dependabot-helm 0.384.0 → 0.386.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c0ab4fed176ce9abcd0eaab214a521878aa723982aaf381767f4140520a64c3
-  data.tar.gz: 4dd796cacde29cc8c1ce1f93fbfdeecb9c3b72844a0241ccf5af839409a9d606
+  metadata.gz: 4d830487e84adfa0aa822028c60564e4052db9bf39d261bf776df1b4214d62bf
+  data.tar.gz: c8677544088532a69e90f056281c28578f279e826ddc624f98b80709563212c3
 SHA512:
-  metadata.gz: '05068c2c0d1c5d056b8abf741c0a56276b947cad741b6814ff1acad06086529d70d78a486089870d29d01afddf8f7acc834e0dfb29e4dacba23af8fa0eb5ea6f'
-  data.tar.gz: b8d45216f93b97f496cfd362d57600abbf1d58a070bcc76dba64d217cb2c5892d3754eadc422f8807d207d7083852389969b470c03a92e067161dc95e2d6cafb
+  metadata.gz: bf871f1010bf02f2e455046ea4e076e8a433c47f11a043ff95e82975d5ff19584b9a8cc8a99eeb1f64c71489665b6da669d37e19c747bbebf4c162d3e7802fff
+  data.tar.gz: 06206be3e63e348226371f69a1f1ede06c14402f3648867dd9749d4bedc749a6b75e63a230ad14d15e47c0d8eb3a61c933c658165620f6c61a6316c5eb191cb5

data/lib/dependabot/helm/file_parser.rb

@@ -39,13 +39,13 @@ module Dependabot
 
       sig do
         params(
-          yaml: T::Hash[T.untyped, T.untyped],
+          yaml: T::Hash[String, Object],
           chart_file: Dependabot::DependencyFile,
           dependency_set: DependencySet
         ).void
       end
       def parse_dependencies(yaml, chart_file, dependency_set)
-        yaml["dependencies"].each do |dep|
+        T.cast(yaml["dependencies"], T::Array[Object]).each do |dep|
           next unless dep.is_a?(Hash) && dep["name"] && dep["version"]
 
           parsed_line = {
@@ -95,7 +95,7 @@ module Dependabot
           next unless yaml.is_a?(Hash)
 
           find_images_in_hash(yaml).each do |image_details|
-            parsed_line = extract_image_details(image_details[:image])
+            parsed_line = extract_image_details(T.must(image_details[:image]))
             next unless parsed_line
 
             version = version_from(parsed_line)
@@ -132,7 +132,7 @@ module Dependabot
         params(
           key: String,
           value: String,
-          hash: T::Hash[T.untyped, T.untyped],
+          hash: T::Hash[String, Object],
           current_path: T::Array[String]
         ).returns(T::Array[T::Hash[Symbol, String]])
       end
@@ -153,7 +153,7 @@ module Dependabot
       end
 
       sig do
-        params(value: T::Array[T.untyped], current_path: T::Array[String]).returns(T::Array[T::Hash[Symbol, String]])
+        params(value: T::Array[Object], current_path: T::Array[String]).returns(T::Array[T::Hash[Symbol, String]])
       end
       def handle_array_value(value, current_path)
         images = []
@@ -163,9 +163,10 @@ module Dependabot
         images
       end
 
-      sig { params(hash: T.untyped, path: T.untyped).returns(T::Array[T.untyped]) }
+      sig { params(hash: Object, path: T::Array[String]).returns(T::Array[T::Hash[Symbol, String]]) }
       def find_images_in_hash(hash, path = [])
-        images = []
+        images = T.let([], T::Array[T::Hash[Symbol, String]])
+        return images unless hash.is_a?(Hash)
 
         hash.each do |key, value|
           current_path = path + [key.to_s]

data/lib/dependabot/helm/file_updater/chart_updater.rb

@@ -23,16 +23,16 @@ module Dependabot
           @dependency = dependency
         end
 
+        # Returns the file content with this dependency's entries rewritten. May
+        # return the content unchanged (e.g. a strategy that leaves an in-range
+        # constraint alone, or a dependency not present in this file); the file
+        # updater decides whether a file actually changed.
         sig { params(file: Dependabot::DependencyFile).returns(T.nilable(String)) }
         def updated_chart_yaml_content(file)
           content = file.content
           yaml_obj = YAML.safe_load(T.must(content))
 
-          content = update_chart_dependencies(T.must(content), yaml_obj, file)
-
-          raise "Expected content to change!" if content == file.content
-
-          content
+          update_chart_dependencies(T.must(content), yaml_obj, file)
         end
 
         private
@@ -43,31 +43,91 @@ module Dependabot
         sig do
           params(
             content: String,
-            yaml_obj: T::Hash[T.untyped, T.untyped],
+            yaml_obj: T::Hash[String, Object],
             file: Dependabot::DependencyFile
           ).returns(String)
         end
         def update_chart_dependencies(content, yaml_obj, file)
-          if update_chart_dependency?(file) && yaml_obj["dependencies"]
-            yaml_obj["dependencies"].each do |dep|
-              next unless dep["name"] == dependency.name
-
-              old_version = dep["version"].to_s
-              new_version = dependency.version
-
-              pattern = /
-              (\s+-\s+name:\s+#{Regexp.escape(dependency.name)}.*?\n\s+)
-              (version:\s+)
-              ["']?#{Regexp.escape(old_version)}["']?
-            /mx
-              content = content.gsub(pattern) do |match|
-                match.gsub(/version: ["']?#{Regexp.escape(old_version)}["']?/, "version: #{new_version}")
-              end
+          return content unless update_chart_dependency?(file) && yaml_obj["dependencies"]
+
+          # Rewrite each entry once, scanning forward so repeated occurrences of
+          # the same chart update independently. A whole-file gsub per entry can
+          # alias — after entry A is rewritten to entry B's old version, B's pass
+          # would re-match the just-updated A.
+          cursor = 0
+          T.cast(yaml_obj["dependencies"], T::Array[T::Hash[String, Object]]).each do |dep|
+            next unless dep["name"] == dependency.name
+
+            old_version = dep["version"].to_s
+            new_requirement = updated_requirement_string(file, old_version) || dependency.version.to_s
+            # This occurrence's constraint is unchanged (the strategy left it
+            # alone) — nothing to write for it.
+            next if new_requirement == old_version
+
+            new_content, cursor = replace_next_entry_version(
+              content,
+              cursor,
+              old_version,
+              yaml_safe_value(new_requirement)
+            )
+            # A changed constraint that produced no textual edit means the entry
+            # wasn't matched (e.g. an unusual name/version layout). Surface it
+            # rather than silently emitting a partial update.
+            if new_content == content
+              raise "Expected to update #{dependency.name} from #{old_version} to " \
+                    "#{new_requirement} in #{file.name}, but no matching entry was found"
             end
+
+            content = new_content
           end
           content
         end
 
+        # Replaces this chart's next `version:` occurrence (at/after cursor) with
+        # new_version, returning the updated content and the position just past
+        # the rewrite so later entries match their own line. The name may be
+        # quoted; returns the content unchanged when no entry matches.
+        sig do
+          params(content: String, cursor: Integer, old_version: String, new_version: String)
+            .returns([String, Integer])
+        end
+        def replace_next_entry_version(content, cursor, old_version, new_version)
+          pattern = /
+            (\s+-\s+name:\s+["']?#{Regexp.escape(dependency.name)}["']?.*?\n\s+version:\s+)
+            ["']?#{Regexp.escape(old_version)}["']?
+          /mx
+          match = pattern.match(content, cursor)
+          return [content, cursor] unless match
+
+          rewritten = "#{match[1]}#{new_version}"
+          updated = T.must(content[0...match.begin(0)]) + rewritten + T.must(content[match.end(0)..])
+          [updated, match.begin(0) + rewritten.length]
+        end
+
+        # Wrap a requirement in double quotes when it would otherwise be
+        # ambiguous as a YAML plain scalar: any whitespace, or a leading
+        # YAML-indicator character (">", "<", "~", "|", etc.). Simple values
+        # (exact, caret) are left bare, preserving the previous output.
+        sig { params(value: String).returns(String) }
+        def yaml_safe_value(value)
+          return "\"#{value}\"" if value.match?(/\s/) || value.match?(/\A[>~<|&*!%@?:#,\[\]{}]/)
+
+          value
+        end
+
+        # The strategy-updated requirement string for a specific chart entry,
+        # matched by the entry's authored version (source[:tag]) so repeated
+        # occurrences of the same chart name each get their own update. Falls
+        # back to the first requirement for the file, then to nil (exact pin).
+        sig { params(file: Dependabot::DependencyFile, old_version: String).returns(T.nilable(String)) }
+        def updated_requirement_string(file, old_version)
+          reqs = dependency.requirements.select do |r|
+            r[:file] == file.name && r.dig(:metadata, :type) == :helm_chart
+          end
+          req = reqs.find { |r| r.dig(:source, :tag) == old_version } || reqs.first
+          req && req[:requirement]
+        end
+
         sig { params(file: Dependabot::DependencyFile).returns(T::Boolean) }
         def update_chart_dependency?(file)
           reqs = dependency.requirements.select { |r| r[:file] == file.name }

data/lib/dependabot/helm/file_updater.rb

@@ -47,6 +47,11 @@ module Dependabot
 
           if file.name.match?(CHART_YAML_REGEXP)
             updated_content = chart_updater.updated_chart_yaml_content(file)
+            # A dependency may span several files/entries; when a strategy leaves
+            # this file's constraint unchanged (e.g. an already-in-range range),
+            # skip it rather than emit an identical file (which would raise).
+            next if updated_content == file.content
+
             updated_files << updated_file(
               file: file,
               content: T.must(updated_content)

data/lib/dependabot/helm/requirement.rb

@@ -0,0 +1,218 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+require "dependabot/requirement"
+require "dependabot/utils"
+require "dependabot/helm/version"
+
+module Dependabot
+  module Helm
+    # Parses Helm Chart.yaml SemVer range constraints (^, ~, x-ranges, hyphen
+    # ranges, || OR, space-AND and comma-AND). Adapted from
+    # Dependabot::NpmAndYarn::Requirement: Helm uses the same SemVer family
+    # (Masterminds), unlike the Gem-style Docker::Requirement registered for the
+    # docker-image path.
+    #
+    # NOTE: this class is intentionally NOT registered as the requirement class
+    # for "helm" (that remains Docker::Requirement, used by the docker-image
+    # path and ignore conditions). It is used explicitly by the range-preserving
+    # requirements updater.
+    class Requirement < Dependabot::Requirement
+      extend T::Sig
+
+      AND_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s+(?:&+\s+)?(?!\s*[|-])/, Regexp)
+      OR_SEPARATOR = T.let(/(?<=[a-zA-Z0-9*])\s*\|+/, Regexp)
+
+      # Allow an optional 'v' prefix and an optional '+<build metadata/digest>'
+      # suffix. Helm::Version supports the latter (e.g. "1.0.119807+<digest>"
+      # from OCI charts), so the requirement parser must accept it too or
+      # constraints containing it raise BadRequirementError.
+      quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
+      version_pattern = "v?#{Gem::Version::VERSION_PATTERN}(?:\\+[0-9A-Za-z\\-.]+)?"
+
+      PATTERN_RAW = T.let("\\s*(#{quoted})?\\s*(#{version_pattern})\\s*".freeze, String)
+      PATTERN = T.let(/\A#{PATTERN_RAW}\z/, Regexp)
+
+      # Always returns a Helm::Version (never the plain Gem::Version-backed
+      # DefaultRequirement), so satisfaction comparisons stay Helm::Version vs
+      # Helm::Version — Helm::Version#<=> has a strict sig that rejects plain
+      # Gem::Version operands.
+      sig do
+        params(obj: T.any(String, Gem::Version))
+          .returns(T::Array[T.any(String, Dependabot::Version)])
+      end
+      def self.parse(obj)
+        return ["=", Helm::Version.new(obj.to_s)] if obj.is_a?(Gem::Version)
+
+        unless (matches = PATTERN.match(obj.to_s))
+          raise BadRequirementError, "Illformed requirement [#{obj.inspect}]"
+        end
+
+        [matches[1] || "=", Helm::Version.new(T.must(matches[2]))]
+      end
+
+      # Returns an array of requirements. At least one requirement from the
+      # returned array must be satisfied for a version to be valid.
+      sig { override.params(requirement_string: T.nilable(String)).returns(T::Array[Requirement]) }
+      def self.requirements_array(requirement_string)
+        return [new(nil)] if requirement_string.nil?
+
+        # Parentheses are extremely rare in Helm constraints; strip them.
+        requirement_string = requirement_string.gsub(/[()]/, "")
+        requirement_string.strip.split(OR_SEPARATOR).map do |req_string|
+          new(req_string.strip.split(AND_SEPARATOR))
+        end
+      end
+
+      sig { params(requirements: T.nilable(T.any(String, T::Array[String]))).void }
+      def initialize(*requirements)
+        requirements = requirements.flatten.compact
+        # `new(nil)` (from `requirements_array(nil)`) means "match anything".
+        # Use a literal ">= 0" so it flows through our `parse` and is backed by a
+        # Helm::Version — Gem's DefaultRequirement uses a plain Gem::Version, which
+        # Helm::Version#<=>'s strict sig would reject.
+        requirements = [">= 0"] if requirements.empty?
+
+        requirements = requirements.flat_map { |req_string| req_string.split(",").map(&:strip) }
+                                   .flat_map { |req_string| convert_helm_constraint_to_ruby_constraint(req_string) }
+
+        super
+      end
+
+      private
+
+      sig { params(req_string: String).returns(T.any(String, T::Array[String])) }
+      def convert_helm_constraint_to_ruby_constraint(req_string)
+        # Leave dist-tags / non-numeric leading tokens untouched.
+        return req_string if req_string.match?(/^([A-Za-uw-z]|v[^\d])/)
+
+        # Wildcards combined with an operator need dedicated handling before the
+        # generic wildcard strip below (which would corrupt them).
+        wildcard = wildcard_ruby_constraint(req_string)
+        return wildcard if wildcard
+
+        dispatch_ruby_constraint(req_string.gsub(/(?:\.|^)[xX*]/, ""))
+      end
+
+      # Dispatches a wildcard-stripped constraint token to its converter.
+      sig { params(req_string: String).returns(T.any(String, T::Array[String])) }
+      def dispatch_ruby_constraint(req_string)
+        if req_string.empty? then ">= 0"
+        elsif req_string.start_with?("~>") then req_string
+        elsif req_string.start_with?("=") then req_string.gsub(/^=*/, "")
+        elsif req_string.start_with?("~") then convert_tilde_req(req_string)
+        elsif req_string.start_with?("^") then convert_caret_req(req_string)
+        elsif req_string.include?(" - ") then convert_hyphen_req(req_string)
+        elsif req_string.match?(/[<>]/) then req_string
+        else ruby_range(req_string)
+        end
+      end
+
+      # Handles wildcard constraints that a leading operator would otherwise
+      # corrupt. Returns nil when there is no operator+wildcard to expand.
+      #   - "<=1.x"/">1.2.x": expand from the wildcard's [floor, ceiling) span
+      #     (stripping the wildcard first would turn "<=1.x" into "<=1", which
+      #     wrongly rejects 1.5.0 that Masterminds accepts).
+      #   - "*"/"^*"/"~*": a bare wildcard means "any version"; any other
+      #     conversion yields an empty bound.
+      sig { params(req_string: String).returns(T.nilable(String)) }
+      def wildcard_ruby_constraint(req_string)
+        if (m = req_string.match(/\A(<=|>=|<|>)\s*(\d+(?:\.\d+)*)\.[xX*]\z/))
+          return convert_wildcard_comparator(T.must(m[1]), T.must(m[2]))
+        end
+
+        return ">= 0" if req_string.match?(/\A[\^~<>=\s]*[xX*]+\z/)
+
+        nil
+      end
+
+      # Expands a comparator applied to a wildcard version ("1.x" spans
+      # [1.0.0, 2.0.0); "1.2.x" spans [1.2.0, 1.3.0)) per Masterminds semantics:
+      #   >= X.x -> >= floor    > X.x -> >= ceiling
+      #   <  X.x -> <  floor    <= X.x -> <  ceiling
+      sig { params(operator: String, prefix: String).returns(String) }
+      def convert_wildcard_comparator(operator, prefix)
+        parts = prefix.split(".").map(&:to_i)
+        floor = (parts + [0, 0, 0]).first(3)
+        ceiling_parts = parts.dup
+        ceiling_parts[-1] = T.must(ceiling_parts[-1]) + 1
+        ceiling = (ceiling_parts + [0, 0, 0]).first(3)
+
+        case operator
+        when ">=" then ">= #{floor.join('.')}"
+        when ">" then ">= #{ceiling.join('.')}"
+        when "<" then "< #{floor.join('.')}"
+        else "< #{ceiling.join('.')}" # "<="
+        end
+      end
+
+      sig { params(req_string: String).returns(String) }
+      def convert_tilde_req(req_string)
+        version = req_string.gsub(/^~\>?[\s=]*/, "")
+        parts = version.split(".")
+        parts << "0" if parts.count < 3
+        "~> #{parts.join('.')}"
+      end
+
+      sig { params(req_string: String).returns(T::Array[String]) }
+      def convert_hyphen_req(req_string)
+        parts = req_string.split(/\s+-\s+/)
+        lower_bound = T.must(parts[0])
+        upper_bound = T.must(parts[1])
+        lower_bound_parts = lower_bound.split(".")
+        lower_bound_parts.fill("0", lower_bound_parts.length...3)
+
+        upper_bound_parts = upper_bound.split(".")
+        upper_bound_range =
+          if upper_bound_parts.length < 3
+            # When upper bound is a partial version treat these as an X-range:
+            # "1.0 - 2.0" includes the whole 2.0.x series, so always increment
+            # the last specified component (even when it is 0) before padding —
+            # otherwise the bound becomes "< 2.0.0.a" and excludes 2.0.0.
+            upper_bound_parts[-1] = (T.must(upper_bound_parts[-1]).to_i + 1).to_s
+            upper_bound_parts.fill("0", upper_bound_parts.length...3)
+            "< #{upper_bound_parts.join('.')}.a"
+          else
+            "<= #{upper_bound_parts.join('.')}"
+          end
+
+        [">= #{lower_bound_parts.join('.')}", upper_bound_range]
+      end
+
+      sig { params(req_string: String).returns(String) }
+      def ruby_range(req_string)
+        parts = req_string.split(".")
+        # If we have three or more parts then this is an exact match
+        return req_string if parts.count >= 3
+
+        # If we have fewer than three parts we do a partial match
+        parts << "0"
+        "~> #{parts.join('.')}"
+      end
+
+      sig { params(req_string: String).returns(T::Array[String]) }
+      def convert_caret_req(req_string)
+        version = req_string.gsub(/^\^[\s=]*/, "")
+        parts = version.split(".")
+        parts.fill("x", parts.length...3)
+        first_non_zero = parts.find { |d| d != "0" }
+        first_non_zero_index =
+          first_non_zero ? T.must(parts.index(first_non_zero)) : parts.count - 1
+        # If the requirement has a blank minor or patch version increment the
+        # previous index value with 1
+        first_non_zero_index -= 1 if first_non_zero == "x"
+        upper_bound = parts.map.with_index do |part, i|
+          if i < first_non_zero_index then part
+          elsif i == first_non_zero_index then (part.to_i + 1).to_s
+          elsif i > first_non_zero_index && i == 2 then "0.a"
+          else "0"
+          end
+        end.join(".")
+
+        [">= #{version}", "< #{upper_bound}"]
+      end
+    end
+  end
+end

data/lib/dependabot/helm/update_checker/latest_version_resolver.rb

@@ -49,11 +49,11 @@ module Dependabot
 
       sig do
         params(
-          versions: T::Array[T::Hash[String, T.untyped]],
+          versions: T::Array[T::Hash[String, Object]],
           repo_name: T.nilable(String),
           chart_name: T.nilable(String)
         )
-          .returns(T::Array[T::Hash[String, T.untyped]])
+          .returns(T::Array[T::Hash[String, Object]])
       end
       def fetch_tag_and_release_date_helm_chart(versions, repo_name, chart_name)
         Dependabot.logger.info("Filtering versions in cooldown period from chart: #{repo_name}")

data/lib/dependabot/helm/update_checker/requirements_updater.rb

@@ -0,0 +1,273 @@
+# typed: strict
+# frozen_string_literal: true
+
+################################################################################
+# Helm Chart.yaml dependency constraints use SemVer ranges (Masterminds), the  #
+# same family npm uses. This mirrors                                           #
+# Dependabot::NpmAndYarn::UpdateChecker::RequirementsUpdater, scoped to the     #
+# three strategies Helm supports, with the git-source / JSR branches removed.   #
+################################################################################
+
+require "sorbet-runtime"
+
+require "dependabot/dependency_requirement"
+require "dependabot/helm/requirement"
+require "dependabot/helm/update_checker"
+require "dependabot/helm/version"
+require "dependabot/requirements_update_strategy"
+
+module Dependabot
+  module Helm
+    class UpdateChecker
+      class RequirementsUpdater
+        extend T::Sig
+
+        # Possessive quantifiers (++) keep these linear on pathological input
+        # (no catastrophic/polynomial backtracking) while matching identically
+        # to the greedy forms for real version constraints. The trailing group
+        # consumes an optional '+<build metadata/digest>' suffix so rewrites
+        # replace it wholesale instead of leaving a stale suffix behind
+        # (e.g. "1.2.3+old" -> "1.5.0", not "1.5.0+old").
+        VERSION_REGEX = /[0-9]++(?:\.[A-Za-z0-9\-_]++)*+(?:\+[A-Za-z0-9\-_.]++)?/
+        SEPARATOR = /(?<=[a-zA-Z0-9*])[\s|]++(?![\s|-])/
+        # The version attached to an upper comparator (`<`/`<=`) or a hyphen
+        # endpoint — the bound that widening moves.
+        UPPER_COMPARATOR_REGEX = /<=?\s*(#{VERSION_REGEX})/
+        HYPHEN_UPPER_REGEX = /\s-\s+(#{VERSION_REGEX})/
+        ALLOWED_UPDATE_STRATEGIES = T.let(
+          [
+            RequirementsUpdateStrategy::LockfileOnly,
+            RequirementsUpdateStrategy::WidenRanges,
+            RequirementsUpdateStrategy::BumpVersions,
+            RequirementsUpdateStrategy::BumpVersionsIfNecessary
+          ].freeze,
+          T::Array[Dependabot::RequirementsUpdateStrategy]
+        )
+
+        sig do
+          params(
+            requirements: T::Array[Dependabot::DependencyRequirement],
+            update_strategy: Dependabot::RequirementsUpdateStrategy,
+            latest_resolvable_version: T.nilable(T.any(String, Gem::Version))
+          ).void
+        end
+        def initialize(requirements:, update_strategy:, latest_resolvable_version:)
+          @requirements = requirements
+          @update_strategy = update_strategy
+
+          check_update_strategy
+
+          return unless latest_resolvable_version
+
+          @latest_resolvable_version = T.let(
+            version_class.new(latest_resolvable_version),
+            Dependabot::Version
+          )
+        end
+
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
+        def updated_requirements
+          return requirements if update_strategy.lockfile_only?
+
+          requirements.map do |req|
+            next req unless latest_resolvable_version
+            next req unless req[:requirement]
+            # Leave dist-tags / non-numeric leading tokens untouched.
+            next req if req[:requirement].match?(/^([A-Za-uw-z]|v[^\d])/)
+
+            case update_strategy
+            when RequirementsUpdateStrategy::WidenRanges then widen_requirement(req)
+            when RequirementsUpdateStrategy::BumpVersions then update_version_requirement(req)
+            when RequirementsUpdateStrategy::BumpVersionsIfNecessary
+              update_version_requirement_if_needed(req)
+            else raise "Unexpected update strategy: #{update_strategy}"
+            end
+          end
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
+        attr_reader :requirements
+
+        sig { returns(Dependabot::RequirementsUpdateStrategy) }
+        attr_reader :update_strategy
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        attr_reader :latest_resolvable_version
+
+        sig { void }
+        def check_update_strategy
+          return if ALLOWED_UPDATE_STRATEGIES.include?(update_strategy)
+
+          raise "Unknown update strategy: #{update_strategy}"
+        end
+
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
+        def update_version_requirement(req)
+          current_requirement = req[:requirement]
+          return req if current_requirement.strip == ""
+
+          if current_requirement.match?(/(<|-\s)/i)
+            # Check every OR alternative, not just the first — a later branch may
+            # already permit the latest version.
+            return req if ruby_requirements(current_requirement).any? { |r| r.satisfied_by?(latest_resolvable_version) }
+
+            updated_req = update_range_requirement(current_requirement)
+            return T.cast(req.merge(requirement: updated_req), Dependabot::DependencyRequirement)
+          end
+
+          # Strict lower-bound (`>`) and not-equal (`!=`) constraints are already
+          # permitted by the resolved version, so leave them untouched. Rewriting
+          # the numeric part would exclude the very version we want
+          # (`>1.0.0` -> `>2.0.0`, `!=1.0.0` -> `!=2.0.0`) and drop any sibling
+          # comparators.
+          if current_requirement.match?(/!=|(?<![<>=])>(?!=)/) &&
+             ruby_requirements(current_requirement).any? { |r| r.satisfied_by?(latest_resolvable_version) }
+            return req
+          end
+
+          reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
+          T.cast(req.merge(requirement: update_version_string(reqs.first)), Dependabot::DependencyRequirement)
+        end
+
+        # Blank, or already permitted by the resolved version, under any strategy.
+        sig { params(req: Dependabot::DependencyRequirement).returns(T::Boolean) }
+        def already_satisfied?(req)
+          current_requirement = req[:requirement]
+          return true if current_requirement.strip == ""
+
+          ruby_requirements(current_requirement).any? { |r| r.satisfied_by?(latest_resolvable_version) }
+        end
+
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
+        def update_version_requirement_if_needed(req)
+          return req if already_satisfied?(req)
+
+          update_version_requirement(req)
+        end
+
+        sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
+        def widen_requirement(req)
+          return req if already_satisfied?(req)
+
+          current_requirement = req[:requirement]
+          reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
+
+          updated_requirement =
+            if reqs.any? { |r| r.match?(/(<|-\s)/i) }
+              update_range_requirement(current_requirement)
+            elsif reqs.one?
+              update_version_string(current_requirement)
+            else
+              # An OR of caret/tilde/exact alternatives, none of which permit the
+              # latest version: widen by adding a new alternative rather than
+              # rewriting the authored ones (npm's widen_ranges behavior).
+              "#{current_requirement} || ^#{latest_resolvable_version}"
+            end
+
+          T.cast(req.merge(requirement: updated_requirement), Dependabot::DependencyRequirement)
+        end
+
+        sig { params(requirement_string: String).returns(T::Array[Helm::Requirement]) }
+        def ruby_requirements(requirement_string)
+          Helm::Requirement.requirements_array(requirement_string)
+        end
+
+        sig { params(req_string: String).returns(String) }
+        def update_range_requirement(req_string)
+          range_requirements =
+            req_string.split(SEPARATOR).select { |r| r.match?(/<|(\s++-\s++)/) }
+
+          if range_requirements.one?
+            range_requirement = T.must(range_requirements.first)
+            versions = range_requirement.scan(VERSION_REGEX)
+            # The bound to move is the operand of `<`/`<=` (or the hyphen
+            # endpoint), NOT the numerically-largest token — a comma-AND `!=`
+            # operand can be larger (e.g. "!=9.0.0,<2.0.0"). Substitute the
+            # *original* matched text, not the parsed version's normalized
+            # #to_s: Helm::Version normalizes "2.0.0-rc1" to "2.0.0", so subbing
+            # the normalized form would match the wrong span and leave a stale
+            # suffix ("<3.0.0-rc1"). Fall back to the max token only if neither
+            # an upper comparator nor a hyphen endpoint is present.
+            original_upper = T.cast(
+              range_requirement[UPPER_COMPARATOR_REGEX, 1] ||
+                range_requirement[HYPHEN_UPPER_REGEX, 1] ||
+                T.must(versions.max_by { |v| version_class.new(v.to_s) }),
+              String
+            )
+            new_upper_bound = update_greatest_version(
+              version_class.new(original_upper).to_s,
+              T.must(latest_resolvable_version)
+            )
+
+            # Anchor the substitution to the upper-bound operator (`<`/`<=`) or
+            # hyphen so it can't replace an earlier lower-bound operand that
+            # happens to share the same version string.
+            req_string.sub(/(<=?\s*|\s-\s+)#{Regexp.escape(original_upper)}/) do
+              "#{Regexp.last_match(1)}#{new_upper_bound}"
+            end
+          else
+            req_string + " || ^#{T.must(latest_resolvable_version)}"
+          end
+        end
+
+        sig { params(req_string: String).returns(String) }
+        def update_version_string(req_string)
+          latest = T.must(latest_resolvable_version).to_s
+          req_string
+            .sub(VERSION_REGEX) do |old_version|
+              if old_version.match?(/\d-/) || latest.match?(/\d-/)
+                latest
+              else
+                old_parts = old_version.split(".")
+                new_parts = latest.split(".")
+                # Iterate the authored segments so the constraint's shape is
+                # preserved even when the latest version has fewer segments
+                # (e.g. "1.2.x" + latest "4.5" -> "4.5.x", not "4.5").
+                old_parts.map.with_index do |old, i|
+                  # Preserve an authored wildcard segment, keeping its case
+                  # ("1.x" -> "4.x", "1.X" -> "4.X").
+                  old.match?(/\A[xX]/) ? old : (new_parts[i] || "0")
+                end.join(".")
+              end
+            end
+        end
+
+        sig { params(old_version: String, version_to_be_permitted: Dependabot::Version).returns(String) }
+        def update_greatest_version(old_version, version_to_be_permitted)
+          version = version_class.new(old_version)
+          version = version.release if version.prerelease?
+
+          index_to_update =
+            version.segments.map.with_index { |seg, i| T.cast(seg, Integer).zero? ? 0 : i }.max || 0
+
+          version.segments.map.with_index do |_, index|
+            segment_value =
+              if index < index_to_update
+                permitted_segment(version_to_be_permitted, index)
+              elsif index == index_to_update
+                permitted_segment(version_to_be_permitted, index) + 1
+              else
+                0
+              end
+            segment_value.to_s
+          end.join(".")
+        end
+
+        # A version segment as an Integer, treating missing trailing segments as
+        # 0 (the permitted version may have fewer segments than the old bound).
+        sig { params(version: Dependabot::Version, index: Integer).returns(Integer) }
+        def permitted_segment(version, index)
+          seg = version.segments[index]
+          seg.nil? ? 0 : T.cast(seg, Integer)
+        end
+
+        sig { returns(T.class_of(Helm::Version)) }
+        def version_class
+          Helm::Version
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/helm/update_checker.rb

@@ -5,7 +5,9 @@ require "sorbet-runtime"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/errors"
+require "dependabot/requirements_update_strategy"
 require "dependabot/helm/version"
+require "dependabot/helm/requirement"
 require "dependabot/docker/requirement"
 require "dependabot/shared/utils/credentials_finder"
 require "dependabot/shared_helpers"
@@ -16,10 +18,15 @@ require "dependabot/helm/helpers"
 
 module Dependabot
   module Helm
-    class UpdateChecker < Dependabot::UpdateCheckers::Base
+    # ClassLength is disabled to match sibling ecosystems' update checkers
+    # (npm_and_yarn and bun disable it on the same class). The version-fetching
+    # helpers already delegate to update_checker/latest_version_resolver;
+    # further extraction would fragment the update-decision flow.
+    class UpdateChecker < Dependabot::UpdateCheckers::Base # rubocop:disable Metrics/ClassLength
       extend T::Sig
 
       require_relative "update_checker/latest_version_resolver"
+      require_relative "update_checker/requirements_updater"
 
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_version
@@ -41,17 +48,116 @@ module Dependabot
         return dependency.requirements unless latest_version
 
         updated_reqs = dependency.requirements.map do |req|
-          updated_metadata = req.fetch(:metadata).dup
-          updated_req = req.dup
-          updated_req[:requirement] = latest_version.to_s if updated_metadata.key?(:type)
-
-          updated_req
+          case req.dig(:metadata, :type)
+          when nil then req
+          when :helm_chart then updated_chart_requirement(req)
+          else req.merge(requirement: latest_version.to_s) # image deps: exact overwrite
+          end
         end
         wrap_requirements(updated_reqs)
       end
 
       private
 
+      # Helm stores each occurrence's constraint in the requirement's
+      # source[:tag], not the requirement field (the shared parser leaves it
+      # nil). Feed that constraint through the RequirementsUpdater so
+      # versioning-strategy is honored. When no strategy is set we default to
+      # BumpVersions, which preserves the authored operator and bumps the floor
+      # (e.g. `^1.0.0` -> `^1.0.5`); exact pins stay exact (`1.0.0` -> `1.5.0`).
+      sig { params(req: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
+      def updated_chart_requirement(req)
+        current_constraint = chart_constraint_for(req)
+        synthetic = T.cast(req.merge(requirement: current_constraint), Dependabot::DependencyRequirement)
+
+        T.must(
+          RequirementsUpdater.new(
+            requirements: [synthetic],
+            update_strategy: resolved_update_strategy,
+            latest_resolvable_version: T.must(latest_version).to_s
+          ).updated_requirements.first
+        )
+      end
+
+      # The authored constraint for a single requirement. Prefer the
+      # requirement's own source[:tag] over dependency.version, since
+      # DependencySet may merge several same-named occurrences (different files
+      # or ranges) into one dependency with a single combined version.
+      sig { params(req: Dependabot::DependencyRequirement).returns(String) }
+      def chart_constraint_for(req)
+        (req[:requirement] || req.dig(:source, :tag) || dependency.version).to_s
+      end
+
+      sig { returns(Dependabot::RequirementsUpdateStrategy) }
+      def resolved_update_strategy
+        requirements_update_strategy || RequirementsUpdateStrategy::BumpVersions
+      end
+
+      # Overrides Base#current_version. For chart deps the Chart.yaml constraint
+      # lives in dependency.version, which may be a range with no single version;
+      # we anchor on its lower bound so candidate filtering has a concrete
+      # baseline. Non-chart deps (docker images) keep the base behavior.
+      sig { override.returns(T.nilable(Dependabot::Version)) }
+      def current_version
+        return super unless dependency_type == :helm_chart
+
+        @current_version ||= T.let(chart_anchor_version, T.nilable(Dependabot::Version))
+      end
+
+      # A concrete version to anchor candidate filtering on. A dependency may
+      # merge several same-named occurrences with different constraints, so anchor
+      # on the *lowest* occurrence — otherwise a higher-floored occurrence would
+      # gate out a release that a lower one still needs updated to.
+      sig { returns(Dependabot::Version) }
+      def chart_anchor_version
+        constraints = dependency.requirements
+                                .select { |r| r.dig(:metadata, :type) == :helm_chart }
+                                .map { |r| chart_constraint_for(r) }
+        constraints = [dependency.version.to_s] if constraints.empty?
+        T.must(constraints.map { |c| anchor_for_constraint(c) }.min)
+      end
+
+      # Anchors a single constraint on a concrete version. Single/lenient forms
+      # (^1.0.0, ~1.2.0, 1.0.0) parse directly; comparator/hyphen/OR ranges do
+      # not, so anchor on the lowest lower bound the Requirement parser reports
+      # (0 when the constraint has no lower bound, e.g. "<2.0.0").
+      sig { params(raw: String).returns(Dependabot::Version) }
+      def anchor_for_constraint(raw)
+        # A comparator/hyphen/OR constraint has no single version, and
+        # version_class.new would silently mis-read it ("<2.0.0" -> 2.0.0), so
+        # route those to the parser's lower bound.
+        return min_bound_anchor(raw) if raw.match?(/[<>]|!=|\s-\s|\|\|/)
+
+        begin
+          version_class.new(raw)
+        rescue StandardError
+          min_bound_anchor(raw)
+        end
+      end
+
+      # The lowest lower-bound version across the constraint's OR branches, or 0
+      # when any branch has no lower bound (that branch permits arbitrarily low
+      # versions, e.g. "<=2.0.0 || >=10.0.0"). Re-wrapped as a Helm::Version —
+      # min_version yields a base Dependabot::Version, but Helm::Version#<=> only
+      # accepts Helm operands.
+      sig { params(raw: String).returns(Dependabot::Version) }
+      def min_bound_anchor(raw)
+        floors = Helm::Requirement.requirements_array(raw).map { |req| branch_lower_bound(req) }
+        # A nil floor means some OR branch permits arbitrarily low versions
+        # (an upper-only or exclusion branch), so anchor at 0.
+        return version_class.new("0") if floors.any?(&:nil?)
+
+        floor = floors.min
+        floor ? version_class.new(floor.to_s) : version_class.new("0")
+      end
+
+      # The lowest version an OR branch permits: its >=/>/~> lower bound, or an
+      # exact (=) pin's version. Nil when the branch has no lower bound (</<=/!=).
+      sig { params(req: Dependabot::Requirement).returns(T.nilable(Gem::Version)) }
+      def branch_lower_bound(req)
+        req.min_version || req.requirements.filter_map { |op, v| v if op == "=" }.min
+      end
+
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
         raise NotImplementedError
@@ -77,11 +183,20 @@ module Dependabot
           valid_releases =  latest_version_resolver
                             .fetch_tag_and_release_date_helm_chart(valid_releases, repo_name, chart_name)
         end
-        highest_release = valid_releases.max_by { |release| version_class.new(release["version"]) }
+        highest_release = valid_releases.max_by { |release| version_class.new(T.cast(release["version"], String)) }
         Dependabot.logger.info(
           "Found latest version #{T.must(highest_release)['version']} for #{chart_name} using helm search"
         )
-        version_class.new(T.must(highest_release)["version"])
+        version_class.new(T.cast(T.must(highest_release)["version"], String))
+      end
+
+      sig do
+        params(index: T.nilable(T::Hash[String, Object]), chart_name: String)
+          .returns(T.nilable(T::Array[T::Hash[String, Object]]))
+      end
+      def chart_entries_from_index(index, chart_name)
+        entries = T.cast(index&.fetch("entries", nil), T.nilable(T::Hash[String, Object]))
+        T.cast(entries&.fetch(chart_name, nil), T.nilable(T::Array[T::Hash[String, Object]]))
       end
 
       sig { params(chart_name: String, repo_url: T.nilable(String)).returns(T.nilable(Gem::Version)) }
@@ -91,9 +206,10 @@ module Dependabot
 
         index_url = build_index_url(repo_url)
         index = fetch_helm_chart_index(index_url)
-        return nil unless index && index["entries"] && index["entries"][chart_name]
+        chart_entries = chart_entries_from_index(index, chart_name)
+        return nil unless chart_entries
 
-        all_versions = index["entries"][chart_name].map { |entry| entry["version"] }
+        all_versions = chart_entries.map { |entry| T.cast(entry["version"], String) }
         Dependabot.logger.info("Found #{all_versions.length} versions for #{chart_name} in index.yaml")
 
         valid_versions = filter_valid_versions(all_versions)
@@ -115,12 +231,16 @@ module Dependabot
         highest_version
       end
 
-      sig { params(releases: T::Array[T::Hash[String, T.untyped]]).returns(T::Array[T::Hash[String, T.untyped]]) }
+      sig { params(releases: T::Array[T::Hash[String, Object]]).returns(T::Array[T::Hash[String, Object]]) }
       def filter_valid_releases(releases)
         releases.reject do |release|
-          version_class.new(release["version"]) <= version_class.new(dependency.version) ||
+          release_version = version_class.new(T.cast(release["version"], String))
+          # Compare against current_version (the anchored floor) rather than
+          # dependency.version: for a range constraint (">=1.0.0 <2.0.0") the raw
+          # version string isn't a single parseable version.
+          release_version <= current_version ||
             ignore_requirements.any? do |r|
-              r.instance_of?(Dependabot::Requirement) && r.satisfied_by?(version_class.new(release["version"]))
+              r.instance_of?(Dependabot::Requirement) && r.satisfied_by?(release_version)
             end
         end
       end
@@ -139,10 +259,37 @@ module Dependabot
       end
 
       sig { params(requirements_to_unlock: T.nilable(Symbol)).returns(T::Boolean) }
-      def version_can_update?(requirements_to_unlock:) # rubocop:disable Lint/UnusedMethodArgument
+      def version_can_update?(requirements_to_unlock:)
         return false unless latest_version
+        # Non-chart deps (docker images) keep the base behavior — including its
+        # nilable current_version handling.
+        return super unless dependency_type == :helm_chart
+
+        return false unless version_class.new(latest_version.to_s) > T.must(current_version)
+
+        # For a chart dependency, an "update" means the authored Chart.yaml
+        # constraint actually changes. The RequirementsUpdater deliberately
+        # leaves some constraints untouched (an in-range comparator/hyphen range,
+        # or an OR range already satisfied by the latest version), so gate on
+        # whether it would produce a different constraint. Otherwise can_update?
+        # promises a change the file updater can't make, and it raises
+        # "Expected content to change!" on the unchanged Chart.yaml.
+        chart_requirement_changes?
+      end
 
-        version_class.new(latest_version.to_s) > version_class.new(dependency.version)
+      # Whether running the authored chart constraint through the
+      # RequirementsUpdater yields a different constraint string for *any*
+      # requirement. A dependency may carry several requirements (same chart
+      # name across files/entries); an update is warranted if even one changes.
+      sig { returns(T::Boolean) }
+      def chart_requirement_changes?
+        chart_reqs = dependency.requirements.select { |r| r.dig(:metadata, :type) == :helm_chart }
+        chart_reqs = dependency.requirements if chart_reqs.empty?
+        return true if chart_reqs.empty?
+
+        chart_reqs.any? do |req|
+          updated_chart_requirement(req)[:requirement].to_s != chart_constraint_for(req)
+        end
       end
 
       sig { returns(T.nilable(T.any(String, Gem::Version))) }
@@ -170,7 +317,7 @@ module Dependabot
           chart_name: String,
           repo_name: T.nilable(String),
           repo_url: T.nilable(String)
-        ).returns(T.nilable(T::Array[T::Hash[String, T.untyped]]))
+        ).returns(T.nilable(T::Array[T::Hash[String, Object]]))
       end
       def fetch_chart_releases(chart_name, repo_name = nil, repo_url = nil)
         Dependabot.logger.info("Fetching releases for Helm chart: #{chart_name}")
@@ -267,7 +414,7 @@ module Dependabot
         name
       end
 
-      sig { params(index_url: String).returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+      sig { params(index_url: String).returns(T.nilable(T::Hash[String, Object])) }
       def fetch_helm_chart_index(index_url)
         Dependabot.logger.info("Fetching Helm chart index from #{index_url}")
 
@@ -296,7 +443,7 @@ module Dependabot
       sig { params(all_versions: T::Array[String]).returns(T::Array[String]) }
       def filter_valid_versions(all_versions)
         all_versions.reject do |version|
-          version_class.new(version) <= version_class.new(dependency.version) ||
+          version_class.new(version) <= current_version ||
             ignore_requirements.any? do |r|
               r.instance_of?(Dependabot::Requirement) && r.satisfied_by?(version_class.new(version))
             end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-helm
 version: !ruby/object:Gem::Version
-  version: 0.384.0
+  version: 0.386.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: dependabot-docker
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.384.0
+        version: 0.386.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -265,15 +265,17 @@ files:
 - lib/dependabot/helm/helpers.rb
 - lib/dependabot/helm/package/package_details_fetcher.rb
 - lib/dependabot/helm/package_manager.rb
+- lib/dependabot/helm/requirement.rb
 - lib/dependabot/helm/update_checker.rb
 - lib/dependabot/helm/update_checker/latest_version_resolver.rb
+- lib/dependabot/helm/update_checker/requirements_updater.rb
 - lib/dependabot/helm/version.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.384.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
 rdoc_options: []
 require_paths:
 - lib