licensed 3.4.0 → 3.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3cb5bf8c20bf1177466536fbc30bc29135a9e76933e225af8353ba8eb89205d
-  data.tar.gz: 26acda6f4b9d90c2457725ecda8f0b00bc7fc793a4993a1e6aa9a6810a995d04
+  metadata.gz: f3f8fc2f5685cca01401bb63373518883d8f3e0cd6d27861a73eb2246d6ab8b5
+  data.tar.gz: fca0431aeb3401f17e78fccff82547315504597b1eab54699c1529c6fbacf2c7
 SHA512:
-  metadata.gz: 5d71df74f6fca5c309230b18a7423f608cdf61ca0a5ddf9f45116b75681196a15ecee70d4d56877841b82c1d75d43fa573182ec300f1976a1e815f169de1598f
-  data.tar.gz: 645c4bf3cbb162e46061b730f947f0299336506fa425640f215e0e96ccb89124ef0e8a9725e6b9044fcd1c8e38c8809b7f5a911479d6583cc097b15d1f4a48c3
+  metadata.gz: 575c5efa3e3b4c3a8bed98094372f61f4977ae9e5b023d155041cab5fd7a410d043b9fa31df20ea5084525251cd69d70474cc107b5b5f7c6e3bb08135d937187
+  data.tar.gz: e3fdbeced907154eb4b9511aefd263f8cf5b188e8360e039ee419496a5c9372ece14f63c59524638f27164cef0bd636e5ccbccaa196e89e117460f7e5faafaa6

data/CHANGELOG.md

@@ -6,6 +6,38 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## 3.4.4
+
+2022-02-07
+
+### Fixed
+
+- The npm and pip sources have better protection from strings causing crashes in `Hash#dig` (https://github.com/github/licensed/pull/450)
+
+## 3.4.3
+
+2022-01-31
+
+### Added
+
+- The npm source handles more cases of missing, optional, peer dependencies (https://github.com/github/licensed/pull/443)
+
+## 3.4.2
+
+2022-01-17
+
+### Fixed
+
+- The yarn source will no longer evaluate package.json files that do not represent project dependencies (https://github.com/github/licensed/pull/439)
+
+## 3.4.1
+
+2022-01-07
+
+### Fixed
+
+- Malformed package.json files will no longer crash yarn dependency detection (https://github.com/github/licensed/pull/431)
+
 ## 3.4.0
 
 2021-12-14
@@ -539,4 +571,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 Initial release :tada:
 
-[Unreleased]: https://github.com/github/licensed/compare/3.4.0...HEAD
+[Unreleased]: https://github.com/github/licensed/compare/3.4.4...HEAD

data/Rakefile

@@ -62,6 +62,7 @@ namespace :test do
     t.libs << "lib"
     t.test_files = FileList["test/**/*_test.rb"].exclude("test/fixtures/**/*_test.rb")
                                                 .exclude("test/sources/*_test.rb")
+                                                .exclude("test/sources/**/*_test.rb")
   end
 end
 

data/docs/commands/status.md

@@ -39,30 +39,34 @@ The following data is reported for each dependency when the YAML or JSON report
 
 ### cached dependency record not found
 
-**Cause:** A dependency was found while running `licensed status` that does not have a corresponding cached metadata file
-**Resolution:** Run `licensed cache` to update the metadata cache and create the missing metadata file
+*Cause:* A dependency was found while running `licensed status` that does not have a corresponding cached metadata file
+
+*Resolution:* Run `licensed cache` to update the metadata cache and create the missing metadata file
 
 ### cached dependency record out of date
 
-**Cause:** A dependency was found while running `licensed status` with a different version than is contained in the dependency's cached metadata file
-**Resolution:** Run `licensed cache` to update the out-of-date metadata files
+*Cause:* A dependency was found while running `licensed status` with a different version than is contained in the dependency's cached metadata file
+
+*Resolution:* Run `licensed cache` to update the out-of-date metadata files
 
 ### missing license text
 
-**Cause:** A license determination was made, e.g. from package metadata, but no license text was found.
-**Resolution:** Manually verify whether the dependency includes a file containing license text.  If the dependency code that was downloaded locally does not contain the license text, please check the dependency source at the version listed in the dependency's cached metadata file to see if there is license text that can be used.
+*Cause:* A license determination was made, e.g. from package metadata, but no license text was found.
+
+*Resolution:* Manually verify whether the dependency includes a file containing license text.  If the dependency code that was downloaded locally does not contain the license text, please check the dependency source at the version listed in the dependency's cached metadata file to see if there is license text that can be used.
 
 If the dependency does not include license text but does specify that it uses a specific license, please copy the standard license text from a [well known source](https://opensource.org/licenses).
 
 ### license text has changed and needs re-review. if the new text is ok, remove the `review_changed_license` flag from the cached record
 
-**Cause:** A dependency that is set as [reviewed] in the licensed configuration file has substantially changed and should be re-reviewed.
-**Resolution:** Review the changes to the license text and classification, along with other metadata contained in the cached file for the dependency.  If the dependency is still allowable for use in your project, remove the `review_changed_license` key from the cached record file.
+*Cause:* A dependency that is set as [reviewed] in the licensed configuration file has substantially changed and should be re-reviewed.
+
+*Resolution:* Review the changes to the license text and classification, along with other metadata contained in the cached file for the dependency.  If the dependency is still allowable for use in your project, remove the `review_changed_license` key from the cached record file.
 
 ### license needs review
 
-**Cause:** A dependency is using a license that is not in the configured [allowed list of licenses][allowed], and the dependency has not been marked [ignored] or [reviewed].
-**Resolution:** Review the dependency's usage and specified license with someone familiar with OSS licensing and compliance rules to determine whether the dependency is allowable.  Some common resolutions:
+*Cause:* A dependency is using a license that is not in the configured [allowed list of licenses][allowed], and the dependency has not been marked [ignored] or [reviewed].
+*Resolution:* Review the dependency's usage and specified license with someone familiar with OSS licensing and compliance rules to determine whether the dependency is allowable.  Some common resolutions:
 
 1. The dependency's specified license text differed enough from the standard license text that it was not recognized and classified as `other`.  If, with human review, the license text is recognizable then update the `license: other` value in the cached metadata file to the correct license.
    - An updated classification will persist through version upgrades until the detected license contents have changed.  The determination is made by [licensee/licensee](https://github.com/licensee/licensee), the library which this tool uses to detect and classify license contents.

data/docs/sources/pip.md

@@ -20,5 +20,5 @@ You have to add this setting to your licensed configuration file.
 An example usage of this might look like:
 ```yaml
 python:
-    virtual_env_dir:"/path/to/your/venv_dir"
+    virtual_env_dir: "/path/to/your/venv_dir"
 ```

data/lib/licensed/sources/npm.rb

@@ -135,11 +135,25 @@ module Licensed
       end
 
       def missing_peer?(parent, dependency, name)
-        dependency["peerMissing"] || (dependency["missing"] && peer_dependency(parent, name))
+        # return true if dependency is marked as "peerMissing"
+        return true if dependency["peerMissing"]
+
+        # return false unless the parent has registered the dependency
+        # as a peer
+        return false unless peer_dependency(parent, name)
+        # return true if the dependency itself is marked as missing
+        return true if dependency["missing"]
+        dependency.empty? && parent&.dig("peerDependenciesMeta", name, "optional")
       end
 
       def peer_dependency(parent, name)
-        parent&.dig("peerDependencies", name)
+        return unless parent.is_a?(Hash)
+
+        peerDependencies = parent["peerDependencies"]
+        # "peerDependencies" could be set to the string "[Circular]"
+        return unless peerDependencies.is_a?(Hash)
+
+        peerDependencies[name]
       end
 
       def extract_version(parent, name)

data/lib/licensed/sources/pip.rb

@@ -63,7 +63,10 @@ module Licensed
       def virtual_env_dir
         return @virtual_env_dir if defined?(@virtual_env_dir)
         @virtual_env_dir = begin
-          venv_dir = config.dig("python", "virtual_env_dir")
+          python_config = config["python"]
+          return unless python_config.is_a?(Hash)
+
+          venv_dir = python_config["virtual_env_dir"]
           File.expand_path(venv_dir, config.root) if venv_dir
         end
       end

data/lib/licensed/sources/yarn/berry.rb

@@ -32,7 +32,7 @@ module Licensed
         mapped_packages = yarn_info.reduce({}) do |accum, package|
           name, _ = package["value"].rpartition("@")
           version = package.dig("children", "Version")
-          id = "#{name}-#{version}"
+          id = "#{name}@#{version}"
 
           accum[name] ||= []
           accum[name] << {
@@ -59,16 +59,6 @@ module Licensed
         end
       end
 
-      # Returns a hash that maps all dependency names to their location on disk
-      # by parsing every package.json file under node_modules.
-      def dependency_paths
-        @dependency_paths ||= Dir.glob(config.pwd.join("node_modules/**/package.json")).each_with_object({}) do |file, hsh|
-          dirname = File.dirname(file)
-          json = JSON.parse(File.read(file))
-          hsh["#{json["name"]}-#{json["version"]}"] = dirname
-        end
-      end
-
       # Returns the output from running `yarn list` to get project dependencies
       def yarn_info_command
         args = %w(--json --manifest --recursive --all)

data/lib/licensed/sources/yarn/v1.rb

@@ -73,16 +73,6 @@ module Licensed
         result
       end
 
-      # Returns a hash that maps all dependency names to their location on disk
-      # by parsing every package.json file under node_modules.
-      def dependency_paths
-        @dependency_paths ||= Dir.glob(config.pwd.join("node_modules/**/package.json")).each_with_object({}) do |file, hsh|
-          dirname = File.dirname(file)
-          json = JSON.parse(File.read(file))
-          hsh["#{json["name"]}@#{json["version"]}"] = dirname
-        end
-      end
-
       # Finds and returns the yarn package tree listing from `yarn list` output
       def yarn_package_tree
         return @yarn_package_tree if defined?(@yarn_package_tree)

data/lib/licensed/sources/yarn.rb

@@ -23,6 +23,25 @@ module Licensed
       def yarn_version
         Gem::Version.new(Licensed::Shell.execute("yarn", "-v"))
       end
+
+      # Returns a hash that maps all dependency names to their location on disk
+      # by parsing every package.json file under node_modules.
+      def dependency_paths
+        @dependency_paths ||= [
+            *Dir.glob(config.pwd.join("**/node_modules/*/package.json")),
+            *Dir.glob(config.pwd.join("**/node_modules/@*/*/package.json"))
+          ].each_with_object({}) do |file, hsh|
+          begin
+            dirname = File.dirname(file)
+            json = JSON.parse(File.read(file))
+            hsh["#{json["name"]}@#{json["version"]}"] = dirname
+          rescue JSON::ParserError
+            # don't crash execution if there is a problem parsing a package.json file
+            # if the bad package.json file relates to a package that licensed should be reporting on
+            # then this will still result in an error about a missing package
+          end
+        end
+      end
     end
   end
 end

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "3.4.0".freeze
+  VERSION = "3.4.4".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 3.4.0
+  version: 3.4.4
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-12-14 00:00:00.000000000 Z
+date: 2022-02-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee