dependabot-swift 0.366.0 → 0.368.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfecded3f835cd8011a78e5cd10c42eaf1f4a518594428a6467c64300fbe1e2a
-  data.tar.gz: a742aa0fab89643edc392546758b904c0e6b8b7a750d7886c470caed4dd46f2f
+  metadata.gz: '058280369adb6c289d2f489441966b3a1388d034dc13aca3c65aa8d12b19a0de'
+  data.tar.gz: 01c2cf4b8a1b9cbc0d8f7adb61d6d5d50340b76ad9bc4956aa993ad941d3b66b
 SHA512:
-  metadata.gz: 5ad87b7b2c883cb85b11d4c4f21d1ee99730b3ceff9b2d38ca6dc62e2640e854ab5036d38545a239bf387df39d9d6f81f4a77756195556bd4f0c74050bd50736
-  data.tar.gz: 9bcebc8617174bbeb25bbb92c9ab6710fcada5a749e118898937d535543d6b65dea35f210fe646682dd29bc343377a3040ad9420e2636d98fb481aea807967e3
+  metadata.gz: 2ff6fe44d399d5d0b2bad6cd86930522217382c0987dcc613d28f6f275a0e204e38049f6cdc987c16ac212eab39b5dd517a98d3538eb7e9d07a9be81d3189ee1
+  data.tar.gz: 3eca296a8d786017decc79a8eccc0f902f84216daba17c42d849bd5a02c380c6435f067c9474c94167fe77fadb21288a2767a179456dc607024a717c9758e882

data/lib/dependabot/swift/file_parser/pbxproj_parser.rb

@@ -34,9 +34,10 @@ module Dependabot
 
         # Patterns for extracting requirement fields
         KIND_PATTERN = T.let(/kind\s*=\s*(\w+);/, Regexp)
-        MIN_VERSION_PATTERN = T.let(/minimumVersion\s*=\s*([\d.]+);/, Regexp)
-        MAX_VERSION_PATTERN = T.let(/maximumVersion\s*=\s*([\d.]+);/, Regexp)
-        VERSION_PATTERN = T.let(/version\s*=\s*([\d.]+);/, Regexp)
+        VERSION_NUMBER_PATTERN = T.let(/[0-9A-Za-z.+-]+/, Regexp)
+        MIN_VERSION_PATTERN = T.let(/minimumVersion\s*=\s*(#{VERSION_NUMBER_PATTERN});/, Regexp)
+        MAX_VERSION_PATTERN = T.let(/maximumVersion\s*=\s*(#{VERSION_NUMBER_PATTERN});/, Regexp)
+        VERSION_PATTERN = T.let(/version\s*=\s*(#{VERSION_NUMBER_PATTERN});/, Regexp)
         BRANCH_PATTERN = T.let(/branch\s*=\s*"?([^";]+)"?;/, Regexp)
         REVISION_PATTERN = T.let(/revision\s*=\s*"?([^";]+)"?;/, Regexp)
 

data/lib/dependabot/swift/file_updater/pbxproj_updater.rb

@@ -0,0 +1,120 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/shared_helpers"
+require "dependabot/file_updaters/base"
+require "dependabot/swift/url_helpers"
+
+module Dependabot
+  module Swift
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      # Updates version requirements in project.pbxproj files for
+      # XCRemoteSwiftPackageReference entries that match the dependencies
+      # being updated. This ensures the Xcode project stays consistent
+      # with the updated Package.resolved.
+      class PbxprojUpdater
+        extend T::Sig
+
+        PACKAGE_REF_BLOCK = T.let(
+          /
+            (isa\s*=\s*XCRemoteSwiftPackageReference;\s*
+            repositoryURL\s*=\s*")
+            ([^"]+)
+            (";\s*
+            requirement\s*=\s*\{)
+            ([^}]*)
+            (\};)
+          /mx,
+          Regexp
+        )
+
+        KIND_PATTERN = T.let(/kind\s*=\s*(\w+);/, Regexp)
+        MIN_VERSION_PATTERN = T.let(/minimumVersion\s*=\s*[0-9A-Za-z.+-]+;/, Regexp)
+        VERSION_PATTERN = T.let(/\bversion\s*=\s*[0-9A-Za-z.+-]+;/, Regexp)
+
+        sig do
+          params(
+            pbxproj_file: Dependabot::DependencyFile,
+            dependencies: T::Array[Dependabot::Dependency]
+          ).void
+        end
+        def initialize(pbxproj_file:, dependencies:)
+          @pbxproj_file = pbxproj_file
+          @dependencies = dependencies
+        end
+
+        sig { returns(String) }
+        def updated_pbxproj_content
+          content = pbxproj_file.content
+          unless content
+            raise Dependabot::DependencyFileNotParseable.new(
+              pbxproj_file.name,
+              "#{pbxproj_file.name} has no content"
+            )
+          end
+
+          dep_lookup = build_dependency_lookup
+
+          content.gsub(PACKAGE_REF_BLOCK) do
+            prefix = T.must(Regexp.last_match(1))
+            url = T.must(Regexp.last_match(2))
+            mid = T.must(Regexp.last_match(3))
+            req_block = T.must(Regexp.last_match(4))
+            suffix = T.must(Regexp.last_match(5))
+
+            normalized = normalize_url(url)
+            dep = dep_lookup[normalized]
+
+            if dep&.version
+              updated_block = update_requirement_block(req_block, T.must(dep.version))
+              "#{prefix}#{url}#{mid}#{updated_block}#{suffix}"
+            else
+              T.must(Regexp.last_match(0))
+            end
+          end
+        end
+
+        private
+
+        sig { returns(Dependabot::DependencyFile) }
+        attr_reader :pbxproj_file
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(T::Hash[String, Dependabot::Dependency]) }
+        def build_dependency_lookup
+          dependencies.to_h { |dep| [dep.name, dep] }
+        end
+
+        sig { params(url: String).returns(String) }
+        def normalize_url(url)
+          UrlHelpers.normalize_name(SharedHelpers.scp_to_standard(url))
+        end
+
+        sig { params(req_block: String, target_version: String).returns(String) }
+        def update_requirement_block(req_block, target_version)
+          kind = req_block.match(KIND_PATTERN)&.captures&.first
+
+          case kind
+          when "upToNextMajorVersion", "upToNextMinorVersion", "versionRange"
+            req_block.sub(MIN_VERSION_PATTERN, "minimumVersion = #{target_version};")
+          when "exactVersion"
+            if req_block.match?(VERSION_PATTERN)
+              req_block.sub(VERSION_PATTERN, "version = #{target_version};")
+            else
+              req_block.sub(MIN_VERSION_PATTERN, "minimumVersion = #{target_version};")
+            end
+          else
+            # branch, revision, or unknown — no version update needed
+            req_block
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/swift/file_updater.rb

@@ -1,12 +1,9 @@
-# typed: strong
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/experiments"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
-require "dependabot/swift/file_updater/lockfile_updater"
-require "dependabot/swift/file_updater/manifest_updater"
-require "dependabot/swift/file_updater/xcode_lockfile_updater"
 require "dependabot/swift/xcode_file_helpers"
 
 module Dependabot
@@ -14,6 +11,11 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       extend T::Sig
 
+      require_relative "file_updater/lockfile_updater"
+      require_relative "file_updater/manifest_updater"
+      require_relative "file_updater/pbxproj_updater"
+      require_relative "file_updater/xcode_lockfile_updater"
+
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         if xcode_spm_mode?
@@ -46,7 +48,7 @@ module Dependabot
         updated_files
       end
 
-      # Xcode SPM update: updates Package.resolved files in-place without CLI
+      # Xcode SPM update: updates Package.resolved and project.pbxproj files
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def updated_xcode_spm_files
         updated_files = T.let([], T::Array[Dependabot::DependencyFile])
@@ -66,6 +68,8 @@ module Dependabot
           updated_files << updated_file(file: resolved_file, content: updated_content)
         end
 
+        update_pbxproj_files(updated_files)
+
         if updated_files.empty?
           raise Dependabot::DependencyFileNotFound.new(
             nil,
@@ -109,6 +113,51 @@ module Dependabot
         )
       end
 
+      sig { params(updated_files: T::Array[Dependabot::DependencyFile]).void }
+      def update_pbxproj_files(updated_files)
+        pbxproj_files.each do |pbxproj_file|
+          scoped_dependencies = dependencies_for_pbxproj(pbxproj_file)
+          next if scoped_dependencies.empty?
+
+          updater = PbxprojUpdater.new(
+            pbxproj_file: pbxproj_file,
+            dependencies: scoped_dependencies
+          )
+          updated_content = updater.updated_pbxproj_content
+          next if updated_content == pbxproj_file.content
+
+          updated = updated_file(file: pbxproj_file, content: updated_content)
+          updated.support_file = false
+          updated_files << updated
+        end
+      end
+
+      sig do
+        params(pbxproj_file: Dependabot::DependencyFile)
+          .returns(T::Array[Dependabot::Dependency])
+      end
+      def dependencies_for_pbxproj(pbxproj_file)
+        dependencies.select do |dep|
+          requirement_files_for(dep).include?(pbxproj_file.name)
+        end
+      end
+
+      sig { params(dep: Dependabot::Dependency).returns(T::Set[String]) }
+      def requirement_files_for(dep)
+        files = dep.requirements.map { |req| req[:file] } + (dep.previous_requirements || []).map { |req| req[:file] }
+        files.compact.to_set
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def pbxproj_files
+        @pbxproj_files ||= T.let(
+          dependency_files.select do |f|
+            f.name.end_with?("project.pbxproj") && f.support_file?
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def xcode_workspace_files
         @xcode_workspace_files ||= T.let(

data/lib/dependabot/swift/update_checker/requirements_updater.rb

@@ -15,12 +15,14 @@ module Dependabot
           params(
             requirements: T::Array[T::Hash[Symbol, T.untyped]],
             target_version: T.nilable(T.any(String, Gem::Version)),
-            xcode_mode: T::Boolean
+            xcode_mode: T::Boolean,
+            target_commit_sha: T.nilable(String)
           ).void
         end
-        def initialize(requirements:, target_version:, xcode_mode: false)
+        def initialize(requirements:, target_version:, xcode_mode: false, target_commit_sha: nil)
           @requirements = requirements
           @xcode_mode = xcode_mode
+          @target_commit_sha = T.let(target_commit_sha, T.nilable(String))
 
           return unless target_version && Version.correct?(target_version)
 
@@ -47,6 +49,9 @@ module Dependabot
         sig { returns(T::Boolean) }
         attr_reader :xcode_mode
 
+        sig { returns(T.nilable(String)) }
+        attr_reader :target_commit_sha
+
         # For Xcode projects, we update the version in the requirement while preserving the kind.
         sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_xcode_requirements
@@ -67,14 +72,36 @@ module Dependabot
           new_requirement_string = build_xcode_requirement_string(requirement_string, kind)
           new_requirement = build_xcode_requirement(requirement_string, kind)
 
+          # Update source ref to target version
+          updated_source = update_source_ref(requirement[:source])
+
           requirement.merge(
             requirement: new_requirement,
+            source: updated_source,
             metadata: metadata.merge(
               requirement_string: new_requirement_string
             ).compact
           )
         end
 
+        sig do
+          params(
+            source: T.nilable(T::Hash[T.any(String, Symbol), T.untyped])
+          ).returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped]))
+        end
+        def update_source_ref(source)
+          return source unless source && target_version
+
+          # Use commit SHA if available (for revision field in Package.resolved),
+          # otherwise fall back to version string
+          ref = target_commit_sha || target_version.to_s
+
+          updated_source = source.dup
+          updated_source[:ref] = ref
+          updated_source["ref"] = ref
+          updated_source
+        end
+
         sig do
           params(
             requirement_string: T.nilable(String),

data/lib/dependabot/swift/update_checker/xcode_version_resolver.rb

@@ -34,15 +34,20 @@ module Dependabot
 
         sig { returns(T.nilable(Dependabot::Version)) }
         def latest_resolvable_version
-          return nil unless version_pinned?
-
-          tag = git_commit_checker.local_tag_for_latest_version
+          tag = latest_resolvable_version_tag
           return nil unless tag
 
-          version = tag.fetch(:version)
-          return nil unless version_meets_requirements?(version)
+          Version.new(tag.fetch(:version))
+        end
 
-          Version.new(version)
+        # Returns the full tag info including commit_sha for the latest resolvable version
+        # Memoized to avoid redundant computation when called from UpdateChecker
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def latest_resolvable_version_tag
+          @latest_resolvable_version_tag ||= T.let(
+            compute_latest_resolvable_version_tag,
+            T.nilable(T::Hash[Symbol, T.untyped])
+          )
         end
 
         sig { returns(T.nilable(Dependabot::Version)) }
@@ -80,6 +85,37 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def compute_latest_resolvable_version_tag
+          return nil unless version_pinned?
+
+          # For versionRange, we need to find the highest version within the range,
+          # not just check if the absolute latest satisfies it
+          return compute_latest_version_in_range if requirement_kind == "versionRange"
+
+          tag = git_commit_checker.local_tag_for_latest_version
+          return nil unless tag
+
+          version = tag.fetch(:version)
+          return nil unless version_meets_requirements?(version)
+
+          tag
+        end
+
+        # For versionRange requirements, find the highest version that satisfies
+        # the explicit upper bound constraint. We don't filter out lower versions here
+        # because `can_update?` will decide whether an update is actually needed.
+        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        def compute_latest_version_in_range
+          requirement = dependency_requirement
+          return nil unless requirement
+
+          tags = git_commit_checker.local_tags_for_allowed_versions
+          matching_tags = tags.select { |tag| requirement.satisfied_by?(tag.fetch(:version)) }
+
+          matching_tags.max_by { |tag| tag.fetch(:version) }
+        end
+
         sig { returns(T.nilable(Dependabot::Swift::Requirement)) }
         def dependency_requirement
           req_string = dependency.requirements.first&.dig(:requirement)
@@ -90,8 +126,25 @@ module Dependabot
           nil
         end
 
+        sig { returns(T.nilable(String)) }
+        def requirement_kind
+          dependency.requirements.first&.dig(:metadata, :kind)
+        end
+
         sig { params(version: T.untyped).returns(T::Boolean) }
         def version_meets_requirements?(version)
+          kind = requirement_kind
+
+          # For most Xcode requirement kinds, we update the requirement itself to match
+          # the new version, so we don't need to check if the new version satisfies
+          # the current requirement:
+          # - exactVersion: requirement changes to exact new version
+          # - upToNextMajorVersion: requirement updates to new version's major range
+          # - upToNextMinorVersion: requirement updates to new version's minor range
+          #
+          # Only versionRange has an explicit upper bound that should be respected.
+          return true if %w(exactVersion upToNextMajorVersion upToNextMinorVersion).include?(kind)
+
           requirement = dependency_requirement
           return true unless requirement
 

data/lib/dependabot/swift/update_checker.rb

@@ -74,10 +74,22 @@ module Dependabot
         target = preferred_resolvable_version
         return old_requirements unless target
 
+        # Only use the "latest" tag's commit SHA when the chosen target version
+        # is actually the latest resolvable version. This avoids attaching a
+        # mismatched SHA when preferred_resolvable_version selects a different
+        # version (for example, the lowest resolvable security-fix version).
+        commit_sha = nil
+        latest = latest_resolvable_version
+        if latest && target == latest
+          tag = xcode_version_resolver.latest_resolvable_version_tag
+          commit_sha = tag&.fetch(:commit_sha, nil)
+        end
+
         RequirementsUpdater.new(
           requirements: old_requirements,
           target_version: target,
-          xcode_mode: true
+          xcode_mode: true,
+          target_commit_sha: commit_sha
         ).updated_requirements
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.366.0
+  version: 0.368.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.366.0
+        version: 0.368.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.366.0
+        version: 0.368.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -252,6 +252,7 @@ files:
 - lib/dependabot/swift/file_updater.rb
 - lib/dependabot/swift/file_updater/lockfile_updater.rb
 - lib/dependabot/swift/file_updater/manifest_updater.rb
+- lib/dependabot/swift/file_updater/pbxproj_updater.rb
 - lib/dependabot/swift/file_updater/requirement_replacer.rb
 - lib/dependabot/swift/file_updater/xcode_lockfile_updater.rb
 - lib/dependabot/swift/language.rb
@@ -273,7 +274,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.366.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.368.0
 rdoc_options: []
 require_paths:
 - lib