dependabot-swift 0.365.0 → 0.366.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 35c7a26b4868b5df0a08396136836264f47a3e1d97219ceb705698bb1eae21f3
-  data.tar.gz: 3c22d53cfb502e71c17ba6edc2d5d0d6b6dbbfc92fdbfb9fc897579d6c15269f
+  metadata.gz: bfecded3f835cd8011a78e5cd10c42eaf1f4a518594428a6467c64300fbe1e2a
+  data.tar.gz: a742aa0fab89643edc392546758b904c0e6b8b7a750d7886c470caed4dd46f2f
 SHA512:
-  metadata.gz: 919317db274d1166b9ad1fb3118e24ed162051839faf392963510986637805dcbd7f5a991f3e7256ee4ad09b626da1aafe133939b91fe35edf00edb7b15600b6
-  data.tar.gz: 98b040a728cfa847e5f8ba4474bbf64ef335e47141f94caad1c0a8e9f693a2bc396c2664143ca8f822f599c16ecab8fff8f7a45f66ae29af971df2d3847fdd32
+  metadata.gz: 5ad87b7b2c883cb85b11d4c4f21d1ee99730b3ceff9b2d38ca6dc62e2640e854ab5036d38545a239bf387df39d9d6f81f4a77756195556bd4f0c74050bd50736
+  data.tar.gz: 9bcebc8617174bbeb25bbb92c9ab6710fcada5a749e118898937d535543d6b65dea35f210fe646682dd29bc343377a3040ad9420e2636d98fb481aea807967e3

data/lib/dependabot/swift/file_fetcher.rb

@@ -5,20 +5,24 @@ require "sorbet-runtime"
 require "dependabot/experiments"
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/swift/xcode_file_helpers"
 
 module Dependabot
   module Swift
     class FileFetcher < Dependabot::FileFetchers::Base
       extend T::Sig
 
+      XCODEPROJ_SUFFIX = ".xcodeproj"
+      XCWORKSPACE_SUFFIX = ".xcworkspace"
       XCODE_SPM_PACKAGE_RESOLVED_PATH = "project.xcworkspace/xcshareddata/swiftpm/Package.resolved"
+      XCWORKSPACE_PACKAGE_RESOLVED_PATH = "xcshareddata/swiftpm/Package.resolved"
 
       sig { override.params(filenames: T::Array[String]).returns(T::Boolean) }
       def self.required_files_in?(filenames)
         return true if filenames.include?("Package.swift")
 
         if Dependabot::Experiments.enabled?(:enable_swift_xcode_spm)
-          return filenames.any? { |f| f.end_with?("Package.resolved") }
+          return filenames.any? { |f| XcodeFileHelpers.xcode_resolved_path?(f) }
         end
 
         false
@@ -28,7 +32,7 @@ module Dependabot
       def self.required_files_message
         if Dependabot::Experiments.enabled?(:enable_swift_xcode_spm)
           "Repo must contain a Package.swift configuration file or " \
-            "an .xcodeproj directory with a Package.resolved file."
+            "an .xcodeproj/.xcworkspace directory with a Package.resolved file."
         else
           "Repo must contain a Package.swift configuration file."
         end
@@ -74,17 +78,62 @@ module Dependabot
           resolved = fetch_file_if_present(File.join(xcodeproj_path, XCODE_SPM_PACKAGE_RESOLVED_PATH))
           fetched_files << resolved if resolved
         end
+
+        xcworkspace_dirs.each do |workspace_path|
+          workspace_data = fetch_support_file(File.join(workspace_path, "contents.xcworkspacedata"))
+          fetched_files << workspace_data if workspace_data
+
+          resolved = fetch_file_if_present(File.join(workspace_path, XCWORKSPACE_PACKAGE_RESOLVED_PATH))
+          fetched_files << resolved if resolved
+        end
       end
 
       sig { returns(T::Array[String]) }
       def xcodeproj_dirs
         @xcodeproj_dirs ||= T.let(
-          repo_contents(dir: ".", raise_errors: false)
-            .select { |entry| entry.type == "dir" && entry.name.end_with?(".xcodeproj") }
-            .map(&:name),
+          discover_dirs_with_suffix(XCODEPROJ_SUFFIX),
           T.nilable(T::Array[String])
         )
       end
+
+      sig { returns(T::Array[String]) }
+      def xcworkspace_dirs
+        @xcworkspace_dirs ||= T.let(
+          discover_dirs_with_suffix(XCWORKSPACE_SUFFIX)
+            .reject { |path| path.include?("#{XCODEPROJ_SUFFIX}/") },
+          T.nilable(T::Array[String])
+        )
+      end
+
+      sig { params(suffix: String).returns(T::Array[String]) }
+      def discover_dirs_with_suffix(suffix)
+        discovered = T.let([], T::Array[String])
+        queue = T.let(["."], T::Array[String])
+        visited = T.let({}, T::Hash[String, T::Boolean])
+        index = T.let(0, Integer)
+
+        while index < queue.length
+          dir = T.must(queue[index])
+          index += 1
+          next if visited[dir]
+
+          visited[dir] = true
+
+          entries = repo_contents(dir: dir, raise_errors: false)
+          entries.each do |entry|
+            next unless entry.type == "dir"
+
+            next_dir = dir == "." ? entry.name : File.join(dir, entry.name)
+            if entry.name.end_with?(suffix)
+              discovered << next_dir
+            elsif !entry.name.start_with?(".")
+              queue << next_dir
+            end
+          end
+        end
+
+        discovered.sort
+      end
     end
   end
 end

data/lib/dependabot/swift/file_parser/xcode_spm_resolver.rb

@@ -7,14 +7,16 @@ require "dependabot/file_parsers/base/dependency_set"
 require "dependabot/swift/file_parser"
 require "dependabot/swift/file_parser/package_resolved_parser"
 require "dependabot/swift/file_parser/pbxproj_parser"
+require "dependabot/swift/xcode_file_helpers"
 
 module Dependabot
   module Swift
     class FileParser < Dependabot::FileParsers::Base
       # Orchestrates Xcode-managed SwiftPM dependency parsing.
       #
-      # Parses Package.resolved JSON files found inside .xcodeproj directories,
-      # then enriches each dependency with requirement info extracted from the
+      # Parses Package.resolved JSON files found inside Xcode project and
+      # workspace directories (e.g., .xcodeproj and .xcworkspace), then
+      # enriches each dependency with requirement info extracted from the
       # corresponding project.pbxproj files.
       class XcodeSpmResolver
         extend T::Sig
@@ -38,8 +40,10 @@ module Dependabot
 
           xcode_resolved_files.each do |resolved_file|
             resolved_deps = PackageResolvedParser.new(resolved_file).parse
-            xcodeproj_dir = extract_xcodeproj_dir(resolved_file.name)
-            pbxproj_requirements = scoped_requirements.fetch(xcodeproj_dir, {})
+            pbxproj_requirements = requirements_for_resolved_file(
+              scoped_requirements: scoped_requirements,
+              resolved_file_name: resolved_file.name
+            )
 
             resolved_deps.each do |dep|
               enriched = enrich_with_pbxproj_requirements(dep, pbxproj_requirements)
@@ -59,24 +63,67 @@ module Dependabot
         attr_reader :pbxproj_files
 
         # Collects requirement info from all project.pbxproj support files,
-        # keyed by xcodeproj directory so each resolved file only sees
-        # requirements from its own Xcode project.
+        # keyed by Xcode scope directory so each resolved file can be enriched
+        # by requirements from its closest matching Xcode scope.
         sig { returns(T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]]) }
         def aggregate_pbxproj_requirements
           scoped = T.let({}, T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]])
 
           pbxproj_files.each do |pbxproj_file|
-            xcodeproj_dir = extract_xcodeproj_dir(pbxproj_file.name)
-            scoped[xcodeproj_dir] ||= {}
+            xcode_scope_dir = extract_xcode_scope_dir(pbxproj_file.name)
+            scoped[xcode_scope_dir] ||= {}
 
             PbxprojParser.new(pbxproj_file).parse.each do |name, req_info|
-              T.must(scoped[xcodeproj_dir])[name] = req_info
+              T.must(scoped[xcode_scope_dir])[name] = req_info
             end
           end
 
           scoped
         end
 
+        sig do
+          params(
+            scoped_requirements: T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]]
+          ).returns(T::Hash[String, T::Hash[Symbol, T.untyped]])
+        end
+        def merge_scopes(scoped_requirements)
+          scoped_requirements.values.each_with_object({}) do |requirements, merged|
+            requirements.each { |name, req_info| merged[name] = req_info }
+          end
+        end
+
+        sig do
+          params(
+            scoped_requirements: T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]],
+            resolved_file_name: String
+          ).returns(T::Hash[String, T::Hash[Symbol, T.untyped]])
+        end
+        def requirements_for_resolved_file(scoped_requirements:, resolved_file_name:)
+          scope_dir = extract_xcode_scope_dir(resolved_file_name)
+          return T.must(scoped_requirements[scope_dir]) if scoped_requirements.key?(scope_dir)
+
+          workspace_root = workspace_root_for_scope(scope_dir)
+          return {} unless workspace_root
+
+          local_scopes = scoped_requirements.select do |candidate_scope, _|
+            scope_in_workspace_root?(candidate_scope, workspace_root)
+          end
+          return {} if local_scopes.empty?
+
+          merge_scopes(local_scopes)
+        end
+
+        sig { params(candidate_scope: T.nilable(String), workspace_root: String).returns(T::Boolean) }
+        def scope_in_workspace_root?(candidate_scope, workspace_root)
+          return false unless candidate_scope
+
+          if workspace_root == "."
+            !candidate_scope.include?("/")
+          else
+            candidate_scope.start_with?("#{workspace_root}/")
+          end
+        end
+
         # Enriches a dependency parsed from Package.resolved with requirement
         # info from the matching project.pbxproj
         sig do
@@ -92,6 +139,7 @@ module Dependabot
           pbxproj_file = req_info[:file]
           requirement_str = req_info[:requirement]
           requirement_string = req_info[:requirement_string]
+          kind = req_info[:kind]
 
           new_requirements = dep.requirements.map do |req|
             req.merge(
@@ -101,7 +149,8 @@ module Dependabot
                 # declaration_string is not applicable for Xcode-managed SPM
                 # (no Package.swift manifest to extract it from)
                 declaration_string: nil,
-                requirement_string: requirement_string
+                requirement_string: requirement_string,
+                kind: kind
               }.compact
             )
           end
@@ -115,13 +164,18 @@ module Dependabot
           )
         end
 
-        # Extracts the .xcodeproj directory name from a file path.
-        # e.g. "MyApp.xcodeproj/project.xcworkspace/.../Package.resolved" -> "MyApp.xcodeproj"
-        # e.g. "sub/dir/App.xcodeproj/project.pbxproj" -> "sub/dir/App.xcodeproj"
+        # Extracts the Xcode scope directory (.xcodeproj or .xcworkspace)
+        # from a file path.
         sig { params(path: String).returns(T.nilable(String)) }
-        def extract_xcodeproj_dir(path)
-          match = path.match(%r{^(.*?\.xcodeproj)/})
-          match&.captures&.first
+        def extract_xcode_scope_dir(path)
+          XcodeFileHelpers.extract_xcode_scope_dir(path)
+        end
+
+        sig { params(scope_dir: T.nilable(String)).returns(T.nilable(String)) }
+        def workspace_root_for_scope(scope_dir)
+          return nil unless scope_dir&.end_with?(".xcworkspace")
+
+          File.dirname(scope_dir)
         end
       end
     end

data/lib/dependabot/swift/file_parser.rb

@@ -10,6 +10,7 @@ require "dependabot/swift/file_parser/manifest_parser"
 require "dependabot/swift/file_parser/xcode_spm_resolver"
 require "dependabot/swift/package_manager"
 require "dependabot/swift/language"
+require "dependabot/swift/xcode_file_helpers"
 
 module Dependabot
   module Swift
@@ -115,13 +116,12 @@ module Dependabot
         @package_manifest_file ||= T.let(get_original_file("Package.swift"), T.nilable(Dependabot::DependencyFile))
       end
 
-      # All non-support Package.resolved files from Xcode project directories
+      # All non-support Package.resolved files from Xcode project and workspace directories (.xcodeproj, .xcworkspace)
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def xcode_resolved_files
         @xcode_resolved_files ||= T.let(
           dependency_files.select do |f|
-            f.name.end_with?("Package.resolved") &&
-              f.name.include?(".xcodeproj/") &&
+            XcodeFileHelpers.xcode_resolved_path?(f.name) &&
               !f.support_file?
           end,
           T.nilable(T::Array[Dependabot::DependencyFile])

data/lib/dependabot/swift/file_updater/xcode_lockfile_updater.rb

@@ -0,0 +1,303 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+require "dependabot/dependency"
+require "dependabot/dependency_file"
+require "dependabot/errors"
+require "dependabot/shared_helpers"
+require "dependabot/swift/file_updater"
+require "dependabot/swift/url_helpers"
+require "dependabot/swift/xcode_file_helpers"
+
+module Dependabot
+  module Swift
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      class XcodeLockfileUpdater
+        extend T::Sig
+
+        SUPPORTED_VERSIONS = T.let([1, 2, 3].freeze, T::Array[Integer])
+
+        # Maps schema version to the JSON keys used for each pin field
+        PIN_KEYS = T.let(
+          {
+            1 => { url: "repositoryURL", identity: "package", pins_path: %w(object pins) },
+            2 => { url: "location", identity: "identity", pins_path: ["pins"] },
+            3 => { url: "location", identity: "identity", pins_path: ["pins"] }
+          }.freeze,
+          T::Hash[Integer, T::Hash[Symbol, T.untyped]]
+        )
+
+        sig do
+          params(
+            resolved_file: Dependabot::DependencyFile,
+            dependencies: T::Array[Dependabot::Dependency],
+            workspace_files: T::Array[Dependabot::DependencyFile]
+          ).void
+        end
+        def initialize(resolved_file:, dependencies:, workspace_files: [])
+          @resolved_file = resolved_file
+          @dependencies = dependencies
+          @workspace_files = workspace_files
+        end
+
+        sig { returns(String) }
+        def updated_lockfile_content
+          content = resolved_file.content
+          unless content
+            raise Dependabot::DependencyFileNotParseable.new(
+              resolved_file.name,
+              "#{resolved_file.name} has no content"
+            )
+          end
+
+          parsed = parse_json(content)
+          schema_version = detect_schema_version(parsed)
+          keys = T.must(PIN_KEYS[schema_version])
+
+          update_pins(parsed, schema_version, keys)
+
+          # Use JSON.pretty_generate to match Xcode's output format:
+          # - 2-space indentation
+          # - space before colon (e.g., "key" : "value")
+          JSON.pretty_generate(
+            parsed,
+            indent: "  ",
+            space: " ",
+            space_before: " ",
+            object_nl: "\n",
+            array_nl: "\n"
+          ) + "\n"
+        end
+
+        sig { returns(T::Boolean) }
+        def lockfile_changed?
+          dependencies_for_file.any?
+        end
+
+        private
+
+        sig { returns(Dependabot::DependencyFile) }
+        attr_reader :resolved_file
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        attr_reader :dependencies
+
+        sig { returns(T::Array[Dependabot::DependencyFile]) }
+        attr_reader :workspace_files
+
+        sig { params(content: String).returns(T::Hash[String, T.untyped]) }
+        def parse_json(content)
+          JSON.parse(content)
+        rescue JSON::ParserError => e
+          raise Dependabot::DependencyFileNotParseable.new(
+            resolved_file.name,
+            "#{resolved_file.name} is not valid JSON: #{e.message}"
+          )
+        end
+
+        sig { params(parsed: T::Hash[String, T.untyped]).returns(Integer) }
+        def detect_schema_version(parsed)
+          version = parsed["version"]
+
+          unless version.is_a?(Integer) && SUPPORTED_VERSIONS.include?(version)
+            raise Dependabot::DependencyFileNotParseable.new(
+              resolved_file.name,
+              "#{resolved_file.name} has unsupported schema version: #{version.inspect}. " \
+              "Supported versions: #{SUPPORTED_VERSIONS.join(', ')}"
+            )
+          end
+
+          version
+        end
+
+        sig do
+          params(
+            parsed: T::Hash[String, T.untyped],
+            schema_version: Integer,
+            keys: T::Hash[Symbol, T.untyped]
+          ).void
+        end
+        def update_pins(parsed, schema_version, keys)
+          pins_path = T.cast(keys[:pins_path], T::Array[String])
+          pins = dig_pins(parsed, pins_path)
+
+          unless pins.is_a?(Array)
+            raise Dependabot::DependencyFileNotParseable.new(
+              resolved_file.name,
+              "#{resolved_file.name} is missing the expected 'pins' array " \
+              "(schema version #{schema_version})"
+            )
+          end
+
+          dependencies_for_file.each do |dep|
+            update_pin_for_dependency(pins, dep, keys, schema_version)
+          end
+        end
+
+        sig do
+          params(
+            parsed: T::Hash[String, T.untyped],
+            path: T::Array[String]
+          ).returns(T.untyped)
+        end
+        def dig_pins(parsed, path)
+          # Navigate nested hash using path keys
+          # Path is either ["object", "pins"] for v1 or ["pins"] for v2/v3
+          current = T.let(parsed, T.untyped)
+          path.each do |key|
+            break unless current.is_a?(Hash)
+
+            current = current[key]
+          end
+          current
+        end
+
+        sig do
+          params(
+            pins: T::Array[T::Hash[String, T.untyped]],
+            dependency: Dependabot::Dependency,
+            keys: T::Hash[Symbol, T.untyped],
+            schema_version: Integer
+          ).void
+        end
+        def update_pin_for_dependency(pins, dependency, keys, schema_version)
+          pin = find_pin_for_dependency(pins, dependency, keys, schema_version)
+          return unless pin
+
+          state = pin["state"]
+          return unless state.is_a?(Hash)
+
+          source = dependency.requirements.first&.dig(:source)
+          new_version = dependency.version
+          new_ref = source&.dig(:ref)
+
+          if new_version
+            state["version"] = new_version
+            # When updating to a new version, update revision if provided in source
+            # The ref from source is typically the git SHA corresponding to the version tag
+            state["revision"] = new_ref if new_ref && looks_like_sha?(new_ref)
+          elsif new_ref
+            # Revision-only update (no version, just SHA)
+            state["revision"] = new_ref
+            state.delete("version")
+          end
+        end
+
+        sig { params(str: String).returns(T::Boolean) }
+        def looks_like_sha?(str)
+          str.match?(/\A[0-9a-f]{40}\z/i)
+        end
+
+        sig do
+          params(
+            pins: T::Array[T::Hash[String, T.untyped]],
+            dependency: Dependabot::Dependency,
+            keys: T::Hash[Symbol, T.untyped],
+            schema_version: Integer
+          ).returns(T.nilable(T::Hash[String, T.untyped]))
+        end
+        def find_pin_for_dependency(pins, dependency, keys, schema_version)
+          identity_key = T.cast(keys[:identity], String)
+          url_key = T.cast(keys[:url], String)
+          identity = dependency.metadata[:identity]
+
+          pins.find do |pin|
+            pin_identity = pin[identity_key]
+            pin_identity = pin_identity&.downcase if schema_version == 1
+
+            if identity && pin_identity == identity
+              true
+            else
+              # Fall back to URL matching
+              pin_url = pin[url_key]
+              next false unless pin_url.is_a?(String)
+
+              normalized_pin_url = SharedHelpers.scp_to_standard(pin_url)
+              pin_name = UrlHelpers.normalize_name(normalized_pin_url)
+
+              pin_name == dependency.name
+            end
+          end
+        end
+
+        sig { returns(T::Array[Dependabot::Dependency]) }
+        def dependencies_for_file
+          @dependencies_for_file ||= T.let(
+            dependencies.select do |dep|
+              dep.requirements.any? do |req|
+                req_file_matches_resolved_scope?(req[:file])
+              end
+            end,
+            T.nilable(T::Array[Dependabot::Dependency])
+          )
+        end
+
+        sig { params(req_file: T.nilable(String)).returns(T::Boolean) }
+        def req_file_matches_resolved_scope?(req_file)
+          return false unless req_file
+          return true if req_file == resolved_file.name
+          return false unless req_file.include?(".xcodeproj/") || req_file.include?(".xcworkspace/")
+
+          req_scope = extract_xcode_scope_dir(req_file)
+          resolved_scope = extract_xcode_scope_dir(resolved_file.name)
+
+          return true if req_scope && resolved_scope && req_scope == resolved_scope
+
+          workspace_related_dependency?(req_file)
+        end
+
+        # Extracts the Xcode scope directory (.xcodeproj or .xcworkspace)
+        # from a file path.
+        sig { params(path: String).returns(T.nilable(String)) }
+        def extract_xcode_scope_dir(path)
+          XcodeFileHelpers.extract_xcode_scope_dir(path)
+        end
+
+        sig { params(req_file: T.nilable(String)).returns(T::Boolean) }
+        def workspace_related_dependency?(req_file)
+          return false unless req_file
+
+          workspace_scope = extract_xcode_scope_dir(resolved_file.name)
+          return false unless workspace_scope&.end_with?(".xcworkspace")
+          return false unless req_file.include?(".xcodeproj/")
+
+          req_scope = extract_xcode_scope_dir(req_file)
+          return false unless req_scope
+
+          referenced = referenced_project_scopes_for_workspace(workspace_scope)
+          return referenced.include?(req_scope) if referenced.any?
+
+          workspace_root = File.dirname(workspace_scope)
+
+          if workspace_root == "."
+            !req_scope.include?("/")
+          else
+            req_scope.start_with?("#{workspace_root}/")
+          end
+        end
+
+        sig { params(workspace_scope: String).returns(T::Set[String]) }
+        def referenced_project_scopes_for_workspace(workspace_scope)
+          workspace_data_path = "#{workspace_scope}/contents.xcworkspacedata"
+          file = workspace_files.find { |workspace_file| workspace_file.name == workspace_data_path }
+          return Set.new unless file&.content
+
+          project_refs = T.must(file.content).scan(/location\s*=\s*"(?:group:)?([^"\n]+\.xcodeproj)"/).flatten
+          workspace_root = File.dirname(workspace_scope)
+
+          Set.new(
+            project_refs.map do |project_ref|
+              if workspace_root == "."
+                project_ref
+              else
+                File.join(workspace_root, project_ref)
+              end
+            end
+          )
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/swift/file_updater.rb

@@ -1,10 +1,13 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "dependabot/experiments"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/swift/file_updater/lockfile_updater"
 require "dependabot/swift/file_updater/manifest_updater"
+require "dependabot/swift/file_updater/xcode_lockfile_updater"
+require "dependabot/swift/xcode_file_helpers"
 
 module Dependabot
   module Swift
@@ -13,6 +16,18 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
+        if xcode_spm_mode?
+          updated_xcode_spm_files
+        else
+          updated_classic_spm_files
+        end
+      end
+
+      private
+
+      # Classic SPM update: uses swift CLI to resolve and update
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def updated_classic_spm_files
         updated_files = T.let([], T::Array[Dependabot::DependencyFile])
 
         SharedHelpers.in_a_temporary_repo_directory(T.must(manifest).directory, repo_contents_path) do
@@ -31,7 +46,35 @@ module Dependabot
         updated_files
       end
 
-      private
+      # Xcode SPM update: updates Package.resolved files in-place without CLI
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def updated_xcode_spm_files
+        updated_files = T.let([], T::Array[Dependabot::DependencyFile])
+
+        xcode_resolved_files.each do |resolved_file|
+          updater = XcodeLockfileUpdater.new(
+            resolved_file: resolved_file,
+            dependencies: dependencies,
+            workspace_files: xcode_workspace_files
+          )
+
+          next unless updater.lockfile_changed?
+
+          updated_content = updater.updated_lockfile_content
+          next if updated_content == resolved_file.content
+
+          updated_files << updated_file(file: resolved_file, content: updated_content)
+        end
+
+        if updated_files.empty?
+          raise Dependabot::DependencyFileNotFound.new(
+            nil,
+            "No Package.resolved files needed updating for the specified dependencies"
+          )
+        end
+
+        updated_files
+      end
 
       sig { returns(Dependabot::Dependency) }
       def dependency
@@ -42,7 +85,38 @@ module Dependabot
 
       sig { override.void }
       def check_required_files
-        raise "A Package.swift file must be provided!" unless manifest
+        return if manifest
+        return if xcode_spm_mode? && xcode_resolved_files.any?
+
+        raise "A Package.swift file or Xcode Package.resolved must be provided!"
+      end
+
+      sig { returns(T::Boolean) }
+      def xcode_spm_mode?
+        return false unless Dependabot::Experiments.enabled?(:enable_swift_xcode_spm)
+
+        manifest.nil? && xcode_resolved_files.any?
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def xcode_resolved_files
+        @xcode_resolved_files ||= T.let(
+          dependency_files.select do |f|
+            XcodeFileHelpers.xcode_resolved_path?(f.name) &&
+              !f.support_file?
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def xcode_workspace_files
+        @xcode_workspace_files ||= T.let(
+          dependency_files.select do |f|
+            f.name.end_with?("contents.xcworkspacedata") && f.support_file?
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
       end
 
       sig { returns(String) }

data/lib/dependabot/swift/metadata_finder.rb

@@ -17,6 +17,11 @@ module Dependabot
         case new_source_type
         when "git" then find_source_from_git_url
         when "registry" then find_source_from_registry
+        when "default", nil
+          # For dependencies without explicit source info (e.g., Xcode-managed
+          # SPM dependencies parsed from Package.resolved), attempt to infer
+          # source from the dependency name which is typically a normalized URL
+          find_source_from_dependency_name
         else raise "Unexpected source type: #{new_source_type}"
         end
       end
@@ -34,6 +39,15 @@ module Dependabot
         Source.from_url(url)
       end
 
+      sig { returns(T.nilable(Dependabot::Source)) }
+      def find_source_from_dependency_name
+        name = dependency.name
+        return nil unless name.include?("/")
+
+        url = "https://#{name}"
+        Source.from_url(url)
+      end
+
       sig { returns(T.noreturn) }
       def find_source_from_registry
         raise NotImplementedError

data/lib/dependabot/swift/update_checker/requirements_updater.rb

@@ -1,4 +1,4 @@
-# typed: strong
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/update_checkers/base"
@@ -14,11 +14,13 @@ module Dependabot
         sig do
           params(
             requirements: T::Array[T::Hash[Symbol, T.untyped]],
-            target_version: T.nilable(T.any(String, Gem::Version))
+            target_version: T.nilable(T.any(String, Gem::Version)),
+            xcode_mode: T::Boolean
           ).void
         end
-        def initialize(requirements:, target_version:)
+        def initialize(requirements:, target_version:, xcode_mode: false)
           @requirements = requirements
+          @xcode_mode = xcode_mode
 
           return unless target_version && Version.correct?(target_version)
 
@@ -27,6 +29,8 @@ module Dependabot
 
         sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
         def updated_requirements
+          return updated_xcode_requirements if xcode_mode
+
           NativeRequirement.map_requirements(requirements) do |requirement|
             T.must(requirement.update_if_needed(T.must(target_version)))
           end
@@ -39,6 +43,116 @@ module Dependabot
 
         sig { returns(T.nilable(Gem::Version)) }
         attr_reader :target_version
+
+        sig { returns(T::Boolean) }
+        attr_reader :xcode_mode
+
+        # For Xcode projects, we update the version in the requirement while preserving the kind.
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        def updated_xcode_requirements
+          requirements.map do |req|
+            next req unless target_version
+
+            updated_req = update_xcode_requirement(req)
+            updated_req
+          end
+        end
+
+        sig { params(requirement: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
+        def update_xcode_requirement(requirement)
+          metadata = requirement[:metadata] || {}
+          requirement_string = metadata[:requirement_string]
+          kind = metadata[:kind]
+
+          new_requirement_string = build_xcode_requirement_string(requirement_string, kind)
+          new_requirement = build_xcode_requirement(requirement_string, kind)
+
+          requirement.merge(
+            requirement: new_requirement,
+            metadata: metadata.merge(
+              requirement_string: new_requirement_string
+            ).compact
+          )
+        end
+
+        sig do
+          params(
+            requirement_string: T.nilable(String),
+            kind: T.nilable(String)
+          ).returns(T.nilable(String))
+        end
+        def build_xcode_requirement_string(requirement_string, kind)
+          return requirement_string unless target_version
+
+          case kind
+          when "upToNextMajorVersion"
+            "from: \"#{target_version}\""
+          when "upToNextMinorVersion"
+            ".upToNextMinor(from: \"#{target_version}\")"
+          when "exactVersion"
+            "exact: \"#{target_version}\""
+          when "versionRange"
+            max = extract_version_range_max(requirement_string)
+            "\"#{target_version}\"..<\"#{max}\""
+          else
+            # Default: update to exact version for unknown kinds
+            "exact: \"#{target_version}\""
+          end
+        end
+
+        sig do
+          params(
+            requirement_string: T.nilable(String),
+            kind: T.nilable(String)
+          ).returns(T.nilable(String))
+        end
+        def build_xcode_requirement(requirement_string, kind)
+          return nil unless target_version
+
+          case kind
+          when "upToNextMajorVersion"
+            max = bump_version(target_version.to_s, :major)
+            ">= #{target_version}, < #{max}"
+          when "upToNextMinorVersion"
+            max = bump_version(target_version.to_s, :minor)
+            ">= #{target_version}, < #{max}"
+          when "exactVersion"
+            "= #{target_version}"
+          when "versionRange"
+            max = extract_version_range_max(requirement_string)
+            ">= #{target_version}, < #{max}"
+          else
+            # Default: exact version
+            "= #{target_version}"
+          end
+        end
+
+        # Extracts the upper bound from a versionRange requirement string.
+        # Format: "min"..<"max" or "min"..."max"
+        sig { params(requirement_string: T.nilable(String)).returns(String) }
+        def extract_version_range_max(requirement_string)
+          return bump_version(target_version.to_s, :major) unless requirement_string
+
+          # Match patterns like "1.0.0"..<"2.0.0" or "1.0.0"..."2.0.0"
+          match = requirement_string.match(/\.{2,3}<?"(\d+\.\d+\.\d+)"/)
+          return bump_version(target_version.to_s, :major) unless match
+
+          match[1].to_s
+        end
+
+        sig { params(version_str: String, bump_type: Symbol).returns(String) }
+        def bump_version(version_str, bump_type)
+          parts = version_str.split(".").map(&:to_i)
+
+          case bump_type
+          when :major
+            [(parts[0] || 0) + 1, 0, 0]
+          when :minor
+            [parts[0] || 0, (parts[1] || 0) + 1, 0]
+          else
+            parts
+          end.join(".")
+        end
       end
     end
   end

data/lib/dependabot/swift/update_checker/xcode_version_resolver.rb

@@ -0,0 +1,124 @@
+# typed: strict
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+require "dependabot/git_commit_checker"
+require "dependabot/swift/update_checker"
+require "dependabot/swift/requirement"
+require "dependabot/swift/version"
+require "dependabot/update_checkers/version_filters"
+
+module Dependabot
+  module Swift
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
+      # Resolves versions for Xcode-only SwiftPM projects (no Package.swift).
+      #
+      # Unlike the classic VersionResolver which relies on `swift package update`,
+      # this resolver uses GitCommitChecker to find the latest available version
+      # from git tags, since we cannot run the Swift CLI without a manifest.
+      class XcodeVersionResolver
+        extend T::Sig
+
+        sig do
+          params(
+            dependency: Dependabot::Dependency,
+            git_commit_checker: Dependabot::GitCommitChecker,
+            security_advisories: T::Array[Dependabot::SecurityAdvisory]
+          ).void
+        end
+        def initialize(dependency:, git_commit_checker:, security_advisories:)
+          @dependency = dependency
+          @git_commit_checker = git_commit_checker
+          @security_advisories = security_advisories
+        end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def latest_resolvable_version
+          return nil unless version_pinned?
+
+          tag = git_commit_checker.local_tag_for_latest_version
+          return nil unless tag
+
+          version = tag.fetch(:version)
+          return nil unless version_meets_requirements?(version)
+
+          Version.new(version)
+        end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def lowest_security_fix_version
+          return nil unless version_pinned?
+
+          tags = git_commit_checker.local_tags_for_allowed_versions
+          relevant_tags = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
+            tags,
+            security_advisories
+          )
+          relevant_tags = filter_lower_tags(relevant_tags)
+
+          lowest_tag = relevant_tags.min_by { |tag| tag.fetch(:version) }
+          return nil unless lowest_tag
+
+          Version.new(lowest_tag.fetch(:version))
+        end
+
+        sig { returns(T::Boolean) }
+        def version_pinned?
+          return false unless dependency.version
+
+          Version.correct?(dependency.version)
+        end
+
+        private
+
+        sig { returns(Dependabot::Dependency) }
+        attr_reader :dependency
+
+        sig { returns(Dependabot::GitCommitChecker) }
+        attr_reader :git_commit_checker
+
+        sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
+        attr_reader :security_advisories
+
+        sig { returns(T.nilable(Dependabot::Swift::Requirement)) }
+        def dependency_requirement
+          req_string = dependency.requirements.first&.dig(:requirement)
+          return nil unless req_string
+
+          Dependabot::Swift::Requirement.new(req_string)
+        rescue Gem::Requirement::BadRequirementError
+          nil
+        end
+
+        sig { params(version: T.untyped).returns(T::Boolean) }
+        def version_meets_requirements?(version)
+          requirement = dependency_requirement
+          return true unless requirement
+
+          requirement.satisfied_by?(version)
+        end
+
+        sig do
+          params(
+            tags: T::Array[T::Hash[Symbol, T.untyped]]
+          ).returns(T::Array[T::Hash[Symbol, T.untyped]])
+        end
+        def filter_lower_tags(tags)
+          current = current_version
+          return tags unless current
+
+          tags.select { |tag| tag.fetch(:version) > current }
+        end
+
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def current_version
+          return nil unless dependency.version
+
+          Version.new(dependency.version)
+        rescue ArgumentError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/swift/update_checker.rb

@@ -2,12 +2,14 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "dependabot/experiments"
 require "dependabot/update_checkers"
 require "dependabot/update_checkers/base"
 require "dependabot/update_checkers/version_filters"
 require "dependabot/git_commit_checker"
 require "dependabot/swift/native_requirement"
 require "dependabot/swift/file_updater/manifest_updater"
+require "dependabot/swift/xcode_file_helpers"
 
 module Dependabot
   module Swift
@@ -17,6 +19,7 @@ module Dependabot
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/version_resolver"
       require_relative "update_checker/latest_version_resolver"
+      require_relative "update_checker/xcode_version_resolver"
 
       sig { override.returns(T.nilable(Dependabot::Version)) }
       def latest_version
@@ -50,21 +53,50 @@ module Dependabot
 
       sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
+        return updated_xcode_requirements if xcode_spm_mode?
+
+        # If no target version is available, return old requirements unchanged
+        target = preferred_resolvable_version
+        return old_requirements unless target
+
         RequirementsUpdater.new(
           requirements: old_requirements,
-          target_version: T.must(preferred_resolvable_version)
+          target_version: target
         ).updated_requirements
       end
 
       private
 
+      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      def updated_xcode_requirements
+        # If no target version is available (e.g., revision-only or branch-pinned
+        # dependency), return old requirements unchanged
+        target = preferred_resolvable_version
+        return old_requirements unless target
+
+        RequirementsUpdater.new(
+          requirements: old_requirements,
+          target_version: target,
+          xcode_mode: true
+        ).updated_requirements
+      end
+
       sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def old_requirements
         dependency.requirements
       end
 
+      sig { returns(T::Boolean) }
+      def xcode_spm_mode?
+        return false unless Dependabot::Experiments.enabled?(:enable_swift_xcode_spm)
+
+        manifest.nil? && xcode_resolved_files.any?
+      end
+
       sig { returns(T.nilable(Dependabot::Version)) }
       def fetch_latest_version
+        return fetch_xcode_latest_version if xcode_spm_mode?
+
         return unless git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
 
         tag = latest_version_tag
@@ -73,8 +105,22 @@ module Dependabot
         tag.fetch(:version)
       end
 
+      sig { returns(T.nilable(Dependabot::Version)) }
+      def fetch_xcode_latest_version
+        # For branch-pinned or revision-only dependencies, don't report a latest version
+        # since they can't be meaningfully updated to version-based pins
+        return nil unless xcode_version_resolver.version_pinned?
+
+        tag = latest_version_tag
+        return unless tag
+
+        tag.fetch(:version)
+      end
+
       sig { returns(T.nilable(Dependabot::Version)) }
       def fetch_lowest_security_fix_version
+        return fetch_xcode_lowest_security_fix_version if xcode_spm_mode?
+
         return unless git_commit_checker.pinned_ref_looks_like_version? && latest_version_tag
 
         tag = lowest_security_fix_version_tag
@@ -83,16 +129,30 @@ module Dependabot
         tag.fetch(:version)
       end
 
+      sig { returns(T.nilable(Dependabot::Version)) }
+      def fetch_xcode_lowest_security_fix_version
+        xcode_version_resolver.lowest_security_fix_version
+      end
+
       sig { returns(T.nilable(Dependabot::Version)) }
       def fetch_latest_resolvable_version
+        return fetch_xcode_latest_resolvable_version if xcode_spm_mode?
+
         latest_resolvable_version = version_resolver_for(unlocked_requirements).latest_resolvable_version
         return current_version unless latest_resolvable_version
 
         Version.new(latest_resolvable_version)
       end
 
+      sig { returns(T.nilable(Dependabot::Version)) }
+      def fetch_xcode_latest_resolvable_version
+        xcode_version_resolver.latest_resolvable_version
+      end
+
       sig { returns(T.nilable(Dependabot::Version)) }
       def fetch_lowest_resolvable_security_fix_version
+        return fetch_xcode_lowest_security_fix_version if xcode_spm_mode?
+
         lowest_resolvable_security_fix_version = version_resolver_for(
           force_lowest_security_fix_requirements
         ).latest_resolvable_version
@@ -218,6 +278,29 @@ module Dependabot
         tags_array
           .select { |tag| tag.fetch(:version) > current_version }
       end
+
+      sig { returns(XcodeVersionResolver) }
+      def xcode_version_resolver
+        @xcode_version_resolver ||= T.let(
+          XcodeVersionResolver.new(
+            dependency: dependency,
+            git_commit_checker: git_commit_checker,
+            security_advisories: security_advisories
+          ),
+          T.nilable(XcodeVersionResolver)
+        )
+      end
+
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def xcode_resolved_files
+        @xcode_resolved_files ||= T.let(
+          dependency_files.select do |f|
+            XcodeFileHelpers.xcode_resolved_path?(f.name) &&
+              !f.support_file?
+          end,
+          T.nilable(T::Array[Dependabot::DependencyFile])
+        )
+      end
     end
   end
 end

data/lib/dependabot/swift/xcode_file_helpers.rb

@@ -0,0 +1,47 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "sorbet-runtime"
+
+module Dependabot
+  module Swift
+    module XcodeFileHelpers
+      extend T::Sig
+
+      XCODEPROJ_SUFFIX = ".xcodeproj/"
+      XCWORKSPACE_SUFFIX = ".xcworkspace/"
+      PACKAGE_RESOLVED = "Package.resolved"
+
+      sig { params(path: String).returns(T::Boolean) }
+      def self.xcode_resolved_path?(path)
+        return false unless path.end_with?(PACKAGE_RESOLVED)
+
+        path.include?(XCODEPROJ_SUFFIX) || path.include?(XCWORKSPACE_SUFFIX)
+      end
+
+      sig { params(path: String).returns(T.nilable(String)) }
+      def self.extract_xcode_scope_dir(path)
+        # Find the first occurrence of .xcodeproj/ or .xcworkspace/
+        xcodeproj_idx = path.index(XCODEPROJ_SUFFIX)
+        xcworkspace_idx = path.index(XCWORKSPACE_SUFFIX)
+
+        # Determine which match to use (earliest occurrence)
+        match_idx = T.let(nil, T.nilable(Integer))
+        suffix_len = T.let(0, Integer)
+
+        if xcodeproj_idx && (xcworkspace_idx.nil? || xcodeproj_idx < xcworkspace_idx)
+          match_idx = xcodeproj_idx
+          suffix_len = XCODEPROJ_SUFFIX.length
+        elsif xcworkspace_idx
+          match_idx = xcworkspace_idx
+          suffix_len = XCWORKSPACE_SUFFIX.length
+        end
+
+        return nil if match_idx.nil?
+
+        # Return path up to and including the suffix (minus trailing /)
+        path[0, match_idx + suffix_len - 1]
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.365.0
+  version: 0.366.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.365.0
+        version: 0.366.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.365.0
+        version: 0.366.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -253,6 +253,7 @@ files:
 - lib/dependabot/swift/file_updater/lockfile_updater.rb
 - lib/dependabot/swift/file_updater/manifest_updater.rb
 - lib/dependabot/swift/file_updater/requirement_replacer.rb
+- lib/dependabot/swift/file_updater/xcode_lockfile_updater.rb
 - lib/dependabot/swift/language.rb
 - lib/dependabot/swift/metadata_finder.rb
 - lib/dependabot/swift/native_requirement.rb
@@ -263,14 +264,16 @@ files:
 - lib/dependabot/swift/update_checker/latest_version_resolver.rb
 - lib/dependabot/swift/update_checker/requirements_updater.rb
 - lib/dependabot/swift/update_checker/version_resolver.rb
+- lib/dependabot/swift/update_checker/xcode_version_resolver.rb
 - lib/dependabot/swift/url_helpers.rb
 - lib/dependabot/swift/version.rb
+- lib/dependabot/swift/xcode_file_helpers.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.365.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.366.0
 rdoc_options: []
 require_paths:
 - lib