dependabot-swift 0.223.0 → 0.224.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9c4d7a75751290497fd09eb0dc26f82ca32b29246bf0d07fabe6c71a9af64f2
-  data.tar.gz: b84e6a5b45b30892f35e2033dc4b57cbb172b3f3f006f2b71f17c7fa4d7463f3
+  metadata.gz: daa823cdb9f7cf8a02a3ae2db25b54b941c87b80c57633c9c2a6e3c09cf2af9d
+  data.tar.gz: 59a6217a928b15e42b033c987cb7e52572961699cd9b78a6b137e88c21d7ccef
 SHA512:
-  metadata.gz: a7fb390b84f5159787be751f8b30815918a76f86a3433961811c6647d2ede4bb1cce2ec201665dce979eafb35b06646c884d4400a313817f18a4a2855fc459b7
-  data.tar.gz: c47f6f424a89188321c59fa5e9401cab4a821c3c80418e5bc7ae7f9b3ec555b1d11e8f525487516659791513fc10e381aee15663baf6b70f731fd849a3c2b5ef
+  metadata.gz: 4ed7d0edc5cf21554321deb0ef4b5ba1caf36878af28c6a36129d60d016f657706d5dfe516ec6c4082fcc68a3007ed6725e2f18840dc2f72a1bb1dc584043818
+  data.tar.gz: 929239d17f49f5260cd217deba666429de17e93afb2c4b970496fa4f0656d4ce9fe3515de067995e087ccb4ea97388156b048cb2f1ebe9948b221f062381d132

data/lib/dependabot/swift/file_updater/lockfile_updater.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/file_updaters/base"
 require "dependabot/shared_helpers"
+require "dependabot/logger"
 
 module Dependabot
   module Swift
@@ -18,11 +19,10 @@ module Dependabot
           SharedHelpers.in_a_temporary_repo_directory(manifest.directory, repo_contents_path) do
             File.write(manifest.name, manifest.content)
 
+            dependency_names = dependencies.map(&:name).join(" ")
+
             SharedHelpers.with_git_configured(credentials: credentials) do
-              SharedHelpers.run_shell_command(
-                "swift package update #{dependencies.map(&:name).join(' ')}",
-                fingerprint: "swift package update <dependency_name>"
-              )
+              try_lockfile_update(dependency_names)
 
               File.read("Package.resolved")
             end
@@ -31,6 +31,19 @@ module Dependabot
 
         private
 
+        def try_lockfile_update(dependency_names)
+          SharedHelpers.run_shell_command(
+            "swift package update #{dependency_names}",
+            fingerprint: "swift package update <dependency_names>"
+          )
+        rescue SharedHelpers::HelperSubprocessFailed => e
+          # This class is not only used for final lockfile updates, but for
+          # checking resolvability. So resolvability errors here are expected in
+          # certain situations and will result in `no_update_possible` outcomes.
+          # That said, since we're swallowing all errors we at least log them to ease debugging.
+          Dependabot.logger.info("Lockfile failed to be updated due to error:\n#{e.message}")
+        end
+
         attr_reader :dependencies, :manifest, :repo_contents_path, :credentials
       end
     end

data/lib/dependabot/swift/native_requirement.rb

@@ -90,7 +90,7 @@ module Dependabot
       end
 
       def parse_range(separator)
-        declaration.split(separator).map { |str| unquote(str) }
+        declaration.split(separator).map { |str| unquote(str.strip) }
       end
 
       def single_version_declaration?

data/lib/dependabot/swift/update_checker/version_resolver.rb

@@ -8,9 +8,10 @@ module Dependabot
   module Swift
     class UpdateChecker < Dependabot::UpdateCheckers::Base
       class VersionResolver
-        def initialize(dependency:, manifest:, repo_contents_path:, credentials:)
+        def initialize(dependency:, manifest:, lockfile:, repo_contents_path:, credentials:)
           @dependency         = dependency
           @manifest           = manifest
+          @lockfile           = lockfile
           @credentials        = credentials
           @repo_contents_path = repo_contents_path
         end
@@ -29,12 +30,14 @@ module Dependabot
             credentials: credentials
           ).updated_lockfile_content
 
-          lockfile = DependencyFile.new(
+          return if updated_lockfile_content == lockfile.content
+
+          updated_lockfile = DependencyFile.new(
             name: "Package.resolved",
             content: updated_lockfile_content
           )
 
-          dependency_parser(manifest, lockfile).parse.find do |parsed_dep|
+          dependency_parser(manifest, updated_lockfile).parse.find do |parsed_dep|
             parsed_dep.name == dependency.name
           end.version
         end
@@ -47,7 +50,7 @@ module Dependabot
           )
         end
 
-        attr_reader :dependency, :manifest, :repo_contents_path, :credentials
+        attr_reader :dependency, :manifest, :lockfile, :repo_contents_path, :credentials
       end
     end
   end

data/lib/dependabot/swift/update_checker.rb

@@ -2,6 +2,7 @@
 
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
+require "dependabot/update_checkers/version_filters"
 require "dependabot/git_commit_checker"
 require "dependabot/swift/native_requirement"
 require "dependabot/swift/file_updater/manifest_updater"
@@ -24,6 +25,18 @@ module Dependabot
         raise NotImplementedError
       end
 
+      def lowest_security_fix_version
+        @lowest_security_fix_version ||= fetch_lowest_security_fix_version
+      end
+
+      def lowest_resolvable_security_fix_version
+        raise "Dependency not vulnerable!" unless vulnerable?
+
+        return @lowest_resolvable_security_fix_version if defined?(@lowest_resolvable_security_fix_version)
+
+        @lowest_resolvable_security_fix_version = fetch_lowest_resolvable_security_fix_version
+      end
+
       def updated_requirements
         RequirementsUpdater.new(
           requirements: old_requirements,
@@ -43,14 +56,33 @@ module Dependabot
         latest_version_tag.fetch(:version)
       end
 
+      def fetch_lowest_security_fix_version
+        return unless git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
+
+        lowest_security_fix_version_tag.fetch(:version)
+      end
+
       def fetch_latest_resolvable_version
-        Version.new(version_resolver.latest_resolvable_version)
+        latest_resolvable_version = version_resolver_for(unlocked_requirements).latest_resolvable_version
+        return current_version unless latest_resolvable_version
+
+        Version.new(latest_resolvable_version)
+      end
+
+      def fetch_lowest_resolvable_security_fix_version
+        lowest_resolvable_security_fix_version = version_resolver_for(
+          force_lowest_security_fix_requirements
+        ).latest_resolvable_version
+        return unless lowest_resolvable_security_fix_version
+
+        Version.new(lowest_resolvable_security_fix_version)
       end
 
-      def version_resolver
+      def version_resolver_for(requirements)
         VersionResolver.new(
           dependency: dependency,
-          manifest: prepared_manifest,
+          manifest: prepare_manifest_for(requirements),
+          lockfile: lockfile,
           repo_contents_path: repo_contents_path,
           credentials: credentials
         )
@@ -62,19 +94,29 @@ module Dependabot
         end
       end
 
-      def prepared_manifest
+      def force_lowest_security_fix_requirements
+        NativeRequirement.map_requirements(old_requirements) do |_old_requirement|
+          "\"#{lowest_security_fix_version}\"...\"#{lowest_security_fix_version}\""
+        end
+      end
+
+      def prepare_manifest_for(new_requirements)
         DependencyFile.new(
           name: manifest.name,
           content: FileUpdater::ManifestUpdater.new(
             manifest.content,
             old_requirements: old_requirements,
-            new_requirements: unlocked_requirements
+            new_requirements: new_requirements
           ).updated_manifest_content
         )
       end
 
       def manifest
-        dependency_files.find { |file| file.name == "Package.swift" }
+        @manifest ||= dependency_files.find { |file| file.name == "Package.swift" }
+      end
+
+      def lockfile
+        @lockfile ||= dependency_files.find { |file| file.name == "Package.resolved" }
       end
 
       def latest_version_resolvable_with_full_unlock?
@@ -99,6 +141,25 @@ module Dependabot
       def latest_version_tag
         git_commit_checker.local_tag_for_latest_version
       end
+
+      def lowest_security_fix_version_tag
+        tags = git_commit_checker.local_tags_for_allowed_versions
+        find_lowest_secure_version(tags)
+      end
+
+      def find_lowest_secure_version(tags)
+        relevant_tags = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(tags, security_advisories)
+        relevant_tags = filter_lower_tags(relevant_tags)
+
+        relevant_tags.min_by { |tag| tag.fetch(:version) }
+      end
+
+      def filter_lower_tags(tags_array)
+        return tags_array unless current_version
+
+        tags_array.
+          select { |tag| tag.fetch(:version) > current_version }
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.223.0
+  version: 0.224.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-25 00:00:00.000000000 Z
+date: 2023-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.224.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.223.0
+        version: 0.224.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -207,7 +207,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.223.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.224.0
 post_install_message: 
 rdoc_options: []
 require_paths: