license_finder 7.0.1 → 7.2.0

data/lib/license_finder/package_managers/yarn.rb

@@ -2,7 +2,12 @@
 
 module LicenseFinder
   class Yarn < PackageManager
-    SHELL_COMMAND = 'yarn licenses list --json'
+    def initialize(options = {})
+      super
+      @yarn_options = options[:yarn_options]
+    end
+
+    SHELL_COMMAND = 'yarn licenses list --recursive --json'
 
     def possible_package_paths
       [project_path.join('yarn.lock')]
@@ -14,31 +19,20 @@ module LicenseFinder
       if yarn_version == 1
         cmd += ' --no-progress'
         cmd += " --cwd #{project_path}" unless project_path.nil?
+        cmd += " #{@yarn_options}" unless @yarn_options.nil?
       end
 
-      stdout, stderr, status = Cmd.run(cmd)
+      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(cmd) }
       raise "Command '#{cmd}' failed to execute: #{stderr}" unless status.success?
 
-      packages = []
-      incompatible_packages = []
-
       json_strings = stdout.encode('ASCII', invalid: :replace, undef: :replace, replace: '?').split("\n")
       json_objects = json_strings.map { |json_object| JSON.parse(json_object) }
 
-      if json_objects.last['type'] == 'table'
-        license_json = json_objects.pop['data']
-        packages = packages_from_json(license_json)
-      end
-
-      json_objects.each do |json_object|
-        match = /(?<name>[\w,\-]+)@(?<version>(\d+\.?)+)/ =~ json_object['data'].to_s
-        if match
-          package = YarnPackage.new(name, version, spec_licenses: ['unknown'])
-          incompatible_packages.push(package)
-        end
+      if yarn_version == 1
+        get_yarn1_packages(json_objects)
+      else
+        get_yarn_packages(json_objects)
       end
-
-      packages + incompatible_packages.uniq
     end
 
     def prepare
@@ -86,7 +80,7 @@ module LicenseFinder
 
     def yarn_version
       Dir.chdir(project_path) do
-        version_string, stderr_str, status = Cmd.run('yarn -v')
+        version_string, stderr_str, status = Dir.chdir(project_path) { Cmd.run('yarn -v') }
         raise "Command 'yarn -v' failed to execute: #{stderr_str}" unless status.success?
 
         version = version_string.split('.').map(&:to_i)
@@ -94,6 +88,61 @@ module LicenseFinder
       end
     end
 
+    def get_yarn_packages(json_objects)
+      packages = []
+      incompatible_packages = []
+      json_objects.each do |json_object|
+        license = json_object['value']
+        body = json_object['children']
+
+        body.each do |package_name, vendor_info|
+          valid_match = %r{(?<name>@?[\w/.-]+)@(?<manager>\D*):\D*(?<version>(\d+\.?)+)} =~ package_name.to_s
+          valid_match = %r{(?<name>@?[\w/.-]+)@virtual:.+#(\D*):\D*(?<version>(\d+\.?)+)} =~ package_name.to_s if manager.eql?('virtual')
+
+          if valid_match
+            homepage = vendor_info['children']['vendorUrl']
+            author = vendor_info['children']['vendorName']
+            package = YarnPackage.new(
+              name,
+              version,
+              spec_licenses: [license],
+              homepage: homepage,
+              authors: author,
+              install_path: project_path.join(modules_folder, name)
+            )
+            packages << package
+          end
+
+          incompatible_match = %r{(?<name>@?[\w/.-]+)@[a-z]*:(?<version>(\.))} =~ package_name.to_s
+          if incompatible_match
+            package = YarnPackage.new(name, version, spec_licenses: [license])
+            incompatible_packages.push(package)
+          end
+        end
+      end
+
+      packages + incompatible_packages.uniq
+    end
+
+    def get_yarn1_packages(json_objects)
+      packages = []
+      if json_objects.last['type'] == 'table'
+        license_json = json_objects.pop['data']
+        packages = packages_from_json(license_json)
+      end
+
+      incompatible_packages = []
+      json_objects.each do |json_object|
+        match = %r{(?<name>@?[\w/.-]+)@(?<version>(\d+\.?)+)} =~ json_object['data'].to_s
+        if match
+          package = YarnPackage.new(name, version, spec_licenses: ['unknown'])
+          incompatible_packages.push(package)
+        end
+      end
+
+      packages + incompatible_packages.uniq
+    end
+
     def packages_from_json(json_data)
       body = json_data['body']
       head = json_data['head']
@@ -119,7 +168,7 @@ module LicenseFinder
     def modules_folder
       return @modules_folder if @modules_folder
 
-      stdout, _stderr, status = Cmd.run('yarn config get modules-folder')
+      stdout, _stderr, status = Dir.chdir(project_path) { Cmd.run('yarn config get modules-folder') }
       @modules_folder = 'node_modules' if !status.success? || stdout.strip == 'undefined'
       @modules_folder ||= stdout.strip
     end

data/lib/license_finder/package_utils/conan_info_parser.rb

@@ -31,9 +31,9 @@ module LicenseFinder
     def parse_key_val(line)
       key, val = key_val(line)
       if val
-        @current_project[key] = val
+        @current_project[key.downcase] = val
       elsif line.start_with?(' ')
-        @current_key = key
+        @current_key = key.downcase
         @current_vals = []
         @state = :val_list
       else

data/lib/license_finder/package_utils/conan_info_parser_v2.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class ConanInfoParserV2
+    def parse(info)
+      @lines = info.lines.map(&:chomp)
+      @state = :project_level # state of the state machine
+      @projects = [] # list of projects
+      @current_project = nil # current project being populated in the SM
+      @current_vals = [] # current val list being populate in the SM
+      @current_key = nil # current key to be associated with the current val
+
+      line = @lines.shift
+      line = @lines.shift while line != '======== Basic graph information ========'
+
+      while (line = @lines.shift)
+        next if line == ''
+
+        case @state
+        when :project_level
+          @current_project = {}
+          name, _id = line.strip.split('#')
+          @current_project['name'] = name
+          @state = :key_val
+        when :key_val
+          parse_key_val(line)
+        when :val_list
+          parse_val_list(line)
+        end
+      end
+      wrap_up
+    end
+
+    private
+
+    def parse_key_val(line)
+      key, val = key_val(line)
+      if val
+        @current_project[key.downcase] = val
+      elsif line.start_with?(' ')
+        @current_key = key.downcase
+        @current_vals = []
+        @state = :val_list
+      else
+        change_to_new_project_state line
+      end
+    end
+
+    def parse_val_list(line)
+      if val_list_level(line)
+        @current_vals << line.strip
+      else
+        @current_project[@current_key] = @current_vals
+        if line.start_with?(' ')
+          @state = :key_val
+          @lines.unshift(line)
+        else
+          change_to_new_project_state line
+        end
+      end
+    end
+
+    def wrap_up
+      @current_project[@current_key] = @current_vals if @current_vals.count && @current_key
+      @projects << @current_project
+    end
+
+    def val_list_level(line)
+      line.start_with?('    ')
+    end
+
+    def change_to_new_project_state(line)
+      @state = :project_level
+      @projects << @current_project
+      @lines.unshift(line)
+    end
+
+    def key_val(info)
+      info.split(':', 2).map(&:strip!)
+    end
+  end
+end

data/lib/license_finder/package_utils/license_files.rb

@@ -27,7 +27,7 @@ module LicenseFinder
 
     def paths_of_candidate_files
       candidate_files_and_dirs
-        .flat_map { |path| path.directory? ? path.children : path }
+        .flat_map { |path| !path.is_a?(Zip::Entry) && path.directory? ? path.children : path }
         .reject(&:directory?)
         .uniq
     end
@@ -35,7 +35,17 @@ module LicenseFinder
     def candidate_files_and_dirs
       return [] if install_path.nil?
 
-      Pathname.glob(install_path.join('**', CANDIDATE_PATH_WILDCARD))
+      if !install_path.extname.casecmp('.jar').zero?
+        Pathname.glob(install_path.join('**', CANDIDATE_PATH_WILDCARD))
+      else
+        candidates_from_zip
+      end
+    end
+
+    def candidates_from_zip
+      Zip::File.open(install_path.to_s) do |zip_file|
+        zip_file.glob(CANDIDATE_PATH_WILDCARD, File::FNM_EXTGLOB)
+      end
     end
   end
 end

data/lib/license_finder/package_utils/licensing.rb

@@ -11,7 +11,8 @@ module LicenseFinder
       if activations_from_decisions.any? then activations_from_decisions
       elsif activations_from_spec.any?      then activations_from_spec
       elsif activations_from_files.any?     then activations_from_files
-      else [default_activation]
+      else
+        [default_activation]
       end
     end
 

data/lib/license_finder/package_utils/maven_dependency_finder.rb

@@ -2,14 +2,56 @@
 
 module LicenseFinder
   class MavenDependencyFinder
-    def initialize(project_path)
+    def initialize(project_path, m2_path)
       @project_path = project_path
+      @m2_path = m2_path
     end
 
     def dependencies
+      options = {
+        'GroupTags' => { 'licenses' => 'license', 'dependencies' => 'dependency' },
+        'ForceArray' => %w[license dependency]
+      }
+
       Pathname
         .glob(@project_path.join('**', 'target', 'generated-resources', 'licenses.xml'))
         .map(&:read)
+        .flat_map { |xml| XmlSimple.xml_in(xml, options)['dependencies'] }
+        .reject(&:empty?)
+        .each { |dep| add_info_from_m2(dep) }
+    end
+
+    # Add the name of the JAR file to allow later retrieval of license and notice files,
+    # and add the name, description and URL from the POM XML file.
+    def add_info_from_m2(dep)
+      m2_artifact_dir = @m2_path
+        .join(dep['groupId'].tr('.', '/'))
+        .join(dep['artifactId'])
+        .join(dep['version'])
+      artifact_basename = "#{dep['artifactId']}-#{dep['version']}"
+
+      # Basic support for Maven classifiers. So far, only "jakarta" is supported. Unfortunately,
+      # we do not have access to the "classifier" field here (licenses.xml does not have it).
+      jar_file = m2_artifact_dir.join("#{artifact_basename}.jar")
+      jar_file = m2_artifact_dir.join("#{artifact_basename}-jakarta.jar") unless File.exist?(jar_file)
+
+      dep.store('jarFile', jar_file)
+
+      add_info_from_pom(m2_artifact_dir.join("#{artifact_basename}.pom"), dep)
+    end
+
+    # Extract name, description and URL from pom.xml
+    def add_info_from_pom(pom_file, dep)
+      pom = XmlSimple.xml_in(pom_file.read, { 'ForceArray' => false })
+
+      name = pom['name']
+      dep.store('summary', name) unless name.nil?
+
+      description = pom['description']
+      dep.store('description', description) unless description.nil?
+
+      url = pom['url']
+      dep.store('homepage', url) unless url.nil?
     end
   end
 end

data/lib/license_finder/package_utils/notice_files.rb

@@ -5,7 +5,8 @@ require 'license_finder/package_utils/possible_license_file'
 module LicenseFinder
   class NoticeFiles
     CANDIDATE_FILE_NAMES = %w[NOTICE Notice].freeze
-    CANDIDATE_PATH_WILDCARD = "*{#{CANDIDATE_FILE_NAMES.join(',')}}*"
+    CANDIDATE_PATH_WILDCARD_STRICT = "{#{CANDIDATE_FILE_NAMES.join(',')}}*"
+    CANDIDATE_PATH_WILDCARD = "*#{CANDIDATE_PATH_WILDCARD_STRICT}"
 
     def self.find(install_path, options = {})
       new(install_path).find(options)
@@ -26,7 +27,7 @@ module LicenseFinder
 
     def paths_of_candidate_files
       candidate_files_and_dirs
-        .flat_map { |path| path.directory? ? path.children : path }
+        .flat_map { |path| !path.is_a?(Zip::Entry) && path.directory? ? path.children : path }
         .reject(&:directory?)
         .uniq
     end
@@ -34,7 +35,17 @@ module LicenseFinder
     def candidate_files_and_dirs
       return [] if install_path.nil?
 
-      Pathname.glob(install_path.join('**', CANDIDATE_PATH_WILDCARD))
+      if !install_path.extname.casecmp('.jar').zero?
+        Pathname.glob(install_path.join('**', CANDIDATE_PATH_WILDCARD))
+      else
+        candidates_from_zip
+      end
+    end
+
+    def candidates_from_zip
+      Zip::File.open(install_path.to_s) do |zip_file|
+        zip_file.glob("*/#{CANDIDATE_PATH_WILDCARD_STRICT}", File::FNM_EXTGLOB)
+      end
     end
   end
 end

data/lib/license_finder/package_utils/possible_license_file.rb

@@ -3,7 +3,11 @@
 module LicenseFinder
   class PossibleLicenseFile
     def initialize(path, options = {})
-      @path = Pathname(path)
+      if !path.is_a?(Zip::Entry)
+        @path = Pathname(path)
+      else
+        @zip_entry = path
+      end
       @logger = options[:logger]
     end
 
@@ -16,7 +20,9 @@ module LicenseFinder
     end
 
     def text
-      if @path.exist?
+      if @zip_entry
+        @zip_entry.get_input_stream.read
+      elsif @path.exist?
         @text ||= (@path.respond_to?(:binread) ? @path.binread : @path.read)
       else
         @logger.info('ERROR', "#{@path} does not exists", color: :red)

data/lib/license_finder/package_utils/pypi.rb

@@ -25,7 +25,9 @@ module LicenseFinder
       def definition(name, version)
         response = request("https://pypi.org/pypi/#{name}/#{version}/json")
         response.is_a?(Net::HTTPSuccess) ? JSON.parse(response.body).fetch('info', {}) : {}
-      rescue *CONNECTION_ERRORS
+      rescue *CONNECTION_ERRORS => e
+        raise e, "Unable to read package from pypi.org #{name} #{version}: #{e}" unless @prepare_no_fail
+
         {}
       end
 

data/lib/license_finder/packages/maven_package.rb

@@ -5,13 +5,17 @@ module LicenseFinder
     def initialize(spec, options = {})
       name = spec['artifactId']
       name = "#{spec['groupId']}:#{name}" if options[:include_groups]
+      @jar_file = spec['jarFile']
 
       super(
         name,
         spec['version'],
         options.merge(
           spec_licenses: Array(spec['licenses']).map { |l| l['name'] },
-          groups: Array(spec['groupId'])
+          groups: Array(spec['groupId']),
+          summary: spec['summary'],
+          description: spec['description'],
+          homepage: spec['homepage']
         )
       )
     end
@@ -23,5 +27,13 @@ module LicenseFinder
     def package_url
       "https://search.maven.org/artifact/#{CGI.escape(groups.first)}/#{CGI.escape(name.split(':').last)}/#{CGI.escape(version)}/jar"
     end
+
+    def license_files
+      LicenseFiles.find(@jar_file, logger: logger)
+    end
+
+    def notice_files
+      NoticeFiles.find(@jar_file, logger: logger)
+    end
   end
 end

data/lib/license_finder/packages/npm_package.rb

@@ -23,12 +23,12 @@ module LicenseFinder
       def flattened_dependencies(npm_json, existing_packages = {})
         identifier = Identifier.from_hash npm_json
         if existing_packages[identifier].nil?
-          existing_packages[identifier] = NpmPackage.new(npm_json) if identifier
+          existing_packages[identifier] = package_for_dependency(npm_json) if identifier
           npm_json.fetch('dependencies', {}).values.map do |d|
             flattened_dependencies(d, existing_packages)
           end
         else
-          duplicate_package = NpmPackage.new(npm_json)
+          duplicate_package = package_for_dependency(npm_json)
           unless existing_packages[identifier].dependencies.include?(duplicate_package.dependencies)
             existing_packages[identifier].dependencies |= duplicate_package.dependencies
             npm_json.fetch('dependencies', {}).values.map do |d|
@@ -39,6 +39,23 @@ module LicenseFinder
         existing_packages
       end
 
+      # Read the dependency's package.json file in order to get details like the license, authors,
+      # and so on. In NPM versions < 7, this information was included in the output of `npm list`.
+      # In later versions, it no longer is, and has to be read from the package.json file instead.
+      def package_for_dependency(npm_json)
+        package_path = npm_json['path']
+        package_json_path = Pathname.new(package_path).join('package.json') unless package_path.nil?
+
+        if package_json_path.nil? || !package_json_path.exist?
+          # Ancient NPM versions did not have the "path" field. Resort to the old way of gathering
+          # the details, expecting them to be contained in the output of `npm list`.
+          NpmPackage.new(npm_json)
+        else
+          package_json = JSON.parse(package_json_path.read, max_nesting: false)
+          NpmPackage.new(npm_json, package_json)
+        end
+      end
+
       def populate_groups(package_json)
         package_json.groups.each do |group|
           group.package_names.each do |package_name|
@@ -64,19 +81,49 @@ module LicenseFinder
       end
     end
 
-    def initialize(npm_json)
-      @json = npm_json
+    def initialize(npm_json, package_json = npm_json)
+      @npm_json = npm_json
+      @json = package_json
       @identifier = Identifier.from_hash(npm_json)
       @dependencies = deps_from_json
       super(@identifier.name,
             @identifier.version,
-            description: npm_json['description'],
-            homepage: npm_json['homepage'],
-            spec_licenses: Package.license_names_from_standard_spec(npm_json),
+            description: package_json['description'],
+            homepage: package_json['homepage'],
+            authors: author_names,
+            spec_licenses: Package.license_names_from_standard_spec(package_json),
             install_path: npm_json['path'],
             children: @dependencies.map(&:name))
     end
 
+    def author_names
+      names = []
+      if @json['author'].is_a?(Array)
+        # "author":["foo","bar"] isn't valid according to the NPM package.json schema, but can be found in the wild.
+        names += @json['author'].map { |a| author_name(a) }
+      else
+        names << author_name(@json['author']) unless @json['author'].nil?
+      end
+      names += @json['contributors'].map { |c| author_name(c) } if @json['contributors'].is_a?(Array)
+      names.compact.join(', ')
+    rescue TypeError
+      puts "Warning: Invalid author and/or contributors metadata found in package.json for #{@identifier}"
+      nil
+    end
+
+    def author_name(author)
+      if author.instance_of?(String)
+        author_name_from_combined(author)
+      else
+        author['name']
+      end
+    end
+
+    def author_name_from_combined(author)
+      matches = author.match /^(.*?)\s*(<.*?>)?\s*(\(.*?\))?\s*$/
+      matches[1]
+    end
+
     def ==(other)
       other.is_a?(NpmPackage) && @identifier == other.identifier
     end
@@ -96,7 +143,7 @@ module LicenseFinder
     private
 
     def deps_from_json
-      @json.fetch('dependencies', {}).values.map { |dep| Identifier.from_hash(dep) }.compact
+      @npm_json.fetch('dependencies', {}).values.map { |dep| Identifier.from_hash(dep) }.compact
     end
 
     class Identifier
@@ -110,7 +157,7 @@ module LicenseFinder
       def self.from_hash(hash)
         name = hash['name']
         version = hash['version']
-        return nil if name.nil? || version.nil?
+        return nil if name.nil? || name.empty? || version.nil? || version.empty?
 
         Identifier.new(name, version)
       end

data/lib/license_finder/packages/pnpm_package.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class PNPMPackage < Package
+    def package_manager
+      'PNPM'
+    end
+
+    def package_url
+      "https://www.npmjs.com/package/#{CGI.escape(name)}/v/#{CGI.escape(version)}"
+    end
+  end
+end

data/lib/license_finder/printer.rb

@@ -4,7 +4,7 @@ module LicenseFinder
   class Printer
     attr_reader :padding
 
-    def initialize #:nodoc:
+    def initialize # :nodoc:
       @base = nil
       @mute = false
       @padding = 0
@@ -24,7 +24,7 @@ module LicenseFinder
       spaces + set_color(message.to_s, *color)
     end
 
-    def set_color(string, *) #:nodoc:
+    def set_color(string, *) # :nodoc:
       string
     end
 

data/lib/license_finder/reports/csv_report.rb

@@ -4,7 +4,7 @@ module LicenseFinder
   class CsvReport < Report
     COMMA_SEP = ','.freeze
     NEWLINE_SEP = '\@NL'.freeze
-    AVAILABLE_COLUMNS = %w[name version authors licenses license_links approved summary description homepage install_path package_manager groups texts notice].freeze
+    AVAILABLE_COLUMNS = %w[name version authors licenses license_links approved summary description homepage install_path package_manager groups texts notice approved_by approved_reason].freeze
     MISSING_DEPENDENCY_TEXT = 'This package is not installed. Please install to determine licenses.'.freeze
 
     def initialize(dependencies, options)
@@ -95,5 +95,14 @@ module LicenseFinder
         dep.groups.join(self.class::COMMA_SEP)
       end
     end
+
+    def format_approved_by(dep)
+      dep.approved_manually? ? dep.manual_approval.who : ''
+    end
+
+    def format_approved_reason(dep)
+      dep.approved_manually? ? dep.manual_approval.why : ''
+    end
+
   end
 end

data/lib/license_finder/scanner.rb

@@ -3,7 +3,7 @@
 module LicenseFinder
   class Scanner
     PACKAGE_MANAGERS = [
-      GoModules, GoDep, GoWorkspace, Go15VendorExperiment, Glide, Gvt, Govendor, Trash, Dep, Bundler, NPM, Pip,
+      GoModules, GoDep, GoWorkspace, Go15VendorExperiment, Glide, Gvt, Govendor, Trash, Bundler, NPM, PNPM, Pip,
       Yarn, Bower, Maven, Gradle, CocoaPods, Rebar, Erlangmk, Nuget, Carthage, Mix, Conan, Sbt, Cargo, Dotnet, Composer, Pipenv,
       Conda, Spm, Pub
     ].freeze
@@ -50,10 +50,10 @@ module LicenseFinder
         active = pm_class.new(@config).active?
 
         if active
-          @logger.info pm_class, 'is active', color: :green
+          @logger.info pm_class, "is active for '#{@project_path}'", color: :green
           active_pm_classes << pm_class
         else
-          @logger.debug pm_class, 'is not active', color: :red
+          @logger.debug pm_class, "is not active for '#{@project_path}'", color: :red
         end
       end
 

data/license_finder.gemspec

@@ -3,7 +3,7 @@
 version = File.read(File.expand_path('VERSION', __dir__)).strip
 
 Gem::Specification.new do |s|
-  s.required_ruby_version = '>= 2.4.0'
+  s.required_ruby_version = '>= 2.6.0'
   s.name        = 'license_finder'
   s.version     = version
 
@@ -44,30 +44,31 @@ Gem::Specification.new do |s|
   s.license = 'MIT'
 
   s.add_dependency 'bundler'
+  s.add_dependency 'csv', '~> 3.2'
   s.add_dependency 'rubyzip', '>=1', '<3'
   s.add_dependency 'thor', '~> 1.2'
   s.add_dependency 'tomlrb', '>= 1.3', '< 2.1'
   s.add_dependency 'with_env', '1.1.0'
   s.add_dependency 'xml-simple', '~> 1.1.9'
 
-  s.add_development_dependency 'addressable', '2.8.0'
-  s.add_development_dependency 'capybara', '~> 3.32.2'
+  s.add_development_dependency 'addressable', '2.8.6'
+  s.add_development_dependency 'capybara', '~> 3.39.2'
   s.add_development_dependency 'cocoapods', '>= 1.0.0' if RUBY_PLATFORM.match?(/darwin/)
   s.add_development_dependency 'e2mmap', '~> 0.1.0'
-  s.add_development_dependency 'fakefs', '~> 1.4.1'
-  s.add_development_dependency 'matrix', '~> 0.1.0'
-  s.add_development_dependency 'mime-types', '3.4.1'
+  s.add_development_dependency 'fakefs', '~> 2.5.0'
+  s.add_development_dependency 'matrix', '~> 0.4.2'
+  s.add_development_dependency 'mime-types', '3.5.2'
   s.add_development_dependency 'pry', '~> 0.14.1'
-  s.add_development_dependency 'rake', '~> 13.0.6'
+  s.add_development_dependency 'rake', '~> 13.1.0'
   s.add_development_dependency 'rspec', '~> 3'
   s.add_development_dependency 'rspec-its', '~> 1.3.0'
-  s.add_development_dependency 'rubocop', '~> 1.12.1'
-  s.add_development_dependency 'rubocop-performance', '~> 1.10.2'
+  s.add_development_dependency 'rubocop', '~> 1.60.2'
+  s.add_development_dependency 'rubocop-performance', '~> 1.20.2'
   s.add_development_dependency 'webmock', '~> 3.14'
 
   s.add_development_dependency 'nokogiri', '~>1.10'
-  s.add_development_dependency 'rack', '~> 2.2.3'
-  s.add_development_dependency 'rack-test', '~> 1.1.0', '> 0.7'
+  s.add_development_dependency 'rack', '~> 3.0.0'
+  s.add_development_dependency 'rack-test', '> 0.7', '~> 2.1.0'
 
   s.files         = `git ls-files`.split("\n").reject { |f| f.start_with?('spec', 'features') }
   s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }