dependabot-swift 0.364.0 → 0.365.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 363036340485e20146d3722b2d6e5636fa4c0ff007002301ebc72fdda60a9014
-  data.tar.gz: 5d938a9377d8900d3d422c76e66d6955787f40d6d39ec7f7c1fd6bc8123d374c
+  metadata.gz: 35c7a26b4868b5df0a08396136836264f47a3e1d97219ceb705698bb1eae21f3
+  data.tar.gz: 3c22d53cfb502e71c17ba6edc2d5d0d6b6dbbfc92fdbfb9fc897579d6c15269f
 SHA512:
-  metadata.gz: 9bc68ec95a147b232bf55779657fd7ce94e3d957a8f483ba5596bcb1cfd5c950daf1f25718aa1bee501c9cfeff07fb1434ac766b4702d38f2930012ce1d18438
-  data.tar.gz: c44d03021e516a1b6e854cfece42f3de2ad37543f4634774447db6943e9ae217e2118212baad943fd18ed475c20d0e9142aca4b81629f17908298ca104260b7e
+  metadata.gz: 919317db274d1166b9ad1fb3118e24ed162051839faf392963510986637805dcbd7f5a991f3e7256ee4ad09b626da1aafe133939b91fe35edf00edb7b15600b6
+  data.tar.gz: 98b040a728cfa847e5f8ba4474bbf64ef335e47141f94caad1c0a8e9f693a2bc396c2664143ca8f822f599c16ecab8fff8f7a45f66ae29af971df2d3847fdd32

data/lib/dependabot/swift/file_parser/dependency_parser.rb

@@ -5,8 +5,8 @@ require "sorbet-runtime"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
 require "dependabot/dependency"
+require "dependabot/swift/url_helpers"
 require "json"
-require "uri"
 
 module Dependabot
   module Swift
@@ -79,7 +79,7 @@ module Dependabot
         def all_dependencies(data, level: 0)
           identity = data["identity"]
           url = SharedHelpers.scp_to_standard(data["url"])
-          name = normalize(url)
+          name = UrlHelpers.normalize_name(url)
           version = data["version"]
 
           source = { type: "git", url: url, ref: version, branch: nil }
@@ -97,13 +97,6 @@ module Dependabot
           [dep, *subdependencies(data, level: level + 1)].compact
         end
 
-        sig { params(source: String).returns(String) }
-        def normalize(source)
-          uri = URI.parse(source.downcase)
-
-          "#{uri.host}#{uri.path}".delete_prefix("www.").delete_suffix(".git")
-        end
-
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :dependency_files
 

data/lib/dependabot/swift/file_parser/package_resolved_parser.rb

@@ -0,0 +1,165 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/errors"
+require "dependabot/shared_helpers"
+require "dependabot/swift/file_parser"
+require "dependabot/swift/url_helpers"
+
+module Dependabot
+  module Swift
+    class FileParser < Dependabot::FileParsers::Base
+      class PackageResolvedParser
+        extend T::Sig
+
+        SUPPORTED_VERSIONS = T.let([1, 2, 3].freeze, T::Array[Integer])
+
+        # Maps schema version to the JSON keys used for each pin field
+        PIN_KEYS = T.let(
+          {
+            1 => { url: "repositoryURL", identity: "package", state: "state" },
+            2 => { url: "location", identity: "identity", state: "state" },
+            3 => { url: "location", identity: "identity", state: "state" }
+          }.freeze,
+          T::Hash[Integer, T::Hash[Symbol, String]]
+        )
+
+        sig { params(resolved_file: Dependabot::DependencyFile).void }
+        def initialize(resolved_file)
+          @resolved_file = resolved_file
+        end
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        def parse
+          parsed = parse_json
+          schema_version = detect_schema_version(parsed)
+          pins = extract_pins(parsed, schema_version)
+
+          pins.filter_map { |pin| build_dependency(pin, schema_version) }
+        end
+
+        private
+
+        sig { returns(Dependabot::DependencyFile) }
+        attr_reader :resolved_file
+
+        sig { returns(T::Hash[String, T.untyped]) }
+        def parse_json
+          content = resolved_file.content
+          unless content
+            raise Dependabot::DependencyFileNotParseable.new(
+              resolved_file.name,
+              "#{resolved_file.name} has no content"
+            )
+          end
+
+          JSON.parse(content)
+        rescue JSON::ParserError => e
+          raise Dependabot::DependencyFileNotParseable.new(
+            resolved_file.name,
+            "#{resolved_file.name} is not valid JSON: #{e.message}"
+          )
+        end
+
+        sig { params(parsed: T::Hash[String, T.untyped]).returns(Integer) }
+        def detect_schema_version(parsed)
+          version = parsed["version"]
+
+          unless version.is_a?(Integer) && SUPPORTED_VERSIONS.include?(version)
+            raise Dependabot::DependencyFileNotParseable.new(
+              resolved_file.name,
+              "#{resolved_file.name} has unsupported schema version: #{version.inspect}. " \
+              "Supported versions: #{SUPPORTED_VERSIONS.join(', ')}"
+            )
+          end
+
+          version
+        end
+
+        sig do
+          params(
+            parsed: T::Hash[String, T.untyped],
+            schema_version: Integer
+          ).returns(T::Array[T::Hash[String, T.untyped]])
+        end
+        def extract_pins(parsed, schema_version)
+          pins = if schema_version == 1
+                   parsed.dig("object", "pins")
+                 else
+                   # v2 and v3 use the same top-level "pins" key
+                   parsed["pins"]
+                 end
+
+          unless pins.is_a?(Array)
+            raise Dependabot::DependencyFileNotParseable.new(
+              resolved_file.name,
+              "#{resolved_file.name} is missing the expected 'pins' array " \
+              "(schema version #{schema_version})"
+            )
+          end
+
+          pins
+        end
+
+        sig do
+          params(
+            pin: T::Hash[String, T.untyped],
+            schema_version: Integer
+          ).returns(T.nilable(Dependabot::Dependency))
+        end
+        def build_dependency(pin, schema_version)
+          keys = T.must(PIN_KEYS[schema_version])
+          url = pin[T.must(keys[:url])]
+          return nil unless url.is_a?(String) && !url.empty?
+
+          state = pin[T.must(keys[:state])] || {}
+          identity = pin[T.must(keys[:identity])]
+          # v1 uses a display name for "package"; normalize to lowercase like v2/v3 "identity".
+          # v2/v3 identity is always lowercase per spec, so only v1 needs downcasing.
+          identity = identity&.downcase if schema_version == 1
+
+          build_dependency_object(
+            identity: identity,
+            url: url,
+            version: state["version"],
+            revision: state["revision"],
+            branch: state["branch"]
+          )
+        end
+
+        sig do
+          params(
+            identity: T.nilable(String),
+            url: String,
+            version: T.nilable(String),
+            revision: T.nilable(String),
+            branch: T.nilable(String)
+          ).returns(T.nilable(Dependabot::Dependency))
+        end
+        def build_dependency_object(identity:, url:, version:, revision:, branch:)
+          normalized_url = SharedHelpers.scp_to_standard(url)
+          name = UrlHelpers.normalize_name(normalized_url)
+          ref = version || revision
+
+          source = { type: "git", url: normalized_url, ref: ref, branch: branch }
+
+          Dependency.new(
+            name: name,
+            version: version,
+            package_manager: "swift",
+            requirements: [{
+              requirement: version ? "= #{version}" : nil,
+              groups: ["dependencies"],
+              file: resolved_file.name,
+              source: source
+            }],
+            metadata: { identity: identity }
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/swift/file_parser/pbxproj_parser.rb

@@ -0,0 +1,199 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/errors"
+require "dependabot/shared_helpers"
+require "dependabot/swift/file_parser"
+require "dependabot/swift/native_requirement"
+require "dependabot/swift/url_helpers"
+
+module Dependabot
+  module Swift
+    class FileParser < Dependabot::FileParsers::Base
+      # Parses XCRemoteSwiftPackageReference entries from a project.pbxproj file
+      # to extract dependency requirement constraints declared in Xcode.
+      #
+      # Returns a hash keyed by normalized dependency name (e.g. "github.com/owner/repo")
+      # mapping to requirement metadata, so the main parser can enrich
+      # Package.resolved dependencies with requirement info from the Xcode project.
+      class PbxprojParser
+        extend T::Sig
+
+        # Regex to extract XCRemoteSwiftPackageReference blocks from pbxproj.
+        # Uses [^}]* to match the requirement block content — this is safe because
+        # Xcode requirement blocks are always flat dictionaries with no nested braces.
+        PACKAGE_REF_BLOCK = T.let(
+          /
+            isa\s*=\s*XCRemoteSwiftPackageReference;\s*
+            repositoryURL\s*=\s*"(?<url>[^"]+)";\s*
+            requirement\s*=\s*\{(?<requirement>[^}]*)\};
+          /mx,
+          Regexp
+        )
+
+        # Patterns for extracting requirement fields
+        KIND_PATTERN = T.let(/kind\s*=\s*(\w+);/, Regexp)
+        MIN_VERSION_PATTERN = T.let(/minimumVersion\s*=\s*([\d.]+);/, Regexp)
+        MAX_VERSION_PATTERN = T.let(/maximumVersion\s*=\s*([\d.]+);/, Regexp)
+        VERSION_PATTERN = T.let(/version\s*=\s*([\d.]+);/, Regexp)
+        BRANCH_PATTERN = T.let(/branch\s*=\s*"?([^";]+)"?;/, Regexp)
+        REVISION_PATTERN = T.let(/revision\s*=\s*"?([^";]+)"?;/, Regexp)
+
+        sig { params(pbxproj_file: Dependabot::DependencyFile).void }
+        def initialize(pbxproj_file)
+          @pbxproj_file = pbxproj_file
+        end
+
+        # Returns a hash mapping normalized URL to requirement metadata.
+        # Each entry includes the Dependabot requirement string and the raw
+        # Xcode requirement kind/version info for use in metadata.
+        sig { returns(T::Hash[String, T::Hash[Symbol, T.untyped]]) }
+        def parse
+          content = pbxproj_file.content
+          return {} unless content
+
+          requirements = T.let({}, T::Hash[String, T::Hash[Symbol, T.untyped]])
+
+          content.scan(PACKAGE_REF_BLOCK).each do |url, requirement_block|
+            url = T.cast(url, String)
+            requirement_block = T.cast(requirement_block, String)
+            normalized_url = SharedHelpers.scp_to_standard(url)
+            name = UrlHelpers.normalize_name(normalized_url)
+
+            req_info = parse_requirement_block(requirement_block)
+            next unless req_info
+
+            requirements[name] = req_info.merge(
+              url: normalized_url,
+              file: pbxproj_file.name
+            )
+          end
+
+          requirements
+        end
+
+        private
+
+        sig { returns(Dependabot::DependencyFile) }
+        attr_reader :pbxproj_file
+
+        sig do
+          params(block: String)
+            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+        end
+        def parse_requirement_block(block)
+          kind = block.match(KIND_PATTERN)&.captures&.first
+          return nil unless kind
+
+          case kind
+          when "upToNextMajorVersion"
+            build_up_to_next_major(block)
+          when "upToNextMinorVersion"
+            build_up_to_next_minor(block)
+          when "exactVersion"
+            build_exact(block)
+          when "versionRange"
+            build_range(block)
+          when "branch"
+            build_branch(block)
+          when "revision"
+            build_revision(block)
+          end
+        end
+
+        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        def build_up_to_next_major(block)
+          min_version = extract_version(block, MIN_VERSION_PATTERN)
+          requirement_string = "from: \"#{min_version}\""
+          requirement = parse_native_requirement(requirement_string)
+
+          {
+            requirement: requirement,
+            requirement_string: requirement_string,
+            kind: "upToNextMajorVersion"
+          }
+        end
+
+        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        def build_up_to_next_minor(block)
+          min_version = extract_version(block, MIN_VERSION_PATTERN)
+          requirement_string = ".upToNextMinor(from: \"#{min_version}\")"
+          requirement = parse_native_requirement(requirement_string)
+
+          {
+            requirement: requirement,
+            requirement_string: requirement_string,
+            kind: "upToNextMinorVersion"
+          }
+        end
+
+        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        def build_exact(block)
+          version = extract_version(block, MIN_VERSION_PATTERN) || extract_version(block, VERSION_PATTERN)
+          requirement_string = "exact: \"#{version}\""
+          requirement = parse_native_requirement(requirement_string)
+
+          {
+            requirement: requirement,
+            requirement_string: requirement_string,
+            kind: "exactVersion"
+          }
+        end
+
+        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        def build_range(block)
+          min_version = extract_version(block, MIN_VERSION_PATTERN)
+          max_version = extract_version(block, MAX_VERSION_PATTERN)
+          requirement_string = "\"#{min_version}\"..<\"#{max_version}\""
+          requirement = parse_native_requirement(requirement_string)
+
+          {
+            requirement: requirement,
+            requirement_string: requirement_string,
+            kind: "versionRange"
+          }
+        end
+
+        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        def build_branch(block)
+          branch = block.match(BRANCH_PATTERN)&.captures&.first
+
+          {
+            requirement: nil,
+            requirement_string: nil,
+            kind: "branch",
+            branch: branch
+          }
+        end
+
+        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        def build_revision(block)
+          revision = block.match(REVISION_PATTERN)&.captures&.first
+
+          {
+            requirement: nil,
+            requirement_string: nil,
+            kind: "revision",
+            revision: revision
+          }
+        end
+
+        sig { params(block: String, pattern: Regexp).returns(T.nilable(String)) }
+        def extract_version(block, pattern)
+          block.match(pattern)&.captures&.first
+        end
+
+        # Parses a requirement string into a Dependabot requirement via
+        # NativeRequirement. Returns nil if the string is malformed rather
+        # than raising, so a single bad entry doesn't stop parsing.
+        sig { params(requirement_string: String).returns(T.nilable(String)) }
+        def parse_native_requirement(requirement_string)
+          NativeRequirement.new(requirement_string).to_s
+        rescue RuntimeError, Gem::Requirement::BadRequirementError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/swift/file_parser/xcode_spm_resolver.rb

@@ -0,0 +1,129 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/file_parsers/base/dependency_set"
+require "dependabot/swift/file_parser"
+require "dependabot/swift/file_parser/package_resolved_parser"
+require "dependabot/swift/file_parser/pbxproj_parser"
+
+module Dependabot
+  module Swift
+    class FileParser < Dependabot::FileParsers::Base
+      # Orchestrates Xcode-managed SwiftPM dependency parsing.
+      #
+      # Parses Package.resolved JSON files found inside .xcodeproj directories,
+      # then enriches each dependency with requirement info extracted from the
+      # corresponding project.pbxproj files.
+      class XcodeSpmResolver
+        extend T::Sig
+
+        sig do
+          params(
+            xcode_resolved_files: T::Array[Dependabot::DependencyFile],
+            pbxproj_files: T::Array[Dependabot::DependencyFile]
+          ).void
+        end
+        def initialize(xcode_resolved_files:, pbxproj_files:)
+          @xcode_resolved_files = xcode_resolved_files
+          @pbxproj_files = pbxproj_files
+        end
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        def parse
+          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
+
+          scoped_requirements = aggregate_pbxproj_requirements
+
+          xcode_resolved_files.each do |resolved_file|
+            resolved_deps = PackageResolvedParser.new(resolved_file).parse
+            xcodeproj_dir = extract_xcodeproj_dir(resolved_file.name)
+            pbxproj_requirements = scoped_requirements.fetch(xcodeproj_dir, {})
+
+            resolved_deps.each do |dep|
+              enriched = enrich_with_pbxproj_requirements(dep, pbxproj_requirements)
+              dependency_set << enriched
+            end
+          end
+
+          dependency_set.dependencies
+        end
+
+        private
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :xcode_resolved_files
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :pbxproj_files
+
+        # Collects requirement info from all project.pbxproj support files,
+        # keyed by xcodeproj directory so each resolved file only sees
+        # requirements from its own Xcode project.
+        sig { returns(T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]]) }
+        def aggregate_pbxproj_requirements
+          scoped = T.let({}, T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]])
+
+          pbxproj_files.each do |pbxproj_file|
+            xcodeproj_dir = extract_xcodeproj_dir(pbxproj_file.name)
+            scoped[xcodeproj_dir] ||= {}
+
+            PbxprojParser.new(pbxproj_file).parse.each do |name, req_info|
+              T.must(scoped[xcodeproj_dir])[name] = req_info
+            end
+          end
+
+          scoped
+        end
+
+        # Enriches a dependency parsed from Package.resolved with requirement
+        # info from the matching project.pbxproj
+        sig do
+          params(
+            dep: Dependabot::Dependency,
+            pbxproj_requirements: T::Hash[String, T::Hash[Symbol, T.untyped]]
+          ).returns(Dependabot::Dependency)
+        end
+        def enrich_with_pbxproj_requirements(dep, pbxproj_requirements)
+          req_info = pbxproj_requirements[dep.name]
+          return dep unless req_info
+
+          pbxproj_file = req_info[:file]
+          requirement_str = req_info[:requirement]
+          requirement_string = req_info[:requirement_string]
+
+          new_requirements = dep.requirements.map do |req|
+            req.merge(
+              requirement: requirement_str || req[:requirement],
+              file: pbxproj_file,
+              metadata: {
+                # declaration_string is not applicable for Xcode-managed SPM
+                # (no Package.swift manifest to extract it from)
+                declaration_string: nil,
+                requirement_string: requirement_string
+              }.compact
+            )
+          end
+
+          Dependency.new(
+            name: dep.name,
+            version: dep.version,
+            package_manager: dep.package_manager,
+            requirements: new_requirements,
+            metadata: dep.metadata
+          )
+        end
+
+        # Extracts the .xcodeproj directory name from a file path.
+        # e.g. "MyApp.xcodeproj/project.xcworkspace/.../Package.resolved" -> "MyApp.xcodeproj"
+        # e.g. "sub/dir/App.xcodeproj/project.pbxproj" -> "sub/dir/App.xcodeproj"
+        sig { params(path: String).returns(T.nilable(String)) }
+        def extract_xcodeproj_dir(path)
+          match = path.match(%r{^(.*?\.xcodeproj)/})
+          match&.captures&.first
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/swift/file_parser.rb

@@ -2,10 +2,12 @@
 # frozen_string_literal: true
 
 require "dependabot/dependency"
+require "dependabot/experiments"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/swift/file_parser/dependency_parser"
 require "dependabot/swift/file_parser/manifest_parser"
+require "dependabot/swift/file_parser/xcode_spm_resolver"
 require "dependabot/swift/package_manager"
 require "dependabot/swift/language"
 
@@ -18,6 +20,34 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def parse
+        if package_manifest_file
+          parse_classic_spm
+        elsif xcode_spm_mode?
+          parse_xcode_spm
+        else
+          raise "No Package.swift or Xcode Package.resolved found!"
+        end
+      end
+
+      sig { returns(Ecosystem) }
+      def ecosystem
+        @ecosystem ||= T.let(
+          begin
+            Ecosystem.new(
+              name: ECOSYSTEM,
+              language: language,
+              package_manager: package_manager
+            )
+          end,
+          T.nilable(Dependabot::Ecosystem)
+        )
+      end
+
+      private
+
+      # Classic SPM parsing: uses swift CLI via DependencyParser + ManifestParser
+      sig { returns(T::Array[Dependabot::Dependency]) }
+      def parse_classic_spm
         dependency_set = DependencySet.new
 
         dependency_parser.parse.map do |dep|
@@ -41,21 +71,21 @@ module Dependabot
         dependency_set.dependencies
       end
 
-      sig { returns(Ecosystem) }
-      def ecosystem
-        @ecosystem ||= T.let(
-          begin
-            Ecosystem.new(
-              name: ECOSYSTEM,
-              language: language,
-              package_manager: package_manager
-            )
-          end,
-          T.nilable(Dependabot::Ecosystem)
-        )
+      # Xcode SPM parsing: delegates to XcodeSpmResolver which parses
+      # Package.resolved JSON and enriches with project.pbxproj requirements
+      sig { returns(T::Array[Dependabot::Dependency]) }
+      def parse_xcode_spm
+        XcodeSpmResolver.new(
+          xcode_resolved_files: xcode_resolved_files,
+          pbxproj_files: pbxproj_files
+        ).parse
       end
 
-      private
+      sig { returns(T::Boolean) }
+      def xcode_spm_mode?
+        Dependabot::Experiments.enabled?(:enable_swift_xcode_spm) &&
+          xcode_resolved_files.any?
+      end
 
       sig { returns(Dependabot::Swift::FileParser::DependencyParser) }
       def dependency_parser
@@ -68,7 +98,15 @@ module Dependabot
 
       sig { override.void }
       def check_required_files
-        raise "No Package.swift!" unless package_manifest_file
+        return if package_manifest_file
+
+        if Dependabot::Experiments.enabled?(:enable_swift_xcode_spm)
+          return if xcode_resolved_files.any?
+
+          raise "No Package.swift or Xcode Package.resolved found!"
+        end
+
+        raise "No Package.swift!"
       end
 
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
@@ -77,6 +115,30 @@ module Dependabot
         @package_manifest_file ||= T.let(get_original_file("Package.swift"), T.nilable(Dependabot::DependencyFile))
       end
 
+      # All non-support Package.resolved files from Xcode project directories
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def xcode_resolved_files
+        @xcode_resolved_files ||= T.let(
+          dependency_files.select do |f|
+            f.name.end_with?("Package.resolved") &&
+              f.name.include?(".xcodeproj/") &&
+              !f.support_file?
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
+      end
+
+      # All project.pbxproj support files
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def pbxproj_files
+        @pbxproj_files ||= T.let(
+          dependency_files.select do |f|
+            f.name.end_with?("project.pbxproj") && f.support_file?
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
+      end
+
       sig { returns(Ecosystem::VersionManager) }
       def package_manager
         @package_manager ||= T.let(

data/lib/dependabot/swift/url_helpers.rb

@@ -0,0 +1,24 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "uri"
+require "sorbet-runtime"
+
+module Dependabot
+  module Swift
+    # Shared URL normalization utilities used by multiple parsers.
+    # Produces a canonical dependency name from a git repository URL
+    # by stripping the scheme, "www." prefix, and ".git" suffix.
+    module UrlHelpers
+      extend T::Sig
+
+      sig { params(source: String).returns(String) }
+      def self.normalize_name(source)
+        uri = URI.parse(source.downcase)
+        "#{uri.host}#{uri.path}".delete_prefix("www.").delete_suffix(".git")
+      rescue URI::InvalidURIError
+        source.downcase.delete_suffix(".git")
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.364.0
+  version: 0.365.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.364.0
+        version: 0.365.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.364.0
+        version: 0.365.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -246,6 +246,9 @@ files:
 - lib/dependabot/swift/file_parser.rb
 - lib/dependabot/swift/file_parser/dependency_parser.rb
 - lib/dependabot/swift/file_parser/manifest_parser.rb
+- lib/dependabot/swift/file_parser/package_resolved_parser.rb
+- lib/dependabot/swift/file_parser/pbxproj_parser.rb
+- lib/dependabot/swift/file_parser/xcode_spm_resolver.rb
 - lib/dependabot/swift/file_updater.rb
 - lib/dependabot/swift/file_updater/lockfile_updater.rb
 - lib/dependabot/swift/file_updater/manifest_updater.rb
@@ -260,13 +263,14 @@ files:
 - lib/dependabot/swift/update_checker/latest_version_resolver.rb
 - lib/dependabot/swift/update_checker/requirements_updater.rb
 - lib/dependabot/swift/update_checker/version_resolver.rb
+- lib/dependabot/swift/url_helpers.rb
 - lib/dependabot/swift/version.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.364.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.365.0
 rdoc_options: []
 require_paths:
 - lib