dependabot-swift 0.367.0 → 0.369.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 050e1345f17613759ae61ddba5a92e93f52dd13ddaab6c168678bb558566fb0a
-  data.tar.gz: 7dc63505a26854e22ff196a2aaf7563faac7a95d09ae60a25bdfa7f3106e5f31
+  metadata.gz: ffba3e2d47abede16d8578f4604ab638a59d08873d56dadb884f2b7a4750714b
+  data.tar.gz: d3df9f2a33ebb10871918caa8946d284457760403bc77b772d0d6be6a435820b
 SHA512:
-  metadata.gz: 912293297d96e6dbfa87f62c95ec5dc26fbb6586f0827718be860c82fd6032a389ed452104e3c0480644cdfbdfce8b3af410385040780d00badade55915d1b57
-  data.tar.gz: 37905ccb716a12d384c91d4178a3280107f7714968bd1a4ab0f54a19b1176595ba732e5b0aa0d8f50060c5cb9e8e14f8ea1c484f1fe3516375af99824c1edbe1
+  metadata.gz: b2f8b488b086c3d49adff713335088ea164884842d7ab07e592a29231b9a462b41cc46d0c8d314afbc5b4394b0ca8b595fcfda0cc80ee50ad6384e3933ba137d
+  data.tar.gz: 94eafc46297bc99402cea427f9d8c9cf8013101912e2edb712dbc406335954a6cec2fd1b0a532857da6820a0edfe9925fcc70ac211f52d3090fbf1b2f9953051

data/lib/dependabot/swift/file_parser/pbxproj_parser.rb

@@ -34,9 +34,10 @@ module Dependabot
 
         # Patterns for extracting requirement fields
         KIND_PATTERN = T.let(/kind\s*=\s*(\w+);/, Regexp)
-        MIN_VERSION_PATTERN = T.let(/minimumVersion\s*=\s*([\d.]+);/, Regexp)
-        MAX_VERSION_PATTERN = T.let(/maximumVersion\s*=\s*([\d.]+);/, Regexp)
-        VERSION_PATTERN = T.let(/version\s*=\s*([\d.]+);/, Regexp)
+        VERSION_NUMBER_PATTERN = T.let(/[0-9A-Za-z.+-]+/, Regexp)
+        MIN_VERSION_PATTERN = T.let(/minimumVersion\s*=\s*(#{VERSION_NUMBER_PATTERN});/, Regexp)
+        MAX_VERSION_PATTERN = T.let(/maximumVersion\s*=\s*(#{VERSION_NUMBER_PATTERN});/, Regexp)
+        VERSION_PATTERN = T.let(/version\s*=\s*(#{VERSION_NUMBER_PATTERN});/, Regexp)
         BRANCH_PATTERN = T.let(/branch\s*=\s*"?([^";]+)"?;/, Regexp)
         REVISION_PATTERN = T.let(/revision\s*=\s*"?([^";]+)"?;/, Regexp)
 

data/lib/dependabot/swift/file_updater/pbxproj_updater.rb

@@ -0,0 +1,120 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/shared_helpers"
+require "dependabot/file_updaters/base"
+require "dependabot/swift/url_helpers"
+
+module Dependabot
+  module Swift
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      # Updates version requirements in project.pbxproj files for
+      # XCRemoteSwiftPackageReference entries that match the dependencies
+      # being updated. This ensures the Xcode project stays consistent
+      # with the updated Package.resolved.
+      class PbxprojUpdater
+        extend T::Sig
+
+        PACKAGE_REF_BLOCK = T.let(
+          /
+            (isa\s*=\s*XCRemoteSwiftPackageReference;\s*
+            repositoryURL\s*=\s*")
+            ([^"]+)
+            (";\s*
+            requirement\s*=\s*\{)
+            ([^}]*)
+            (\};)
+          /mx,
+          Regexp
+        )
+
+        KIND_PATTERN = T.let(/kind\s*=\s*(\w+);/, Regexp)
+        MIN_VERSION_PATTERN = T.let(/minimumVersion\s*=\s*[0-9A-Za-z.+-]+;/, Regexp)
+        VERSION_PATTERN = T.let(/\bversion\s*=\s*[0-9A-Za-z.+-]+;/, Regexp)
+
+        sig do
+          params(
+            pbxproj_file: Dependabot::DependencyFile,
+            dependencies: T::Array[Dependabot::Dependency]
+          ).void
+        end
+        def initialize(pbxproj_file:, dependencies:)
+          @pbxproj_file = pbxproj_file
+          @dependencies = dependencies
+        end
+
+        sig { returns(String) }
+        def updated_pbxproj_content
+          content = pbxproj_file.content
+          unless content
+            raise Dependabot::DependencyFileNotParseable.new(
+              pbxproj_file.name,
+              "#{pbxproj_file.name} has no content"
+            )
+          end
+
+          dep_lookup = build_dependency_lookup
+
+          content.gsub(PACKAGE_REF_BLOCK) do
+            prefix = T.must(Regexp.last_match(1))
+            url = T.must(Regexp.last_match(2))
+            mid = T.must(Regexp.last_match(3))
+            req_block = T.must(Regexp.last_match(4))
+            suffix = T.must(Regexp.last_match(5))
+
+            normalized = normalize_url(url)
+            dep = dep_lookup[normalized]
+
+            if dep&.version
+              updated_block = update_requirement_block(req_block, T.must(dep.version))
+              "#{prefix}#{url}#{mid}#{updated_block}#{suffix}"
+            else
+              T.must(Regexp.last_match(0))
+            end
+          end
+        end
+
+        private
+
+        sig { returns(Dependabot::DependencyFile) }
+        attr_reader :pbxproj_file
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(T::Hash[String, Dependabot::Dependency]) }
+        def build_dependency_lookup
+          dependencies.to_h { |dep| [dep.name, dep] }
+        end
+
+        sig { params(url: String).returns(String) }
+        def normalize_url(url)
+          UrlHelpers.normalize_name(SharedHelpers.scp_to_standard(url))
+        end
+
+        sig { params(req_block: String, target_version: String).returns(String) }
+        def update_requirement_block(req_block, target_version)
+          kind = req_block.match(KIND_PATTERN)&.captures&.first
+
+          case kind
+          when "upToNextMajorVersion", "upToNextMinorVersion", "versionRange"
+            req_block.sub(MIN_VERSION_PATTERN, "minimumVersion = #{target_version};")
+          when "exactVersion"
+            if req_block.match?(VERSION_PATTERN)
+              req_block.sub(VERSION_PATTERN, "version = #{target_version};")
+            else
+              req_block.sub(MIN_VERSION_PATTERN, "minimumVersion = #{target_version};")
+            end
+          else
+            # branch, revision, or unknown — no version update needed
+            req_block
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/swift/file_updater.rb

@@ -1,12 +1,9 @@
-# typed: strong
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/experiments"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
-require "dependabot/swift/file_updater/lockfile_updater"
-require "dependabot/swift/file_updater/manifest_updater"
-require "dependabot/swift/file_updater/xcode_lockfile_updater"
 require "dependabot/swift/xcode_file_helpers"
 
 module Dependabot
@@ -14,6 +11,11 @@ module Dependabot
     class FileUpdater < Dependabot::FileUpdaters::Base
       extend T::Sig
 
+      require_relative "file_updater/lockfile_updater"
+      require_relative "file_updater/manifest_updater"
+      require_relative "file_updater/pbxproj_updater"
+      require_relative "file_updater/xcode_lockfile_updater"
+
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         if xcode_spm_mode?
@@ -46,7 +48,7 @@ module Dependabot
         updated_files
       end
 
-      # Xcode SPM update: updates Package.resolved files in-place without CLI
+      # Xcode SPM update: updates Package.resolved and project.pbxproj files
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def updated_xcode_spm_files
         updated_files = T.let([], T::Array[Dependabot::DependencyFile])
@@ -66,6 +68,8 @@ module Dependabot
           updated_files << updated_file(file: resolved_file, content: updated_content)
         end
 
+        update_pbxproj_files(updated_files)
+
         if updated_files.empty?
           raise Dependabot::DependencyFileNotFound.new(
             nil,
@@ -109,6 +113,51 @@ module Dependabot
         )
       end
 
+      sig { params(updated_files: T::Array[Dependabot::DependencyFile]).void }
+      def update_pbxproj_files(updated_files)
+        pbxproj_files.each do |pbxproj_file|
+          scoped_dependencies = dependencies_for_pbxproj(pbxproj_file)
+          next if scoped_dependencies.empty?
+
+          updater = PbxprojUpdater.new(
+            pbxproj_file: pbxproj_file,
+            dependencies: scoped_dependencies
+          )
+          updated_content = updater.updated_pbxproj_content
+          next if updated_content == pbxproj_file.content
+
+          updated = updated_file(file: pbxproj_file, content: updated_content)
+          updated.support_file = false
+          updated_files << updated
+        end
+      end
+
+      sig do
+        params(pbxproj_file: Dependabot::DependencyFile)
+          .returns(T::Array[Dependabot::Dependency])
+      end
+      def dependencies_for_pbxproj(pbxproj_file)
+        dependencies.select do |dep|
+          requirement_files_for(dep).include?(pbxproj_file.name)
+        end
+      end
+
+      sig { params(dep: Dependabot::Dependency).returns(T::Set[String]) }
+      def requirement_files_for(dep)
+        files = dep.requirements.map { |req| req[:file] } + (dep.previous_requirements || []).map { |req| req[:file] }
+        files.compact.to_set
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def pbxproj_files
+        @pbxproj_files ||= T.let(
+          dependency_files.select do |f|
+            f.name.end_with?("project.pbxproj") && f.support_file?
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def xcode_workspace_files
         @xcode_workspace_files ||= T.let(

data/lib/dependabot/swift/update_checker/xcode_version_resolver.rb

@@ -6,6 +6,7 @@ require "dependabot/git_commit_checker"
 require "dependabot/swift/update_checker"
 require "dependabot/swift/requirement"
 require "dependabot/swift/version"
+require "dependabot/swift/xcode_file_helpers"
 require "dependabot/update_checkers/version_filters"
 
 module Dependabot
@@ -145,12 +146,32 @@ module Dependabot
           # Only versionRange has an explicit upper bound that should be respected.
           return true if %w(exactVersion upToNextMajorVersion upToNextMinorVersion).include?(kind)
 
+          # For sub-dependencies that are not declared directly in project.pbxproj
+          # (e.g., transitive dependencies of local packages), kind will be nil and
+          # the requirement comes from Package.resolved as an equality pin.
+          # In this case, we allow updates since the actual constraint lives in
+          # the local package's Package.swift, which we don't have access to.
+          # This may produce a pin that is not resolvable for the full package graph.
+          # In Xcode mode we intentionally defer that validation to downstream
+          # SwiftPM/Xcode resolution.
+          return true if kind.nil? && package_resolved_requirement?
+
           requirement = dependency_requirement
           return true unless requirement
 
           requirement.satisfied_by?(version)
         end
 
+        # Returns true if the dependency's requirement originates from an
+        # Xcode-managed Package.resolved file (rather than project.pbxproj).
+        sig { returns(T::Boolean) }
+        def package_resolved_requirement?
+          dependency.requirements.any? do |req|
+            file = req[:file]
+            file.is_a?(String) && XcodeFileHelpers.xcode_resolved_path?(file)
+          end
+        end
+
         sig do
           params(
             tags: T::Array[T::Hash[Symbol, T.untyped]]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.367.0
+  version: 0.369.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.367.0
+        version: 0.369.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.367.0
+        version: 0.369.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -252,6 +252,7 @@ files:
 - lib/dependabot/swift/file_updater.rb
 - lib/dependabot/swift/file_updater/lockfile_updater.rb
 - lib/dependabot/swift/file_updater/manifest_updater.rb
+- lib/dependabot/swift/file_updater/pbxproj_updater.rb
 - lib/dependabot/swift/file_updater/requirement_replacer.rb
 - lib/dependabot/swift/file_updater/xcode_lockfile_updater.rb
 - lib/dependabot/swift/language.rb
@@ -273,7 +274,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.367.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.369.0
 rdoc_options: []
 require_paths:
 - lib