dependabot-apm 0.400.0

data/lib/dependabot/apm/metadata_finder.rb

@@ -0,0 +1,91 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/metadata_finders"
+require "dependabot/metadata_finders/base"
+require "dependabot/source"
+require "dependabot/apm/package_specifier"
+
+module Dependabot
+  module Apm
+    class MetadataFinder < Dependabot::MetadataFinders::Base
+      extend T::Sig
+
+      # Hosts whose canonical git provider lets us rebuild the Source from the
+      # full repository path. Dependabot::Source.from_url caps the repo at three
+      # path segments and is not end-anchored, so a deep GitLab namespace such as
+      # `group/subgroup/team/project` would be truncated to `group/subgroup/team`
+      # and resolve to the wrong source/changelog. APM already knows the complete
+      # path via PackageSpecifier, so we bypass that regex for these hosts.
+      PROVIDER_BY_HOST = T.let(
+        {
+          "github.com" => "github",
+          "gitlab.com" => "gitlab",
+          "bitbucket.org" => "bitbucket"
+        }.freeze,
+        T::Hash[String, String]
+      )
+
+      # The API path each provider serves under its own authority. A dependency
+      # may pin a custom port (`github.com:8443`), which is a distinct endpoint
+      # from the public SaaS host: it is a self-hosted-style install whose API is
+      # served from the same authority (mirroring Dependabot::Source's GitHub
+      # Enterprise `…/api/v3` handling), not from the public `api.github.com`.
+      # Used only when a port is present; portless canonical hosts keep the
+      # provider's public defaults.
+      API_PATH_BY_PROVIDER = T.let(
+        {
+          "github" => "api/v3",
+          "gitlab" => "api/v4",
+          "bitbucket" => "2.0"
+        }.freeze,
+        T::Hash[String, String]
+      )
+
+      private
+
+      sig { override.returns(T.nilable(Dependabot::Source)) }
+      def look_up_source
+        url = dependency.requirements.first&.source_string("url")
+        return unless url
+
+        source_from_full_path(url) || Source.from_url(url)
+      end
+
+      # Builds the Source directly from the full repository path so nested
+      # namespaces survive, falling back (via the caller) to Source.from_url for
+      # hosts we cannot resolve a provider for (e.g. self-hosted installs).
+      sig { params(url: String).returns(T.nilable(Dependabot::Source)) }
+      def source_from_full_path(url)
+        spec = Dependabot::Apm::PackageSpecifier.parse(url)
+        return unless spec
+
+        # Classify by the hostname alone: a custom port is transport, not a
+        # different provider, so `github.com:8443` is still GitHub.
+        hostname = Dependabot::Apm::PackageSpecifier.hostname_without_port(spec.host)
+        provider = PROVIDER_BY_HOST[hostname]
+        return if provider.nil? || spec.repo.empty?
+
+        repo = "#{spec.owner}/#{spec.repo}"
+        # A portless canonical host uses the provider's public defaults.
+        return Dependabot::Source.new(provider: provider, repo: repo) if spec.host == hostname
+
+        # A custom port is a distinct, self-hosted-style endpoint: preserve the
+        # full authority and its matching API so source and changelog links
+        # target it. Passing the URL to Source.from_url instead would misread the
+        # port as part of the repo path (`github.com:8443/org/repo` -> `8443/org`).
+        Dependabot::Source.new(
+          provider: provider,
+          repo: repo,
+          hostname: spec.host,
+          api_endpoint: "https://#{spec.host}/#{API_PATH_BY_PROVIDER.fetch(provider)}"
+        )
+      end
+    end
+  end
+end
+
+Dependabot::MetadataFinders
+  .register("apm", Dependabot::Apm::MetadataFinder)

data/lib/dependabot/apm/package_manager.rb

@@ -0,0 +1,75 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/ecosystem"
+require "dependabot/version"
+
+module Dependabot
+  module Apm
+    ECOSYSTEM = "apm"
+    PACKAGE_MANAGER = "apm"
+
+    # The default version reported when the resolved apm CLI version cannot be
+    # determined from the lockfile (`apm_version`).
+    DEFAULT_PACKAGE_MANAGER_VERSION = "0.0.0"
+
+    SUPPORTED_APM_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+    DEPRECATED_APM_VERSIONS = T.let([].freeze, T::Array[Dependabot::Version])
+
+    class PackageManager < Dependabot::Ecosystem::VersionManager
+      extend T::Sig
+
+      # Matches the top-level `apm_version` key the lockfile records for the apm
+      # CLI that wrote it. The value may be plain or quoted, so optional quotes
+      # are stripped. Nested `version:` keys under `dependencies:` are indented
+      # and so never match this line-anchored pattern.
+      LOCKFILE_VERSION_REGEX = /^apm_version:\s*['"]?(?<version>[^'"\s]+)['"]?\s*$/
+
+      sig { params(raw_version: String).void }
+      def initialize(raw_version)
+        super(
+          name: PACKAGE_MANAGER,
+          version: PackageManager.parse_version(raw_version),
+          deprecated_versions: DEPRECATED_APM_VERSIONS,
+          supported_versions: SUPPORTED_APM_VERSIONS
+        )
+      end
+
+      # The apm CLI version recorded in the lockfile (`apm_version`), or nil when
+      # there is no lockfile or it does not record one. Read straight from the
+      # raw content rather than by parsing the YAML: the lockfile is a support
+      # file we never rewrite, and a malformed one should degrade to the default
+      # version rather than raise while parsing the project.
+      sig { params(lockfile_content: T.nilable(String)).returns(T.nilable(String)) }
+      def self.version_from_lockfile(lockfile_content)
+        lockfile_content&.match(LOCKFILE_VERSION_REGEX)&.[](:version)
+      end
+
+      # The apm CLI version recorded in the lockfile (`apm_version`) is written
+      # by apm from its Python (PEP 440) distribution metadata, and the lockfile
+      # schema permits an arbitrary string, so it is not necessarily strict
+      # SemVer (e.g. `0.32.0rc1`, `0.32.0.dev3`). Parse it with the permissive
+      # base version rather than the strict Apm::Version — which is meant for
+      # dependency git refs and would raise ArgumentError here — falling back to
+      # the default when the string cannot be represented at all, so an unusual
+      # CLI version never prevents parsing the project.
+      sig { params(raw_version: String).returns(Dependabot::Version) }
+      def self.parse_version(raw_version)
+        return Dependabot::Version.new(raw_version) if Dependabot::Version.correct?(raw_version)
+
+        Dependabot::Version.new(DEFAULT_PACKAGE_MANAGER_VERSION)
+      end
+
+      sig { returns(T::Boolean) }
+      def deprecated?
+        false
+      end
+
+      sig { returns(T::Boolean) }
+      def unsupported?
+        false
+      end
+    end
+  end
+end

data/lib/dependabot/apm/package_specifier.rb

@@ -0,0 +1,347 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Apm
+    # Parses a single `dependencies.apm` entry from an `apm.yml` manifest into its
+    # git coordinates. APM supports several equivalent forms for the same entry:
+    #
+    #   owner/repo                              GitHub shorthand, default branch
+    #   owner/repo#v1.0.0                       Pinned to a tag, branch or SHA
+    #   gitlab.com/acme/repo#v2.0              FQDN shorthand (any git host)
+    #   gitlab.com/group/subgroup/repo#v2.0   Nested subgroup repo (non-GitHub)
+    #   owner/repo/skills/review               Virtual subdirectory of a repo
+    #   owner/repo/prompts/x.prompt.md#v1.0.0  Virtual file within a repo
+    #   https://gitlab.com/acme/repo.git       Explicit HTTPS git URL
+    #   git@gitlab.com:acme/repo.git           SSH SCP-style URL
+    #   ssh://git@gitlab.com/acme/repo.git     SSH URI-style URL
+    #
+    # HTTPS and SSH clone URLs both resolve to an `https://host[:port]/owner/repo`
+    # remote, since Dependabot enumerates tags over HTTPS with a token. An
+    # `https://` source keeps its authority, including a non-default port
+    # (`github.com:8443` is a distinct endpoint); the implicit `:443` is
+    # normalised away so it collapses to the same endpoint as a portless
+    # declaration. An `ssh://` (or `git@host:`
+    # SCP) source reaches the same repositories over HTTPS, so it resolves there
+    # and its SSH port (e.g. `:2222`) is dropped, as it is not an HTTPS port.
+    # Host classification (GitHub-family, Azure DevOps) always ignores the port.
+    # `http://` and `git://` URLs name a different endpoint than HTTPS and are
+    # not silently rewritten; they are out of scope for v1 and resolve to `nil`.
+    #
+    # Virtual package paths (`owner/repo/skills/review`) are a GitHub-family
+    # shorthand, since GitHub repositories are always `owner/repo`. That covers
+    # github.com and GitHub Enterprise Cloud data-residency hosts (`*.ghe.com`),
+    # which APM also resolves as GitHub. On other hosts (e.g. GitLab) the whole
+    # path is treated as the repository so nested subgroups resolve to the
+    # correct remote; virtual packages there are out of scope for v1, as is
+    # self-hosted GHES on an arbitrary hostname that cannot be recognised from
+    # the host alone.
+    #
+    # Azure DevOps hosts (`dev.azure.com`, `ssh.dev.azure.com` and legacy
+    # `*.visualstudio.com`) expose repositories at `org/project/_git/repo`, a
+    # structure this generic `owner/repo` builder cannot construct, so their
+    # entries are out of scope for v1 and resolve to `nil`.
+    #
+    # Local path entries (`./pkg`, `../pkg`, `/pkg`, `~/pkg`, and their Windows
+    # `.\`/`..\`/`~\` forms) are not versioned by a remote git host and resolve
+    # to `nil`, as do entries we cannot confidently parse.
+    class PackageSpecifier
+      extend T::Sig
+
+      DEFAULT_HOST = "github.com"
+
+      # Azure DevOps Services hosts. Their repositories live at
+      # `org/project/_git/repo`, a structure this generic owner/repo builder
+      # cannot express, so ADO entries are out of scope for v1 (see README) and
+      # are skipped rather than resolved to a wrong remote. Legacy
+      # per-organisation hosts match the `.visualstudio.com` suffix separately.
+      AZURE_DEVOPS_HOSTS = %w(dev.azure.com ssh.dev.azure.com).freeze
+
+      # SCP-style SSH shorthand `user@host:path`. APM accepts any valid SSH
+      # username here (not only `git@`), so match any user that has no `:` or
+      # `/` (either would signal a URL scheme or path rather than an SCP user).
+      # The user is discarded — only the host and path determine the git
+      # coordinates, just as URL_STYLE drops its `user@` info.
+      SCP_STYLE = %r{\A(?<user>[^@:/\s]+)@(?<host>[^:/\s]+):(?<path>.+)\z}
+      # Matches https/git/ssh URIs, discarding any `user@` info (e.g. the
+      # `git@` in an `ssh://git@host/owner/repo` URL) so only the host remains.
+      # URI schemes are case-insensitive (RFC 3986), so the scheme alternation
+      # is matched case-insensitively and normalised (downcased) before dispatch;
+      # e.g. `HTTPS://host/owner/repo` is recognised rather than mis-parsed as a
+      # default-host shorthand.
+      URL_STYLE = %r{\A(?<scheme>(?i:https?|git|ssh))://(?:[^@/]+@)?(?<host>[^/]+)/(?<path>.+)\z}
+
+      sig { returns(String) }
+      attr_reader :host
+
+      sig { returns(String) }
+      attr_reader :owner
+
+      sig { returns(String) }
+      attr_reader :repo
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :sub_path
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :ref
+
+      sig { params(raw: Object, default_host: String).returns(T.nilable(Dependabot::Apm::PackageSpecifier)) }
+      def self.parse(raw, default_host: DEFAULT_HOST)
+        return nil unless raw.is_a?(String)
+
+        entry = raw.strip
+        return nil if entry.empty? || local_path?(entry)
+
+        spec, _, ref = entry.partition("#")
+        host, path = split_host_and_path(spec, default_host)
+        return nil unless path
+
+        build(host: host, path: path, ref: ref, default_host: default_host)
+      end
+
+      # True when `raw` is the string shorthand form (`[host/]owner/repo…`)
+      # rather than an explicit git reference (`https://`, `http://`, `ssh://git@`,
+      # an SCP `git@host:path`, or any `.git`-suffixed ref). When an apm manifest
+      # configures a default registry, APM routes shorthand entries through it
+      # instead of Git, so the parser skips them (registry dependencies are out
+      # of scope for v1). This mirrors APM's `_is_explicit_git_form`, which
+      # routes URL, SCP and `.git` forms to Git even when a default registry is
+      # configured -- they are the escape hatch and are never registry-routed.
+      sig { params(raw: Object).returns(T::Boolean) }
+      def self.shorthand?(raw)
+        return false unless raw.is_a?(String)
+
+        spec = raw.strip.partition("#").first.to_s
+        return false if spec.empty? || local_path?(spec)
+
+        # A `.git` suffix marks an explicit git reference (as APM's
+        # `_is_explicit_git_form` treats it), so it is a Git escape hatch rather
+        # than a registry-routed shorthand even without a transport scheme.
+        return false if spec.downcase.end_with?(".git")
+
+        !spec.match?(SCP_STYLE) && !spec.match?(URL_STYLE)
+      end
+
+      sig do
+        params(host: String, path: String, ref: String, default_host: String)
+          .returns(T.nilable(Dependabot::Apm::PackageSpecifier))
+      end
+      def self.build(host:, path:, ref:, default_host: DEFAULT_HOST)
+        # DNS hostnames are case-insensitive, so canonicalise to lowercase once
+        # here; repository splitting, naming and credential-host matching all key
+        # off `host` and must agree on e.g. `GitHub.com` == `github.com`.
+        host = host.downcase
+        # Azure DevOps clone URLs are `org/project/_git/repo`, which this generic
+        # owner/repo builder cannot construct, so ADO shorthands and URLs are not
+        # versioned in v1 (see README). Skip them rather than emit a wrong remote
+        # that GitCommitChecker would query as a non-repository endpoint.
+        return nil if azure_devops_host?(host)
+
+        segments = path.delete_suffix(".git").split("/").reject(&:empty?)
+        owner = segments[0]
+        return nil if owner.nil? || segments[1].nil?
+
+        repo, sub_path = repository_and_sub_path(host, segments)
+
+        # GitHub-family owner/repo paths are case-insensitive, so canonicalise
+        # them to lowercase to give each repository a single stable identity.
+        # Other hosts (e.g. GitLab) are case-sensitive and MUST preserve casing,
+        # as must virtual sub paths (they address entries inside the repo tree).
+        if github_family?(host)
+          owner = owner.downcase
+          repo = repo.downcase
+        end
+
+        new(
+          host: host,
+          owner: owner,
+          repo: repo,
+          sub_path: sub_path.empty? ? nil : sub_path,
+          ref: ref.empty? ? nil : ref,
+          default_host: default_host.downcase
+        )
+      end
+
+      # Splits the path segments (after `owner`) into a repository path and an
+      # optional virtual sub path. GitHub-family hosts (github.com and GitHub
+      # Enterprise Cloud `*.ghe.com`) always expose repositories as exactly
+      # `owner/repo`, so any deeper segments are an APM virtual package path.
+      # Other hosts (e.g. GitLab) allow repositories nested at arbitrary subgroup
+      # depth, and APM resolves the repository/virtual boundary host-specifically
+      # rather than from the path alone; to avoid querying a shallower, wrong
+      # remote we keep the whole path as the repository there. Virtual packages
+      # outside the GitHub family are therefore out of scope for v1.
+      sig { params(host: String, segments: T::Array[String]).returns([String, String]) }
+      def self.repository_and_sub_path(host, segments)
+        if github_family?(host)
+          [T.must(segments[1]), (segments[2..] || []).join("/")]
+        else
+          [(segments[1..] || []).join("/"), ""]
+        end
+      end
+
+      # GitHub-family hosts share the strict `owner/repo` boundary (any deeper
+      # segments are an APM virtual package path) and case-insensitive owner and
+      # repo names. That is github.com plus GitHub Enterprise Cloud
+      # data-residency hosts (`*.ghe.com`), which APM resolves as GitHub too.
+      # Self-hosted GHES uses arbitrary hostnames that cannot be recognised from
+      # the host alone, so it is not detected here -- a follow-up for once host
+      # configuration is threaded through the parser.
+      sig { params(host: String).returns(T::Boolean) }
+      def self.github_family?(host)
+        hostname = hostname_without_port(host)
+        hostname == DEFAULT_HOST || hostname.end_with?(".ghe.com")
+      end
+
+      # True for Azure DevOps Services hosts: dev.azure.com, its SSH alias, and
+      # legacy per-organisation `*.visualstudio.com` hosts. APM special-cases
+      # these with `org/project/_git/repo` clone URLs; v1 does not build those,
+      # so such entries are skipped (see README) rather than resolved to a wrong
+      # remote.
+      sig { params(host: String).returns(T::Boolean) }
+      def self.azure_devops_host?(host)
+        hostname = hostname_without_port(host)
+        AZURE_DEVOPS_HOSTS.include?(hostname) || hostname.end_with?(".visualstudio.com")
+      end
+
+      # The hostname with any `:port` suffix removed. Host-family classification
+      # keys off the hostname alone: the port is part of the authority that
+      # `git_url` and `name` keep, but it must not change which family a URL
+      # belongs to (`github.com:8443` is still GitHub, `foo.ghe.com:8443` still
+      # GHE Cloud). Only a trailing `:<digits>` is stripped, so bracketed IPv6
+      # authorities are left intact.
+      sig { params(host: String).returns(String) }
+      def self.hostname_without_port(host)
+        host.sub(/:\d+\z/, "")
+      end
+
+      # The authority with a default HTTPS port removed. APM treats a
+      # non-default port as part of a dependency's identity but normalises the
+      # implicit `:443` away (its `_split_shorthand_host_port` maps port 443 to
+      # "no port"), so `github.com:443` and `github.com` are the same endpoint
+      # while `github.com:8443` stays distinct. Applied when parsing an HTTPS
+      # URL so `git_url` and `name` share one canonical authority; only a
+      # trailing `:<digits>` is considered, leaving bracketed IPv6 hosts intact.
+      sig { params(host: String).returns(String) }
+      def self.normalize_https_port(host)
+        match = host.match(/\A(?<hostname>.+):(?<port>\d+)\z/)
+        return host unless match
+
+        T.must(match[:port]).to_i == 443 ? T.must(match[:hostname]) : host
+      end
+
+      sig { params(entry: String).returns(T::Boolean) }
+      def self.local_path?(entry)
+        entry.start_with?("./", "../", "/", "~/", ".\\", "..\\", "~\\") ||
+          entry == "." || entry == "~"
+      end
+
+      sig { params(spec: String, default_host: String).returns([String, T.nilable(String)]) }
+      def self.split_host_and_path(spec, default_host)
+        if (m = spec.match(SCP_STYLE))
+          return [T.must(m[:host]), m[:path]]
+        end
+
+        if (m = spec.match(URL_STYLE))
+          host = T.must(m[:host])
+          case T.must(m[:scheme]).downcase
+          when "https"
+            # HTTPS is the transport we query, so keep the authority, including
+            # a non-default port: `github.com:8443` is a distinct endpoint from
+            # `github.com` and must stay that way. The implicit `:443` is
+            # normalised off so a `github.com:443` declaration collapses to the
+            # same endpoint and identity as a portless one, matching APM's
+            # default-port handling.
+            return [normalize_https_port(host), m[:path]]
+          when "ssh"
+            # SSH reaches the same repositories as HTTPS on that host, and
+            # Dependabot enumerates tags over HTTPS with a token, so resolve
+            # ssh:// URIs over HTTPS. The SSH port (e.g. the `:2222` on
+            # `ssh://git@host:2222/...`) is not an HTTPS port, so drop it.
+            return [host.sub(/:\d+\z/, ""), m[:path]]
+          else
+            # http:// and git:// name a different endpoint than HTTPS (a
+            # distinct port, and for http an unencrypted service). We only query
+            # over HTTPS, so rather than silently rewrite them to a possibly
+            # wrong remote we treat them as out of scope for v1 (see README);
+            # returning a nil path makes `parse` yield nil.
+            return [host, nil]
+          end
+        end
+
+        first_segment = spec.split("/").first.to_s
+        # A dot in the first path segment marks an FQDN host (GitHub owners never
+        # contain a dot), e.g. `gitlab.com/acme/repo`. Normalise the HTTPS port
+        # the same way as the explicit-URL branch so `github.com:443/org/repo`
+        # shorthand collapses to the same authority and identity as the portless
+        # and explicit-URL forms (a non-default port is kept as a distinct
+        # endpoint).
+        if first_segment.include?(".")
+          [normalize_https_port(first_segment), spec.split("/")[1..].to_a.join("/")]
+        else
+          [default_host, spec]
+        end
+      end
+
+      sig do
+        params(
+          host: String,
+          owner: String,
+          repo: String,
+          sub_path: T.nilable(String),
+          ref: T.nilable(String),
+          default_host: String
+        ).void
+      end
+      def initialize(host:, owner:, repo:, sub_path: nil, ref: nil, default_host: DEFAULT_HOST)
+        @host = host
+        @owner = owner
+        @repo = repo
+        @sub_path = sub_path
+        @ref = ref
+        @default_host = default_host
+      end
+
+      sig { returns(String) }
+      def git_url
+        "https://#{host}/#{owner}/#{repo}"
+      end
+
+      # The dependency name shown to users, which is also APM's dedup/lock
+      # identity. Repositories on the manifest's default host -- the configured
+      # `default_host`, or github.com when unset -- keep the familiar
+      # `owner/repo` shorthand, matching how APM keys the dependency;
+      # repositories on any other host are namespaced by host to stay unique.
+      # Comparing against the effective default (rather than a hard-coded
+      # github.com) means a manifest-selected `default_host` is stripped too, so
+      # dependency-name ignore rules and deduplication use the same identity APM
+      # does. A non-default port is part of the identity, matching APM's
+      # get_identity (`git.example.com:8443/org/repo` and
+      # `git.example.com:9443/org/repo` stay distinct dependencies rather than
+      # collapse into one entry that DependencySet would merge -- which, holding
+      # two different clone URLs, then raises `Multiple sources!`). The default
+      # `:443` is normalised off at parse time, so `git_url` and `name` share
+      # one authority and a `:443` declaration dedups with a portless one. A
+      # virtual package (sub path) is namespaced by that path too: APM keys
+      # virtual packages by repository plus path, so `org/mono/skills/review`
+      # and `org/mono/skills/security` must remain distinct dependencies rather
+      # than collapse into one `org/mono` entry that DependencySet would
+      # deduplicate.
+      sig { returns(String) }
+      def name
+        identity_host = self.class.hostname_without_port(host)
+        # `host` carries only a non-default port here (the default :443 is
+        # normalised off when parsing the URL), so it is the identity authority:
+        # on the default host with no port the bare `owner/repo` shorthand is
+        # used, otherwise the port-bearing authority is prefixed.
+        on_default_host = identity_host == @default_host && host == identity_host
+        repo_name = on_default_host ? "#{owner}/#{repo}" : "#{host}/#{owner}/#{repo}"
+        virtual_path = sub_path
+        virtual_path ? "#{repo_name}/#{virtual_path}" : repo_name
+      end
+    end
+  end
+end

data/lib/dependabot/apm/requirement.rb

@@ -0,0 +1,68 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/apm/version"
+require "dependabot/requirement"
+require "dependabot/utils"
+
+module Dependabot
+  module Apm
+    class Requirement < Dependabot::Requirement
+      extend T::Sig
+
+      # Requirement bounds are matched with SemVer 2.0.0 precedence, to stay
+      # consistent with Apm::Version. Left to Gem::Requirement, a prerelease
+      # bound such as `1.0.0-alpha.beta` is rewritten to the RubyGems form
+      # `1.0.0.pre.alpha.beta` and compared with RubyGems precedence, which
+      # orders prerelease identifiers the opposite way to SemVer (so a range
+      # like `< 1.0.0-alpha.beta` would wrongly exclude `1.0.0-alpha.1`).
+      quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
+      # Gem::Version::VERSION_PATTERN covers the release and `-prerelease`
+      # portions; the trailing group additionally accepts SemVer `+build`
+      # metadata so bounds like `= 1.0.0+build.5` are recognised too.
+      version_pattern = "#{Gem::Version::VERSION_PATTERN}(?:\\+[0-9A-Za-z][0-9A-Za-z.-]*)?"
+
+      PATTERN_RAW = T.let("\\s*(#{quoted})?\\s*(#{version_pattern})\\s*".freeze, String)
+      PATTERN = /\A#{PATTERN_RAW}\z/
+
+      # Builds each requirement bound from an Apm::Version so prerelease
+      # ordering follows SemVer. Operands that are not strict SemVer (e.g. the
+      # partial `>= 1.0` or `>= 0`) fall back to RubyGems parsing, which does
+      # not have the prerelease-ordering problem.
+      sig { override.params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
+      def self.parse(obj)
+        if obj.is_a?(String) && (matches = PATTERN.match(obj)) && Apm::Version.correct?(T.must(matches[2]))
+          return [matches[1] || "=", Apm::Version.new(T.must(matches[2]))]
+        end
+
+        super
+      end
+
+      # For consistency with other languages, we define a requirements array.
+      # APM doesn't have an `OR` separator for requirements, so it always
+      # contains a single element.
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
+      def self.requirements_array(requirement_string)
+        [new(requirement_string)]
+      end
+
+      # Patches Gem::Requirement to make it accept requirement strings like
+      # "~> 4.2.5, >= 4.2.5.1" without first needing to split them.
+      sig { params(requirements: T.any(T.nilable(String), T::Array[T.nilable(String)])).void }
+      def initialize(*requirements)
+        requirements = requirements.flatten.flat_map do |req_string|
+          req_string&.split(",")&.map(&:strip)
+        end
+
+        super(requirements)
+      end
+    end
+  end
+end
+
+Dependabot::Utils.register_requirement_class(
+  "apm",
+  Dependabot::Apm::Requirement
+)