cyclonedx-cocoapods 1.4.0 → 1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b3c1577d54844759e40218fb3b0876014aa8a2eac1a8ea2be2512cab13d79f9
-  data.tar.gz: dd99bd2aa09a1d6ecd956fdd3118a064df6662026b6816ee86f9a2f553347068
+  metadata.gz: 84ed77501efec7ca77fce507dd1dbc4a29ffb4b8cf45fc6b942eafe3901af95a
+  data.tar.gz: 85204bb25786de11c3dc7ec302d016431ebecd7078149081a6b294ba65f756aa
 SHA512:
-  metadata.gz: 5e82c25c27de0fbede464d04a06b9b7f06c3fc79550041835395c6fe5aa32a0f1c4bba1d391b988ff6d39107f696960f064730de43ef8c0f0e8000d576cd1010
-  data.tar.gz: '048fa99979dd4e606b4952412dad3675bad2ebe3e45eccd8513089f18908d5594213031cb85130434f002d7a8edbafbb67818e602c648b49137768e8085c445b'
+  metadata.gz: 7f4b84eb0a11f7f6488fe9fccef7806e786db41ea647806046b729b39952172175df7b8884b17c60e5cac0b246a9bfc6e56d8e53f69b3ad9521c9cde0f19726b
+  data.tar.gz: f719564347931af554dbc2705022a548405bbd95320db5c094f5616166a46ecd830d8fddedcaebd9e24fd76ff6e8be2e1917d3a3be8bc6ede3f21e77e763af77

data/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.1]
+
+### Changed
+- Minimum Ruby version is now v2.6.3 so the [Array.union](https://apidock.com/ruby/v2_6_3/Array/union) function can be used.
+
+### Fixed
+- Improved performance when analyzing a Podfile with many pods. ([Issue #78](https://github.com/CycloneDX/cyclonedx-cocoapods/issues/78)) [@macblazer](https://github.com/macblazer).
+
 ## [1.4.0]
 
 ### Added

data/lib/cyclonedx/cocoapods/cli_runner.rb

@@ -100,12 +100,10 @@ module CycloneDX
             parsed_options[:name] = name
           end
           options.on('-v', '--version version', 'Version of the component for which the BOM is generated') do |version|
-            begin
-              Gem::Version.new(version)
-              parsed_options[:version] = version
-            rescue StandardError => e
-              raise OptionParser::InvalidArgument, e.message
-            end
+            Gem::Version.new(version)
+            parsed_options[:version] = version
+          rescue StandardError => e
+            raise OptionParser::InvalidArgument, e.message
           end
           options.on('-t', '--type type',
                      'Type of the component for which the BOM is generated ' \

data/lib/cyclonedx/cocoapods/podfile_analyzer.rb

@@ -184,12 +184,18 @@ module CycloneDX
         end
       end
 
-      def append_all_pod_dependencies(pods_used, pods_cache)
-        result = pods_used
+      # Calculate simple array of all used pods plus their direct dependencies
+      #
+      # @param [Array<String>] top_level_pods List of pod names that are directly imported by the Podfile
+      # @param [Hash<String,Array<String>>] pods_cache Dependency information directly from the Podfile.lock;
+      # keys are string pod names, values are list of direct dependencies of the given pod.
+      # @return [Array<String>, Hash<String,Array<String>>] First element is list of all used pod names.
+      # Second element is a hash: keys are string pod names, values are the direct dependencies of that pod.
+      def append_all_pod_dependencies(top_level_pods, pods_cache)
+        result = top_level_pods
         original_number = 0
-        dependencies_hash = {}
 
-        # Loop adding pod dependencies until we are not adding any more dependencies to the result
+        # Loop adding pod dependencies until we are not adding any more dependencies to the result.
         # This brings in all the transitive dependencies of every top level pod.
         # Note this also handles two edge cases:
         #  1. Having a Podfile with no pods used.
@@ -197,15 +203,20 @@ module CycloneDX
         while result.length != original_number
           original_number = result.length
 
-          pods_used.each do |pod_name|
+          top_level_pods.each do |pod_name|
             if pods_cache.key?(pod_name)
-              result.push(*pods_cache[pod_name])
-              dependencies_hash[pod_name] = pods_cache[pod_name].empty? ? [] : pods_cache[pod_name]
+              # Append all of the dependencies of this pod into the main list, if they aren't already in the list
+              result = result.union(pods_cache[pod_name])
             end
           end
 
-          result = result.uniq
-          pods_used = result
+          top_level_pods = result
+        end
+
+        # Now that we have the simple list of all unique pods, grab their direct dependencies
+        dependencies_hash = {}
+        result.each do |pod_name|
+          dependencies_hash[pod_name] = pods_cache.key?(pod_name) ? pods_cache[pod_name] : []
         end
 
         [result, dependencies_hash]

data/lib/cyclonedx/cocoapods/version.rb

@@ -21,6 +21,6 @@
 
 module CycloneDX
   module CocoaPods
-    VERSION = '1.4.0'
+    VERSION = '1.4.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cyclonedx-cocoapods
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.4.1
 platform: ruby
 authors:
 - José González
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-10-15 00:00:00.000000000 Z
+date: 2024-11-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cocoapods
@@ -51,48 +51,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: equivalent-xml
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.6.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.6.0
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
 description: CycloneDX is a lightweight software bill-of-material (SBOM) specification
   designed for use in application security contexts and supply chain component analysis.
   This Gem generates CycloneDX BOMs from CocoaPods projects.
@@ -133,14 +91,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.4.0
+      version: 2.6.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.5.23
 signing_key:
 specification_version: 4
 summary: CycloneDX software bill-of-material (SBOM) generation utility