licensed 5.0.2 → 5.0.4

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    licensed (5.0.2)
+    licensed (5.0.4)
       csv (~> 3.3)
       json (~> 2.6)
       licensee (~> 9.16)
@@ -15,113 +15,124 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.1.3.2)
+    activesupport (7.2.2.1)
       base64
+      benchmark (>= 0.3)
       bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.0.2)
+      concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
       minitest (>= 5.1)
-      mutex_m
-      tzinfo (~> 2.0)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
     ast (2.4.2)
     base64 (0.2.0)
-    bigdecimal (3.1.7)
-    byebug (11.1.3)
-    concurrent-ruby (1.2.3)
-    connection_pool (2.4.1)
-    csv (3.3.2)
-    dotenv (3.1.4)
+    benchmark (0.4.0)
+    bigdecimal (3.1.9)
+    byebug (12.0.0)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.0)
+    csv (3.3.4)
+    dotenv (3.1.7)
     drb (2.2.1)
-    faraday (2.12.1)
+    faraday (2.12.2)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
     faraday-net_http (3.4.0)
       net-http (>= 0.5.0)
-    i18n (1.14.4)
+    i18n (1.14.7)
       concurrent-ruby (~> 1.0)
-    json (2.9.1)
+    json (2.11.3)
+    language_server-protocol (3.17.0.4)
     licensee (9.18.0)
       dotenv (>= 2, < 4)
       octokit (>= 4.20, < 10.0)
       reverse_markdown (>= 1, < 4)
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
-    logger (1.6.1)
+    lint_roller (1.1.0)
+    logger (1.6.6)
     mini_portile2 (2.8.8)
-    minitest (5.25.4)
+    minitest (5.25.5)
     minitest-hooks (1.5.2)
       minitest (> 5.3)
     mocha (2.7.1)
       ruby2_keywords (>= 0.0.5)
-    mutex_m (0.2.0)
-    net-http (0.5.0)
+    net-http (0.6.0)
       uri
-    nokogiri (1.16.7)
+    nokogiri (1.18.8)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     octokit (9.2.0)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
-    parallel (1.26.3)
-    parser (3.2.0.0)
+    parallel (1.27.0)
+    parser (3.3.7.1)
       ast (~> 2.4.1)
+      racc
     pathname-common_prefix (0.0.2)
     public_suffix (6.0.1)
     racc (1.8.1)
-    rack (3.0.9.1)
+    rack (3.1.12)
     rainbow (3.1.1)
     rake (13.2.1)
-    regexp_parser (2.6.2)
+    regexp_parser (2.10.0)
     reverse_markdown (3.0.0)
       nokogiri
-    rexml (3.3.9)
-    rubocop (1.45.1)
+    rubocop (1.73.2)
       json (~> 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
       parallel (~> 1.10)
-      parser (>= 3.2.0.0)
+      parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.24.1, < 2.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.38.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.24.1)
-      parser (>= 3.1.1.0)
-    rubocop-github (0.20.0)
-      rubocop (>= 1.37)
-      rubocop-performance (>= 1.15)
-      rubocop-rails (>= 2.17)
-    rubocop-performance (1.15.2)
-      rubocop (>= 1.7.0, < 2.0)
-      rubocop-ast (>= 0.4.0)
-    rubocop-rails (2.18.0)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.38.1)
+      parser (>= 3.3.1.0)
+    rubocop-github (0.23.0)
+      rubocop (>= 1.72)
+      rubocop-performance (>= 1.24)
+      rubocop-rails (>= 2.23)
+    rubocop-performance (1.24.0)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.72.1, < 2.0)
+      rubocop-ast (>= 1.38.0, < 2.0)
+    rubocop-rails (2.30.3)
       activesupport (>= 4.2.0)
+      lint_roller (~> 1.1)
       rack (>= 1.1)
-      rubocop (>= 1.33.0, < 2.0)
-    ruby-progressbar (1.11.0)
+      rubocop (>= 1.72.1, < 2.0)
+      rubocop-ast (>= 1.38.0, < 2.0)
+    ruby-progressbar (1.13.0)
     ruby-xxHash (0.4.0.2)
     ruby2_keywords (0.0.5)
-    rugged (1.7.2)
+    rugged (1.9.0)
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
+    securerandom (0.4.1)
     thor (1.3.2)
     tomlrb (2.0.3)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    unicode-display_width (2.4.2)
-    uri (1.0.2)
+    unicode-display_width (3.1.4)
+      unicode-emoji (~> 4.0, >= 4.0.4)
+    unicode-emoji (4.0.4)
+    uri (1.0.3)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  byebug (~> 11.1)
+  byebug (~> 12.0)
   licensed!
   minitest (~> 5.17)
   minitest-hooks (~> 1.5)

data/lib/licensed/configuration.rb

@@ -228,7 +228,7 @@ module Licensed
       # return the root directory name
       return root_path_parts[-1] if source_path_parts == root_path_parts
 
-      if source_path_parts[0..root_path_parts.size-1] != root_path_parts
+      if source_path_parts[0..root_path_parts.size - 1] != root_path_parts
         raise Licensed::Configuration::LoadError,
           "source_path must be a descendent of the app root to generate an app name from the relative source_path"
       end

data/lib/licensed/git.rb

@@ -1,49 +1,47 @@
 # frozen_string_literal: true
 module Licensed
   module Git
-    class << self
-      # Returns whether git commands are available
-      def available?
-        @git ||= Licensed::Shell.tool_available?("git")
-      end
+    # Returns whether git commands are available
+    def self.available?
+      @git ||= Licensed::Shell.tool_available?("git")
+    end
 
-      # Returns the root of the current git repository
-      # or nil if not in a git repository.
-      def repository_root
-        return unless available?
-        root = Licensed::Shell.execute("git", "rev-parse", "--show-toplevel", allow_failure: true)
-        return nil if root.empty?
-        root
-      end
+    # Returns the root of the current git repository
+    # or nil if not in a git repository.
+    def self.repository_root
+      return unless available?
+      root = Licensed::Shell.execute("git", "rev-parse", "--show-toplevel", allow_failure: true)
+      return nil if root.empty?
+      root
+    end
 
-      # Returns true if a git repository is found, false otherwise
-      def git_repo?
-        !repository_root.to_s.empty?
-      end
+    # Returns true if a git repository is found, false otherwise
+    def self.git_repo?
+      !repository_root.to_s.empty?
+    end
 
-      # Returns the most recent git SHA for a file or directory
-      # or nil if SHA is not available
-      #
-      # descriptor - file or directory to retrieve latest SHA for
-      def version(descriptor)
-        return unless git_repo? && descriptor
-        Licensed::Shell.execute("git", "rev-list", "-1", "HEAD", "--", descriptor, allow_failure: true)
-      end
+    # Returns the most recent git SHA for a file or directory
+    # or nil if SHA is not available
+    #
+    # descriptor - file or directory to retrieve latest SHA for
+    def self.version(descriptor)
+      return unless git_repo? && descriptor
+      Licensed::Shell.execute("git", "rev-list", "-1", "HEAD", "--", descriptor, allow_failure: true)
+    end
 
-      # Returns the commit date for the provided SHA as a timestamp
-      #
-      # sha - commit sha to retrieve date
-      def commit_date(sha)
-        return unless git_repo? && sha
-        Licensed::Shell.execute("git", "show", "-s", "-1", "--format=%ct", sha)
-      end
+    # Returns the commit date for the provided SHA as a timestamp
+    #
+    # sha - commit sha to retrieve date
+    def self.commit_date(sha)
+      return unless git_repo? && sha
+      Licensed::Shell.execute("git", "show", "-s", "-1", "--format=%ct", sha)
+    end
 
-      # Returns the files in the git repository from `git ls-files --recurse-submodules`
-      def files
-        return unless git_repo?
-        output = Licensed::Shell.execute("git", "ls-files", "--full-name", "--recurse-submodules")
-        output.lines.map(&:strip)
-      end
+    # Returns the files in the git repository from `git ls-files --recurse-submodules`
+    def self.files
+      return unless git_repo?
+      output = Licensed::Shell.execute("git", "ls-files", "--full-name", "--recurse-submodules")
+      output.lines.map(&:strip)
     end
   end
 end

data/lib/licensed/shell.rb

@@ -41,7 +41,7 @@ module Licensed
       end
 
       def message
-        extra = @stderr.empty?? "" : "#{@stderr.gsub(/^/, "        ")}"
+        extra = @stderr.empty? ? "" : "#{@stderr.gsub(/^/, "        ")}"
         "'#{escape_cmd}' exited with status #{@exitstatus}\n#{extra}"
       end
 

data/lib/licensed/sources/gradle.rb

@@ -13,11 +13,9 @@ module Licensed
       GRADLE_LICENSES_PATH     = ".gradle-licenses".freeze
       GRADLE_LICENSES_CSV_NAME = "licenses.csv".freeze
       class Dependency < Licensed::Dependency
-        class << self
-          # Cache and return the results of getting the license content.
-          def retrieve_license(url)
-            (@licenses ||= {})[url] ||= Net::HTTP.get(URI(url))
-          end
+        # Cache and return the results of getting the license content.
+        def self.retrieve_license(url)
+          (@licenses ||= {})[url] ||= Net::HTTP.get(URI(url))
         end
 
         def initialize(name:, version:, path:, url:, metadata: {})

data/lib/licensed/sources/nuget.rb

@@ -106,59 +106,57 @@ module Licensed
           @nuspec_remote_license_file = Licensee::ProjectFiles::LicenseFile.new(license_content, { uri: match[1] }) if license_content
         end
 
-        class << self
-          def strip_html(html)
-            return unless html
+        def self.strip_html(html)
+          return unless html
 
-            return html unless html.downcase.include?("<html")
-            ReverseMarkdown.convert(html, unknown_tags: :bypass)
-          end
+          return html unless html.downcase.include?("<html")
+          ReverseMarkdown.convert(html, unknown_tags: :bypass)
+        end
 
-          def ignored_url?(url)
-            # Many Microsoft packages that now use <license> use this for <licenseUrl>
-            # No need to fetch this page - it just contains NuGet documentation
-            url == "https://aka.ms/deprecateLicenseUrl"
-          end
+        def self.ignored_url?(url)
+          # Many Microsoft packages that now use <license> use this for <licenseUrl>
+          # No need to fetch this page - it just contains NuGet documentation
+          url == "https://aka.ms/deprecateLicenseUrl"
+        end
 
-          def text_content_url(url)
-            # Convert github file URLs to raw URLs
-            return url unless match = url.match(/https?:\/\/(?:www\.)?github.com\/([^\/]+)\/([^\/]+)\/blob\/(.*)/i)
-            "https://github.com/#{match[1]}/#{match[2]}/raw/#{match[3]}"
-          end
+        def self.text_content_url(url)
+          # Convert github file URLs to raw URLs
+          return url unless match = url.match(/https?:\/\/(?:www\.)?github.com\/([^\/]+)\/([^\/]+)\/blob\/(.*)/i)
+          "https://github.com/#{match[1]}/#{match[2]}/raw/#{match[3]}"
+        end
 
-          def retrieve_license(url)
-            return unless url
-            return if ignored_url?(url)
+        def self.retrieve_license(url)
+          return unless url
+          return if ignored_url?(url)
 
-            # Transform URLs that are known to return HTML but have a corresponding text-based URL
-            text_url = text_content_url(url)
+          # Transform URLs that are known to return HTML but have a corresponding text-based URL
+          text_url = text_content_url(url)
 
-            raw_content = fetch_content(text_url)
-            strip_html(raw_content)
-          end
+          raw_content = fetch_content(text_url)
+          strip_html(raw_content)
+        end
 
-          def fetch_content(url, redirect_limit = 5)
-            url = URI.parse(url) if url.instance_of? String
-            return @response_by_url[url] if (@response_by_url ||= {}).key?(url)
-            return if redirect_limit == 0
-
-            begin
-              response = Net::HTTP.get_response(url)
-              case response
-              when Net::HTTPSuccess     then
-                @response_by_url[url] = response.body
-              when Net::HTTPRedirection then
-                redirect_url = URI.parse(response["location"])
-                if redirect_url.relative?
-                  redirect_url = url + redirect_url
-                end
-                # The redirect might be to a URL that requires transformation, i.e. a github file
-                redirect_url = text_content_url(redirect_url.to_s)
-                @response_by_url[url] = fetch_content(redirect_url, redirect_limit - 1)
+        def self.fetch_content(url, redirect_limit = 5)
+          url = URI.parse(url) if url.instance_of? String
+          return @response_by_url[url] if (@response_by_url ||= {}).key?(url)
+          return if redirect_limit == 0
+
+          begin
+            response = Net::HTTP.get_response(url)
+            case response
+            when Net::HTTPSuccess     then
+              @response_by_url[url] = response.body
+            when Net::HTTPRedirection then
+              redirect_url = URI.parse(response["location"])
+              if redirect_url.relative?
+                redirect_url = url + redirect_url
               end
-            rescue
-              # Host might no longer exist or some other error, ignore
+              # The redirect might be to a URL that requires transformation, i.e. a github file
+              redirect_url = text_content_url(redirect_url.to_s)
+              @response_by_url[url] = fetch_content(redirect_url, redirect_limit - 1)
             end
+          rescue
+            # Host might no longer exist or some other error, ignore
           end
         end
       end

data/lib/licensed/sources/pip.rb

@@ -7,8 +7,6 @@ require "parallel"
 module Licensed
   module Sources
     class Pip < Source
-      PACKAGE_INFO_SEPARATOR = "\n---\n"
-
       def enabled?
         !pip_command.empty? && Licensed::Shell.tool_available?(pip_command.join(""))
       end
@@ -41,7 +39,7 @@ module Licensed
       # Returns the location of license files in the package, checking for the inclusion of a new `license_files`
       # folder per https://peps.python.org/pep-0639/
       def package_license_location(package)
-        dist_info = File.join(package["Location"], package["Name"].gsub("-", "_") +  "-" + package["Version"] + ".dist-info")
+        dist_info = File.join(package["Location"], package["Name"].gsub("-", "_") + "-" + package["Version"] + ".dist-info")
 
         license_path = ["license_files", "licenses"]
           .map { |directory| File.join(dist_info, directory) }
@@ -54,8 +52,12 @@ module Licensed
       # using `pip list` to determine what packages are used and `pip show`
       # to gather package information
       def packages
-        all_packages = pip_show_command(package_names)
-        all_packages.split(PACKAGE_INFO_SEPARATOR).reduce([]) do |accum, val|
+        # Handle case where package show command actually includes the separator inside the package info
+        # This is a workaround for the fact that pip show does not have a way to specify a custom separator
+        # Not counting on the package separator here but instead doing them one by one.
+        all_packages = Parallel.map(package_names, in_threads: 4) { |package| pip_show_command(package) }
+
+        all_packages.reduce([]) do |accum, val|
           accum << parse_package_info(val)
         end
       end
@@ -89,8 +91,8 @@ module Licensed
       end
 
       # Returns the output from `pip show <package> <package> ...`
-      def pip_show_command(packages)
-        Licensed::Shell.execute(*pip_command, "--disable-pip-version-check", "show", *packages)
+      def pip_show_command(package)
+        Licensed::Shell.execute(*pip_command, "--disable-pip-version-check", "show", package)
       end
 
       def virtual_env_dir

data/lib/licensed/sources/pnpm.rb

@@ -18,19 +18,24 @@ module Licensed
       end
 
       def enumerate_dependencies
-        packages.map do |package|
-          name_with_version = "#{package["name"]}@#{package["version"]}"
-          Dependency.new(
-            name: name_with_version,
-            version: package["version"],
-            path: package["path"],
-            metadata: {
-              "type"     => PNPM.type,
-              "name"     => package["name"],
-              "summary"  => package["description"],
-              "homepage" => package["homepage"]
-            }
-          )
+        packages.flat_map do |package|
+          versions = package.key?("versions") ? package["versions"] : [package["version"]]
+          paths = package.key?("paths") ? package["paths"] : [package["path"]]
+
+          versions.zip(paths).map do |version, path|
+            name_with_version = "#{package["name"]}@#{version}"
+            Dependency.new(
+              name: name_with_version,
+              version: version,
+              path: path,
+              metadata: {
+                "type"     => PNPM.type,
+                "name"     => package["name"],
+                "summary"  => package["description"],
+                "homepage" => package["homepage"]
+              }
+            )
+          end
         end
       end
 

data/lib/licensed/sources/source.rb

@@ -13,50 +13,56 @@ module Licensed
 
       class << self
         attr_reader :sources
-        def inherited(klass)
-          # register the inherited class as a source on the Licensed::Sources::Source class
-          Licensed::Sources::Source.register_source(klass)
-        end
 
-        def register_source(klass)
-          # add the source class to the known sources list
-          return unless klass < Licensed::Sources::Source
-          (@sources ||= []) << klass
-        end
 
-        # Returns the source name as the first snake cased class or module name
-        # following "Licensed::Sources::".  This is the type that is included
-        # in metadata files and cache paths.
-        # e.g. for `Licensed::Sources::Yarn::V1`, this returns "yarn"
-        def type
-          type_and_version[0]
-        end
 
-        # Returns the source name as a "/" delimited string of all the module and
-        # class names following "Licensed::Sources::".  This is the type that is
-        # used to distinguish multiple versions of a sources from each other.
-        # e.g. for `Licensed::Sources::Yarn::V1`, this returns `yarn/v1`
-        def full_type
-          type_and_version.join("/")
-        end
 
-        # Returns an array that includes the source's type name at the first index, and
-        # optionally a version string for the source as the second index.
-        # Callers should override this function and not `type` or `full_type` when
-        # needing to adjust the default type and version parsing logic
-        def type_and_version
-          self.name.gsub("#{Licensed::Sources.name}::", "")
-                   .gsub(/([A-Z\d]+)([A-Z][a-z])/, "\\1_\\2".freeze)
-                   .gsub(/([a-z\d])([A-Z])/, "\\1_\\2".freeze)
-                   .downcase
-                   .split("::")
-        end
 
-        # Returns true if the source requires matching reviewed and ignored dependencies'
-        # versions as well as their name
-        def require_matched_dependency_version
-          false
-        end
+      end
+
+      def self.inherited(klass)
+        # register the inherited class as a source on the Licensed::Sources::Source class
+        Licensed::Sources::Source.register_source(klass)
+      end
+
+      def self.register_source(klass)
+        # add the source class to the known sources list
+        return unless klass < Licensed::Sources::Source
+        (@sources ||= []) << klass
+      end
+
+      # Returns the source name as the first snake cased class or module name
+      # following "Licensed::Sources::".  This is the type that is included
+      # in metadata files and cache paths.
+      # e.g. for `Licensed::Sources::Yarn::V1`, this returns "yarn"
+      def self.type
+        type_and_version[0]
+      end
+
+      # Returns the source name as a "/" delimited string of all the module and
+      # class names following "Licensed::Sources::".  This is the type that is
+      # used to distinguish multiple versions of a sources from each other.
+      # e.g. for `Licensed::Sources::Yarn::V1`, this returns `yarn/v1`
+      def self.full_type
+        type_and_version.join("/")
+      end
+
+      # Returns an array that includes the source's type name at the first index, and
+      # optionally a version string for the source as the second index.
+      # Callers should override this function and not `type` or `full_type` when
+      # needing to adjust the default type and version parsing logic
+      def self.type_and_version
+        self.name.gsub("#{Licensed::Sources.name}::", "")
+                 .gsub(/([A-Z\d]+)([A-Z][a-z])/, "\\1_\\2".freeze)
+                 .gsub(/([a-z\d])([A-Z])/, "\\1_\\2".freeze)
+                 .downcase
+                 .split("::")
+      end
+
+      # Returns true if the source requires matching reviewed and ignored dependencies'
+      # versions as well as their name
+      def self.require_matched_dependency_version
+        false
       end
 
       # all sources have a configuration

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "5.0.2".freeze
+  VERSION = "5.0.4".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

data/licensed.gemspec

@@ -21,7 +21,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = ">= 3.0.0"
+  spec.required_ruby_version = ">= 3.1.0"
 
   spec.add_dependency "csv", "~> 3.3"
   spec.add_dependency "licensee", "~> 9.16"
@@ -38,5 +38,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "minitest-hooks", "~> 1.5"
   spec.add_development_dependency "mocha", "~> 2.0"
   spec.add_development_dependency "rubocop-github", "~> 0.20"
-  spec.add_development_dependency "byebug", "~> 11.1"
+  spec.add_development_dependency "byebug", "~> 12.0"
 end