16 +142,31 @@ module Bibliothecary
       def self.map_dependencies(packages, type, source = nil)
         return [] unless packages
 
-        packages.map do |name, package_info|
+        packages.flat_map do |name, package_info|
           local = true if package_info.is_a?(Hash) && (package_info.key?("path") || package_info.key?("file"))
 
-          Dependency.new(
-            name: name,
-            requirement: map_requirements(package_info),
-            type: type,
-            source: source,
-            local: local
-          )
+          if package_info.is_a?(Array)
+            # Poetry supports multiple requirements with differing specifiers for the same
+            # package. Break these out into a separate dep per requirement.
+            # https://python-poetry.org/docs/dependency-specification/#multiple-constraints-dependencies
+            package_info.map do |info|
+              Dependency.new(
+                name: name,
+                requirement: map_requirements(info),
+                type: type,
+                source: source,
+                local: local
+              )
+            end
+          else
+            Dependency.new(
+              name: name,
+              requirement: map_requirements(package_info),
+              type: type,
+              source: source,
+              local: local
+            )
+          end
         end
       end
 
@@ -160,7 +175,7 @@ module Bibliothecary
           if info["version"]
             info["version"]
           elsif info["git"]
-            "#{info['git']}##{info['ref']}"
+            "#{info['git']}##{info['ref'] || info['tag']}"
           else
             "*"
           end
@@ -186,19 +201,25 @@ module Bibliothecary
         deps = []
         manifest["package"].each do |package|
           # next if group == "_meta"
-          group = case package["category"]
-                  when "dev"
-                    "develop"
-                  else
-                    "runtime"
-                  end
 
-          deps << Dependency.new(
-            name: package["name"],
-            requirement: map_requirements(package),
-            type: group,
-            source: options.fetch(:filename, nil)
-          )
+          # Poetry <1.2.0 used singular "category" for kind
+          # Poetry >=1.2.0 uses plural "groups" field for kind(s)
+          package.values_at("category", "groups").flatten.compact
+            .map do |g|
+              if g == "dev"
+                "develop"
+              else
+                (g == "main" ? "runtime" : g)
+              end
+            end
+            .each do |group|
+              deps << Dependency.new(
+                name: package["name"],
+                requirement: map_requirements(package),
+                type: group,
+                source: options.fetch(:filename, nil)
+              )
+            end
         end
         deps
       end

data/lib/bibliothecary/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bibliothecary
-  VERSION = "12.1.7"
+  VERSION = "12.1.8"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 12.1.7
+  version: 12.1.8
 platform: ruby
 authors:
 - Andrew Nesbitt
 bindir: bin
 cert_chain: []
-date: 2025-04-30 00:00:00.000000000 Z
+date: 2025-05-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: commander