bibliothecary 8.6.5 → 8.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58c0282aec64e81ed313f123670287697f3718e64276e1260030833d70baf892
-  data.tar.gz: be3e9107d5fb2a0968acca81878d4c0bab062bf5b9d994121af2d682a4e8d278
+  metadata.gz: 39af4653f19e0376f945656791b9dc2eb6e60f5d519a9a0e947e4623827376d2
+  data.tar.gz: c2a6b01a1d14abffde071d07a95a28e851e85c61a89fe3ebb5239c82f2cef3fd
 SHA512:
-  metadata.gz: 211d953af085e4495325cdd450816f6747ce42b1d8e9c55852e2a50786190466a885cd70b8c454ec1c5d6872ce55f6d8a8ecddd03be7ca2faa02450216f84242
-  data.tar.gz: 74ba743b92e5858c8cc6d7341bf2dda8ff9ce7fdabdff58f44e544554fbc538ae9909726cfcb588d222fa9e1b490d0db9e4ff45896f6f13c375fd1e4ea978f95
+  metadata.gz: 5e923a36a18760a6f3acdc05f7330de7704c42f235fd1bbee880dc7d7ea3bf1604ea8ecd060f6984db7a32ac6b552d10cd19d8b6257153fc7c19f55430234661
+  data.tar.gz: a65aed02e5de4338a4c48ce44f77b2119fee0a26be51c7bac1bd18cdf8a51ceebed0305e16b965483cf4d2452ba63f3557de93acd29b474428245d62bceac707

data/lib/bibliothecary/parsers/maven.rb

@@ -1,6 +1,10 @@
 require 'ox'
 require 'strings-ansi'
 
+# Known shortcomings and unimplemented Maven features:
+#   pom.xml
+#     <exclusions> cannot be taken into account (because it requires knowledge of transitive deps)
+#     <properties> are the only thing inherited from parent poms currenly
 module Bibliothecary
   module Parsers
     class Maven
@@ -270,18 +274,40 @@ module Bibliothecary
         manifest = Ox.parse file_contents
         xml = manifest.respond_to?('project') ? manifest.project : manifest
         [].tap do |deps|
-          ['dependencies/dependency', 'dependencyManagement/dependencies/dependency'].each do |deps_xpath|
-            xml.locate(deps_xpath).each do |dep|
-              dep_hash = {
-                name: "#{extract_pom_dep_info(xml, dep, 'groupId', parent_properties)}:#{extract_pom_dep_info(xml, dep, 'artifactId', parent_properties)}",
-                requirement: extract_pom_dep_info(xml, dep, 'version', parent_properties),
-                type: extract_pom_dep_info(xml, dep, 'scope', parent_properties) || 'runtime',
-              }
-              # optional field is, itself, optional, and will be either "true" or "false"
-              optional = extract_pom_dep_info(xml, dep, 'optional', parent_properties)
-              dep_hash[:optional] = optional == "true" unless optional.nil?
-              deps.push(dep_hash)
+          # <dependencyManagement> is a namespace to specify artifact configuration (e.g. version), but it doesn't
+          # actually add dependencies to your project. Grab these and keep them for reference while parsing <dependencies>
+          # Ref: https://maven.apache.org/pom.html#Dependency_Management
+          # Ref: https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#transitive-dependencies
+          dependencyManagement = xml.locate("dependencyManagement/dependencies/dependency").map do |dep|
+            {
+              groupId: extract_pom_dep_info(xml, dep, "groupId", parent_properties),
+              artifactId: extract_pom_dep_info(xml, dep, "artifactId", parent_properties),
+              version: extract_pom_dep_info(xml, dep, "version", parent_properties),
+              scope: extract_pom_dep_info(xml, dep, "scope", parent_properties),
+            }
+          end
+          # <dependencies> is the namespace that will add dependencies to your project.
+          xml.locate("dependencies/dependency").each do |dep|
+            groupId = extract_pom_dep_info(xml, dep, 'groupId', parent_properties)
+            artifactId = extract_pom_dep_info(xml, dep, 'artifactId', parent_properties)
+            version = extract_pom_dep_info(xml, dep, 'version', parent_properties)
+            scope = extract_pom_dep_info(xml, dep, 'scope', parent_properties)
+
+            # Use any dep configurations from <dependencyManagement> as fallbacks
+            if (depConfig = dependencyManagement.find { |d| d[:groupId] == groupId && d[:artifactId] == artifactId })
+              version ||= depConfig[:version]
+              scope ||= depConfig[:scope]
             end
+
+            dep_hash = {
+              name: "#{groupId}:#{artifactId}",
+              requirement: version,
+              type: scope || 'runtime',
+            }
+            # optional field is, itself, optional, and will be either "true" or "false"
+            optional = extract_pom_dep_info(xml, dep, 'optional', parent_properties)
+            dep_hash[:optional] = optional == "true" unless optional.nil?
+            deps.push(dep_hash)
           end
         end
       end

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.6.5"
+  VERSION = "8.7.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.6.5
+  version: 8.7.0
 platform: ruby
 authors:
 - Andrew Nesbitt
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-08-10 00:00:00.000000000 Z
+date: 2023-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb
@@ -248,7 +248,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description:
+description: 
 email:
 - andrewnez@gmail.com
 executables:
@@ -326,7 +326,7 @@ homepage: https://github.com/librariesio/bibliothecary
 licenses:
 - AGPL-3.0
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -341,8 +341,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key:
+rubygems_version: 3.3.22
+signing_key: 
 specification_version: 4
 summary: Find and parse manifests
 test_files: []