dependabot-swift 0.366.0 → 0.367.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfecded3f835cd8011a78e5cd10c42eaf1f4a518594428a6467c64300fbe1e2a
-  data.tar.gz: a742aa0fab89643edc392546758b904c0e6b8b7a750d7886c470caed4dd46f2f
+  metadata.gz: 050e1345f17613759ae61ddba5a92e93f52dd13ddaab6c168678bb558566fb0a
+  data.tar.gz: 7dc63505a26854e22ff196a2aaf7563faac7a95d09ae60a25bdfa7f3106e5f31
 SHA512:
-  metadata.gz: 5ad87b7b2c883cb85b11d4c4f21d1ee99730b3ceff9b2d38ca6dc62e2640e854ab5036d38545a239bf387df39d9d6f81f4a77756195556bd4f0c74050bd50736
-  data.tar.gz: 9bcebc8617174bbeb25bbb92c9ab6710fcada5a749e118898937d535543d6b65dea35f210fe646682dd29bc343377a3040ad9420e2636d98fb481aea807967e3
+  metadata.gz: 912293297d96e6dbfa87f62c95ec5dc26fbb6586f0827718be860c82fd6032a389ed452104e3c0480644cdfbdfce8b3af410385040780d00badade55915d1b57
+  data.tar.gz: 37905ccb716a12d384c91d4178a3280107f7714968bd1a4ab0f54a19b1176595ba732e5b0aa0d8f50060c5cb9e8e14f8ea1c484f1fe3516375af99824c1edbe1

data/lib/dependabot/swift/update_checker/requirements_updater.rb

@@ -15,12 +15,14 @@ module Dependabot
           params(
             requirements: T::Array[T::Hash[Symbol, T.untyped]],
             target_version: T.nilable(T.any(String, Gem::Version)),
-            xcode_mode: T::Boolean
+            xcode_mode: T::Boolean,
+            target_commit_sha: T.nilable(String)
           ).void
         end
-        def initialize(requirements:, target_version:, xcode_mode: false)
+        def initialize(requirements:, target_version:, xcode_mode: false, target_commit_sha: nil)
           @requirements = requirements
           @xcode_mode = xcode_mode
+          @target_commit_sha = T.let(target_commit_sha, T.nilable(String))
 
           return unless target_version && Version.correct?(target_version)
 
@@ -47,6 +49,9 @@ module Dependabot
         sig { returns(T::Boolean) }
         attr_reader :xcode_mode
 
+        sig { returns(T.nilable(String)) }
+        attr_reader :target_commit_sha
+
         # For Xcode projects, we update the version in the requirement while preserving the kind.
         sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_xcode_requirements
@@ -67,14 +72,36 @@ module Dependabot
           new_requirement_string = build_xcode_requirement_string(requirement_string, kind)
           new_requirement = build_xcode_requirement(requirement_string, kind)
 
+          # Update source ref to target version
+          updated_source = update_source_ref(requirement[:source])
+
           requirement.merge(
             requirement: new_requirement,
+            source: updated_source,
             metadata: metadata.merge(
               requirement_string: new_requirement_string
             ).compact
           )
         end
 
+        sig do
+          params(
+            source: T.nilable(T::Hash[T.any(String, Symbol), T.untyped])
+          ).returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped]))
+        end
+        def update_source_ref(source)
+          return source unless source && target_version
+
+          # Use commit SHA if available (for revision field in Package.resolved),
+          # otherwise fall back to version string
+          ref = target_commit_sha || target_version.to_s
+
+          updated_source = source.dup
+          updated_source[:ref] = ref
+          updated_source["ref"] = ref
+          updated_source
+        end
+
         sig do
           params(
             requirement_string: T.nilable(String),

data/lib/dependabot/swift/update_checker/xcode_version_resolver.rb

@@ -34,15 +34,20 @@ module Dependabot
 
         sig { returns(T.nilable(Dependabot::Version)) }
         def latest_resolvable_version
-          return nil unless version_pinned?
-
-          tag = git_commit_checker.local_tag_for_latest_version
+          tag = latest_resolvable_version_tag
           return nil unless tag
 
-          version = tag.fetch(:version)
-          return nil unless version_meets_requirements?(version)
+          Version.new(tag.fetch(:version))
+        end
 
-          Version.new(version)
+        # Returns the full tag info including commit_sha for the latest resolvable version
+        # Memoized to avoid redundant computation when called from UpdateChecker
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def latest_resolvable_version_tag
+          @latest_resolvable_version_tag ||= T.let(
+            compute_latest_resolvable_version_tag,
+            T.nilable(T::Hash[Symbol, T.untyped])
+          )
         end
 
         sig { returns(T.nilable(Dependabot::Version)) }
@@ -80,6 +85,37 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def compute_latest_resolvable_version_tag
+          return nil unless version_pinned?
+
+          # For versionRange, we need to find the highest version within the range,
+          # not just check if the absolute latest satisfies it
+          return compute_latest_version_in_range if requirement_kind == "versionRange"
+
+          tag = git_commit_checker.local_tag_for_latest_version
+          return nil unless tag
+
+          version = tag.fetch(:version)
+          return nil unless version_meets_requirements?(version)
+
+          tag
+        end
+
+        # For versionRange requirements, find the highest version that satisfies
+        # the explicit upper bound constraint. We don't filter out lower versions here
+        # because `can_update?` will decide whether an update is actually needed.
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def compute_latest_version_in_range
+          requirement = dependency_requirement
+          return nil unless requirement
+
+          tags = git_commit_checker.local_tags_for_allowed_versions
+          matching_tags = tags.select { |tag| requirement.satisfied_by?(tag.fetch(:version)) }
+
+          matching_tags.max_by { |tag| tag.fetch(:version) }
+        end
+
         sig { returns(T.nilable(Dependabot::Swift::Requirement)) }
         def dependency_requirement
           req_string = dependency.requirements.first&.dig(:requirement)
@@ -90,8 +126,25 @@ module Dependabot
           nil
         end
 
+        sig { returns(T.nilable(String)) }
+        def requirement_kind
+          dependency.requirements.first&.dig(:metadata, :kind)
+        end
+
         sig { params(version: T.untyped).returns(T::Boolean) }
         def version_meets_requirements?(version)
+          kind = requirement_kind
+
+          # For most Xcode requirement kinds, we update the requirement itself to match
+          # the new version, so we don't need to check if the new version satisfies
+          # the current requirement:
+          # - exactVersion: requirement changes to exact new version
+          # - upToNextMajorVersion: requirement updates to new version's major range
+          # - upToNextMinorVersion: requirement updates to new version's minor range
+          #
+          # Only versionRange has an explicit upper bound that should be respected.
+          return true if %w(exactVersion upToNextMajorVersion upToNextMinorVersion).include?(kind)
+
           requirement = dependency_requirement
           return true unless requirement
 

data/lib/dependabot/swift/update_checker.rb

@@ -74,10 +74,22 @@ module Dependabot
         target = preferred_resolvable_version
         return old_requirements unless target
 
+        # Only use the "latest" tag's commit SHA when the chosen target version
+        # is actually the latest resolvable version. This avoids attaching a
+        # mismatched SHA when preferred_resolvable_version selects a different
+        # version (for example, the lowest resolvable security-fix version).
+        commit_sha = nil
+        latest = latest_resolvable_version
+        if latest && target == latest
+          tag = xcode_version_resolver.latest_resolvable_version_tag
+          commit_sha = tag&.fetch(:commit_sha, nil)
+        end
+
         RequirementsUpdater.new(
           requirements: old_requirements,
           target_version: target,
-          xcode_mode: true
+          xcode_mode: true,
+          target_commit_sha: commit_sha
         ).updated_requirements
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.366.0
+  version: 0.367.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.366.0
+        version: 0.367.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.366.0
+        version: 0.367.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -273,7 +273,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.366.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.367.0
 rdoc_options: []
 require_paths:
 - lib