licensed 3.4.2 → 3.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d7cec159ef0a5af9df07ac13ba8f540897d1039436d39d361ad2948f305f857
-  data.tar.gz: 1e7b7b50ee7715c41e0b5774104039e471be2d749645a38265d3930d51cd81ab
+  metadata.gz: d2fafd3b11ba6f63760979021e1628aa1d4ae0e0cd5b0b413b06c6163a1b64fd
+  data.tar.gz: d5fe530e59e0091b44f0ae08403f72707f6dc4db391a6d7e39e4b620c01b1da9
 SHA512:
-  metadata.gz: 5c32f95d211dece04fea6c8dff48525593a8348d36dea980f0815159922b5b813270d0ac8b4f6425a9cbcf9437cbf145693f18411b733c917f56ef1b495cca77
-  data.tar.gz: '095b85ceea926a975b18b8001bebca68343dba8550ed2533ccc7eb3860424f707b0756cc121e8c6ad2fc7715c734232f43175513e5005a5c6f535551c3831f6f'
+  metadata.gz: a2b691823b7cbc692fb155bc672772fea156932a3d7d38111634927a0babf427343f992eded7d219041575e64e698a9821fdf1e9e12390f8e29a2c95a42e340a
+  data.tar.gz: 61872b213231ead8c7ce5d209af8332964e8562e8809dbbf7c3e5fd95b84cfffcc7b9c4391f0e81d6e094325293bbe61520458d4cc1233072f4b0c41b04cd165

data/CHANGELOG.md

@@ -6,6 +6,30 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## 3.5.0
+
+2022-02-24
+
+### Added
+
+- [Licensee](https://github.com/licensee/licensee) confidence thresholds can be configured in the licensed configuration file (https://github.com/github/licensed/pull/455)
+
+## 3.4.4
+
+2022-02-07
+
+### Fixed
+
+- The npm and pip sources have better protection from strings causing crashes in `Hash#dig` (https://github.com/github/licensed/pull/450)
+
+## 3.4.3
+
+2022-01-31
+
+### Added
+
+- The npm source handles more cases of missing, optional, peer dependencies (https://github.com/github/licensed/pull/443)
+
 ## 3.4.2
 
 2022-01-17
@@ -555,4 +579,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 Initial release :tada:
 
-[Unreleased]: https://github.com/github/licensed/compare/3.4.2...HEAD
+[Unreleased]: https://github.com/github/licensed/compare/3.4.4...HEAD

data/docs/configuration/customizing_licensee.md

@@ -0,0 +1,13 @@
+# Customize Licensee's behavior
+
+Licensed uses [Licensee](https://github.com/licensee/licensee) to detect and evaluate OSS licenses for project dependencies found during source enumeration.  Licensed can optionally [customize Licensee's behavior](https://github.com/licensee/licensee/blob/jonabc-patch-1/docs/customizing.md#customizing-licensees-behavior) based on options set in the configuration file.
+
+**NOTE** Matching licenses based on package manager metadata and README references is always enabled and cannot currently be configured.
+
+```yml
+licensee:
+  # the confidence threshold is an integer between 1 and 100. the value represents
+  # the minimum percentage confidence that Licensee must have to report a matched license
+  # https://github.com/licensee/licensee/blob/jonabc-patch-1/docs/customizing.md#adjusting-the-confidence-threshold
+  confidence_threshold: 90 # default value: 98
+```

data/docs/configuration.md

@@ -4,7 +4,7 @@ A configuration file specifies the details of enumerating and operating on licen
 
 Configuration can be specified in either YML or JSON formats, with examples given in YML.  The example
 below describes common configuration values and their purposes.  See [configuration options documentation](./configuration)
-for in depth information.  
+for in depth information.
 
 Additionally, some dependency sources have their own specific configuration options.  See the [source documentation](./sources) for details.
 

data/docs/sources/npm.md

@@ -4,7 +4,7 @@ The npm source will detect dependencies `package.json` is found at an apps `sour
 
 ### Including development dependencies
 
-By default, the npm source will exclude all non-development dependencies.  To include development or test dependencies, set `production_only: false` in the licensed configuration.
+By default, the npm source will exclude all development dependencies. To include development or test dependencies, set `production_only: false` in the licensed configuration.
 
 ```yml
 npm:

data/docs/sources/pip.md

@@ -20,5 +20,5 @@ You have to add this setting to your licensed configuration file.
 An example usage of this might look like:
 ```yaml
 python:
-    virtual_env_dir:"/path/to/your/venv_dir"
+    virtual_env_dir: "/path/to/your/venv_dir"
 ```

data/lib/licensed/commands/cache.rb

@@ -29,6 +29,18 @@ module Licensed
         files.clear
       end
 
+      # Run the command for an application configurations.
+      # Applies a licensee configuration for the duration of the operation.
+      #
+      # report - A Licensed::Report object for this command
+      #
+      # Returns whether the command succeeded
+      def run_app(app, report)
+        with_licensee_configuration(app, report) do
+          super
+        end
+      end
+
       # Run the command for all enumerated dependencies found in a dependency source,
       # recording results in a report.
       # Enumerating dependencies in the source is skipped if a :sources option
@@ -136,6 +148,22 @@ module Licensed
       def files
         @files ||= Set.new
       end
+
+      # Configure licensee for the duration of a yielded operation
+      def with_licensee_configuration(app, report)
+        licensee_configuration = app["licensee"]
+        return yield unless licensee_configuration
+
+        report["licensee"] = licensee_configuration
+
+        if new_threshold = licensee_configuration["confidence_threshold"]
+          old_threshold, Licensee.confidence_threshold = Licensee.confidence_threshold, new_threshold
+        end
+
+        yield
+      ensure
+        Licensee.confidence_threshold = old_threshold if old_threshold
+      end
     end
   end
 end

data/lib/licensed/sources/npm.rb

@@ -135,11 +135,25 @@ module Licensed
       end
 
       def missing_peer?(parent, dependency, name)
-        dependency["peerMissing"] || (dependency["missing"] && peer_dependency(parent, name))
+        # return true if dependency is marked as "peerMissing"
+        return true if dependency["peerMissing"]
+
+        # return false unless the parent has registered the dependency
+        # as a peer
+        return false unless peer_dependency(parent, name)
+        # return true if the dependency itself is marked as missing
+        return true if dependency["missing"]
+        dependency.empty? && parent&.dig("peerDependenciesMeta", name, "optional")
       end
 
       def peer_dependency(parent, name)
-        parent&.dig("peerDependencies", name)
+        return unless parent.is_a?(Hash)
+
+        peerDependencies = parent["peerDependencies"]
+        # "peerDependencies" could be set to the string "[Circular]"
+        return unless peerDependencies.is_a?(Hash)
+
+        peerDependencies[name]
       end
 
       def extract_version(parent, name)

data/lib/licensed/sources/pip.rb

@@ -63,7 +63,10 @@ module Licensed
       def virtual_env_dir
         return @virtual_env_dir if defined?(@virtual_env_dir)
         @virtual_env_dir = begin
-          venv_dir = config.dig("python", "virtual_env_dir")
+          python_config = config["python"]
+          return unless python_config.is_a?(Hash)
+
+          venv_dir = python_config["virtual_env_dir"]
           File.expand_path(venv_dir, config.root) if venv_dir
         end
       end

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "3.4.2".freeze
+  VERSION = "3.5.0".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

data/licensed.gemspec

@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
 
   spec.required_ruby_version = ">= 2.3.0"
 
-  spec.add_dependency "licensee", ">= 9.14.0", "< 10.0.0"
+  spec.add_dependency "licensee", ">= 9.15.2", "< 10.0.0"
   spec.add_dependency "thor", ">= 0.19"
   spec.add_dependency "pathname-common_prefix", "~> 0.0.1"
   spec.add_dependency "tomlrb", ">= 1.2", "< 3.0"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 3.4.2
+  version: 3.5.0
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-01-17 00:00:00.000000000 Z
+date: 2022-02-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee
@@ -16,7 +16,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 9.14.0
+        version: 9.15.2
     - - "<"
       - !ruby/object:Gem::Version
         version: 10.0.0
@@ -26,7 +26,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 9.14.0
+        version: 9.15.2
     - - "<"
       - !ruby/object:Gem::Version
         version: 10.0.0
@@ -261,6 +261,7 @@ files:
 - docs/configuration/application_source.md
 - docs/configuration/configuration_root.md
 - docs/configuration/configuring_multiple_apps.md
+- docs/configuration/customizing_licensee.md
 - docs/configuration/dependency_source_enumerators.md
 - docs/configuration/ignoring_dependencies.md
 - docs/configuration/metadata_cache.md