bibliothecary 7.2.1 → 7.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ba740dd30abb75fb073f3160d963a970ffa41099966e86a38558fc50c515c9bf
-  data.tar.gz: 19de22f64f4390acd0c15781283d1089c85459aa989393485ab25337e246ef01
+  metadata.gz: 6bf41693f3224f06747aa8ea8799d369d68b262033689b900fe1a18c35803b85
+  data.tar.gz: 4cee903aaa6fff7e24e7ca4f8ddd162d2dd42af4ec04161fac21397622e6f5cd
 SHA512:
-  metadata.gz: 9f7f301227e79af9a7f3bafc5484e39426c9d5faee1ee1c6a97f4173d6b438def08cf36ea3a8eedaa06d9ce0741ee6bf012b7aba1a972680c79b397ac57a1ac9
-  data.tar.gz: 11bbaf66d5dcb32b042923abf85be353d96a6d1f09c1e641e0c40df215d9f70347e56b4d7afe81b5bb27a685318667c7c53d2ba24a2961e2a4dad72ad1c90273
+  metadata.gz: c178932cf88d945686cfa34ab2e9cf581c2b99878d51e2fc783e98804b63737f7f852a1017c81c4aec9c8ca7f425b54b3092722f95b767e37be07fce343a2740
+  data.tar.gz: b11a8ea3373f61fb2d1def0f203a400c864f30eec52faa77551d256cdc1a9c27e20e960b4151713982987faea0af8529e83f0d8606129613591487a358c26755

data/lib/bibliothecary/parsers/npm.rb

@@ -5,6 +5,9 @@ module Bibliothecary
     class NPM
       include Bibliothecary::Analyser
 
+      # Max depth to recurse into the "dependencies" property of package-lock.json
+      PACKAGE_LOCK_JSON_MAX_DEPTH = 10
+
       def self.mapping
         {
           match_filename("package.json") => {
@@ -43,26 +46,25 @@ module Bibliothecary
 
       def self.parse_package_lock(file_contents)
         manifest = JSON.parse(file_contents)
-        manifest.fetch('dependencies',[]).map do |name, requirement|
-          if requirement.fetch("dev", false)
-            type = 'development'
-          else
-            type = 'runtime'
-          end
-
-          version = nil
-
-          if requirement.key?("from")
-            version = requirement["from"][/#(?:semver:)?v?(.*)/, 1]
-          end
+        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+      end
 
+      def self.parse_package_lock_deps_recursively(dependencies, depth=1)
+        dependencies.flat_map do |name, requirement|
+          type = requirement.fetch("dev", false) ? 'development' : 'runtime'
+          version = requirement.key?("from") ? requirement["from"][/#(?:semver:)?v?(.*)/, 1] : nil
           version ||= requirement["version"].split("#").last
+          child_dependencies = if depth >= PACKAGE_LOCK_JSON_MAX_DEPTH
+            []
+          else
+            parse_package_lock_deps_recursively(requirement.fetch('dependencies', []), depth + 1)
+          end
 
-          {
+          [{
             name: name,
             requirement: version,
             type: type
-          }
+          }] + child_dependencies
         end
       end
 

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "7.2.1"
+  VERSION = "7.3.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 7.2.1
+  version: 7.3.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-10-15 00:00:00.000000000 Z
+date: 2021-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb