dependabot-swift 0.223.0 → 0.225.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9c4d7a75751290497fd09eb0dc26f82ca32b29246bf0d07fabe6c71a9af64f2
-  data.tar.gz: b84e6a5b45b30892f35e2033dc4b57cbb172b3f3f006f2b71f17c7fa4d7463f3
+  metadata.gz: ece4598e2b52cc65a287a39c06f315c6971c62162bb5f571f8b35b8a7dcd95ca
+  data.tar.gz: a2e0c834bb02b3e8ee6cc0fac896083700ea4423154827ddee9b3ab9af9fc8d6
 SHA512:
-  metadata.gz: a7fb390b84f5159787be751f8b30815918a76f86a3433961811c6647d2ede4bb1cce2ec201665dce979eafb35b06646c884d4400a313817f18a4a2855fc459b7
-  data.tar.gz: c47f6f424a89188321c59fa5e9401cab4a821c3c80418e5bc7ae7f9b3ec555b1d11e8f525487516659791513fc10e381aee15663baf6b70f731fd849a3c2b5ef
+  metadata.gz: 1b53549f3e23982d335b6d8ab2e0e7bfb540fd708b22f1f220625a3aed3524af77586d097f8cc700af0839b31ded7fec9876643ee32413a76f81282c216efa8c
+  data.tar.gz: 284f0ee7c59cfe1854b77b23ba1ace37cbe3629512a67d4fa519ef148fc1276fd0a9530802878ebdc0295335bb2983c7c6978786ab5cd45c3aaa94b3186345e0

data/lib/dependabot/swift/file_parser/dependency_parser.rb

@@ -4,6 +4,7 @@ require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
 require "dependabot/dependency"
 require "json"
+require "uri"
 
 module Dependabot
   module Swift
@@ -47,12 +48,14 @@ module Dependabot
         end
 
         def all_dependencies(data, level: 0)
-          name = data["identity"]
+          identity = data["identity"]
           url = data["url"]
+          name = normalize(url)
           version = data["version"]
 
           source = { type: "git", url: url, ref: version, branch: nil }
-          args = { name: name, version: version, package_manager: "swift", requirements: [] }
+          metadata = { identity: identity }
+          args = { name: name, version: version, package_manager: "swift", requirements: [], metadata: metadata }
 
           if level.zero?
             args[:requirements] << { requirement: nil, groups: ["dependencies"], file: nil, source: source }
@@ -65,6 +68,12 @@ module Dependabot
           [dep, *subdependencies(data, level: level + 1)].compact
         end
 
+        def normalize(source)
+          uri = URI.parse(source.downcase)
+
+          "#{uri.host}#{uri.path}".delete_prefix("www.").delete_suffix(".git")
+        end
+
         attr_reader :dependency_files, :repo_contents_path, :credentials
       end
     end

data/lib/dependabot/swift/file_parser/manifest_parser.rb

@@ -7,7 +7,8 @@ module Dependabot
   module Swift
     class FileParser < Dependabot::FileParsers::Base
       class ManifestParser
-        DEPENDENCY = /(?<declaration>\.package\(\s*(?:name: "[^"]+",\s*)?url: "(?<url>[^"]+)",\s*(?<requirement>.*)\))/
+        DEPENDENCY =
+          /(?<declaration>\.package\(\s*(?:name: "[^"]+",\s*)?url: "(?<url>[^"]+)",\s*(?<requirement>.*)\s*\))/
 
         def initialize(manifest, source:)
           @manifest = manifest

data/lib/dependabot/swift/file_parser.rb

@@ -24,7 +24,8 @@ module Dependabot
               name: dep.name,
               version: dep.version,
               package_manager: dep.package_manager,
-              requirements: requirements
+              requirements: requirements,
+              metadata: dep.metadata
             )
           else
             dependency_set << dep

data/lib/dependabot/swift/file_updater/lockfile_updater.rb

@@ -2,16 +2,18 @@
 
 require "dependabot/file_updaters/base"
 require "dependabot/shared_helpers"
+require "dependabot/logger"
 
 module Dependabot
   module Swift
     class FileUpdater < Dependabot::FileUpdaters::Base
       class LockfileUpdater
-        def initialize(dependencies:, manifest:, repo_contents_path:, credentials:)
-          @dependencies = dependencies
+        def initialize(dependency:, manifest:, repo_contents_path:, credentials:, target_version: nil)
+          @dependency = dependency
           @manifest = manifest
           @repo_contents_path = repo_contents_path
           @credentials = credentials
+          @target_version = target_version
         end
 
         def updated_lockfile_content
@@ -19,10 +21,7 @@ module Dependabot
             File.write(manifest.name, manifest.content)
 
             SharedHelpers.with_git_configured(credentials: credentials) do
-              SharedHelpers.run_shell_command(
-                "swift package update #{dependencies.map(&:name).join(' ')}",
-                fingerprint: "swift package update <dependency_name>"
-              )
+              try_lockfile_update(dependency.metadata[:identity])
 
               File.read("Package.resolved")
             end
@@ -31,7 +30,27 @@ module Dependabot
 
         private
 
-        attr_reader :dependencies, :manifest, :repo_contents_path, :credentials
+        def try_lockfile_update(dependency_name)
+          if target_version
+            SharedHelpers.run_shell_command(
+              "swift package resolve #{dependency_name} --version #{target_version}",
+              fingerprint: "swift package resolve <dependency_name> --version <target_version>"
+            )
+          else
+            SharedHelpers.run_shell_command(
+              "swift package update #{dependency_name}",
+              fingerprint: "swift package update <dependency_name>"
+            )
+          end
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          # This class is not only used for final lockfile updates, but for
+          # checking resolvability. So resolvability errors here are expected in
+          # certain situations and will result in `no_update_possible` outcomes.
+          # That said, since we're swallowing all errors we at least log them to ease debugging.
+          Dependabot.logger.info("Lockfile failed to be updated due to error:\n#{e.message}")
+        end
+
+        attr_reader :dependency, :manifest, :repo_contents_path, :credentials, :target_version
       end
     end
   end

data/lib/dependabot/swift/file_updater.rb

@@ -54,10 +54,11 @@ module Dependabot
 
       def updated_lockfile_content(updated_manifest)
         LockfileUpdater.new(
-          dependencies: dependencies,
+          dependency: dependency,
           manifest: updated_manifest || manifest,
           repo_contents_path: repo_contents_path,
-          credentials: credentials
+          credentials: credentials,
+          target_version: dependency.version
         ).updated_lockfile_content
       end
 

data/lib/dependabot/swift/native_requirement.rb

@@ -90,7 +90,7 @@ module Dependabot
       end
 
       def parse_range(separator)
-        declaration.split(separator).map { |str| unquote(str) }
+        declaration.split(separator).map { |str| unquote(str.strip) }
       end
 
       def single_version_declaration?

data/lib/dependabot/swift/update_checker/version_resolver.rb

@@ -8,9 +8,10 @@ module Dependabot
   module Swift
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       class VersionResolver
-        def initialize(dependency:, manifest:, repo_contents_path:, credentials:)
+        def initialize(dependency:, manifest:, lockfile:, repo_contents_path:, credentials:)
           @dependency         = dependency
           @manifest           = manifest
+          @lockfile           = lockfile
           @credentials        = credentials
           @repo_contents_path = repo_contents_path
         end
@@ -23,18 +24,21 @@ module Dependabot
 
         def fetch_latest_resolvable_version
           updated_lockfile_content = FileUpdater::LockfileUpdater.new(
-            dependencies: [dependency],
+            dependency: dependency,
             manifest: manifest,
             repo_contents_path: repo_contents_path,
             credentials: credentials
           ).updated_lockfile_content
 
-          lockfile = DependencyFile.new(
+          return if updated_lockfile_content == lockfile.content
+
+          updated_lockfile = DependencyFile.new(
             name: "Package.resolved",
-            content: updated_lockfile_content
+            content: updated_lockfile_content,
+            directory: manifest.directory
           )
 
-          dependency_parser(manifest, lockfile).parse.find do |parsed_dep|
+          dependency_parser(manifest, updated_lockfile).parse.find do |parsed_dep|
             parsed_dep.name == dependency.name
           end.version
         end
@@ -47,7 +51,7 @@ module Dependabot
           )
         end
 
-        attr_reader :dependency, :manifest, :repo_contents_path, :credentials
+        attr_reader :dependency, :manifest, :lockfile, :repo_contents_path, :credentials
       end
     end
   end

data/lib/dependabot/swift/update_checker.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/git_commit_checker"
 require "dependabot/swift/native_requirement"
 require "dependabot/swift/file_updater/manifest_updater"
@@ -24,6 +25,18 @@ module Dependabot
         raise NotImplementedError
       end
 
+      def lowest_security_fix_version
+        @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+      end
+
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        return @lowest_resolvable_security_fix_version if defined?(@lowest_resolvable_security_fix_version)
+
+        @lowest_resolvable_security_fix_version = fetch_lowest_resolvable_security_fix_version
+      end
+
       def updated_requirements
         RequirementsUpdater.new(
           requirements: old_requirements,
@@ -43,14 +56,33 @@ module Dependabot
         latest_version_tag.fetch(:version)
       end
 
+      def fetch_lowest_security_fix_version
+        return unless git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
+
+        lowest_security_fix_version_tag.fetch(:version)
+      end
+
       def fetch_latest_resolvable_version
-        Version.new(version_resolver.latest_resolvable_version)
+        latest_resolvable_version = version_resolver_for(unlocked_requirements).latest_resolvable_version
+        return current_version unless latest_resolvable_version
+
+        Version.new(latest_resolvable_version)
+      end
+
+      def fetch_lowest_resolvable_security_fix_version
+        lowest_resolvable_security_fix_version = version_resolver_for(
+          force_lowest_security_fix_requirements
+        ).latest_resolvable_version
+        return unless lowest_resolvable_security_fix_version
+
+        Version.new(lowest_resolvable_security_fix_version)
       end
 
-      def version_resolver
+      def version_resolver_for(requirements)
         VersionResolver.new(
           dependency: dependency,
-          manifest: prepared_manifest,
+          manifest: prepare_manifest_for(requirements),
+          lockfile: lockfile,
           repo_contents_path: repo_contents_path,
           credentials: credentials
         )
@@ -62,19 +94,30 @@ module Dependabot
         end
       end
 
-      def prepared_manifest
+      def force_lowest_security_fix_requirements
+        NativeRequirement.map_requirements(old_requirements) do |_old_requirement|
+          "\"#{lowest_security_fix_version}\"...\"#{lowest_security_fix_version}\""
+        end
+      end
+
+      def prepare_manifest_for(new_requirements)
         DependencyFile.new(
           name: manifest.name,
           content: FileUpdater::ManifestUpdater.new(
             manifest.content,
             old_requirements: old_requirements,
-            new_requirements: unlocked_requirements
-          ).updated_manifest_content
+            new_requirements: new_requirements
+          ).updated_manifest_content,
+          directory: manifest.directory
         )
       end
 
       def manifest
-        dependency_files.find { |file| file.name == "Package.swift" }
+        @manifest ||= dependency_files.find { |file| file.name == "Package.swift" }
+      end
+
+      def lockfile
+        @lockfile ||= dependency_files.find { |file| file.name == "Package.resolved" }
       end
 
       def latest_version_resolvable_with_full_unlock?
@@ -99,6 +142,25 @@ module Dependabot
       def latest_version_tag
         git_commit_checker.local_tag_for_latest_version
       end
+
+      def lowest_security_fix_version_tag
+        tags = git_commit_checker.local_tags_for_allowed_versions
+        find_lowest_secure_version(tags)
+      end
+
+      def find_lowest_secure_version(tags)
+        relevant_tags = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(tags, security_advisories)
+        relevant_tags = filter_lower_tags(relevant_tags)
+
+        relevant_tags.min_by { |tag| tag.fetch(:version) }
+      end
+
+      def filter_lower_tags(tags_array)
+        return tags_array unless current_version
+
+        tags_array.
+          select { |tag| tag.fetch(:version) > current_version }
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.223.0
+  version: 0.225.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.225.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.225.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -207,7 +207,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.223.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.225.0
 post_install_message: 
 rdoc_options: []
 require_paths: