dependabot-swift 0.368.0 → 0.369.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '058280369adb6c289d2f489441966b3a1388d034dc13aca3c65aa8d12b19a0de'
-  data.tar.gz: 01c2cf4b8a1b9cbc0d8f7adb61d6d5d50340b76ad9bc4956aa993ad941d3b66b
+  metadata.gz: ffba3e2d47abede16d8578f4604ab638a59d08873d56dadb884f2b7a4750714b
+  data.tar.gz: d3df9f2a33ebb10871918caa8946d284457760403bc77b772d0d6be6a435820b
 SHA512:
-  metadata.gz: 2ff6fe44d399d5d0b2bad6cd86930522217382c0987dcc613d28f6f275a0e204e38049f6cdc987c16ac212eab39b5dd517a98d3538eb7e9d07a9be81d3189ee1
-  data.tar.gz: 3eca296a8d786017decc79a8eccc0f902f84216daba17c42d849bd5a02c380c6435f067c9474c94167fe77fadb21288a2767a179456dc607024a717c9758e882
+  metadata.gz: b2f8b488b086c3d49adff713335088ea164884842d7ab07e592a29231b9a462b41cc46d0c8d314afbc5b4394b0ca8b595fcfda0cc80ee50ad6384e3933ba137d
+  data.tar.gz: 94eafc46297bc99402cea427f9d8c9cf8013101912e2edb712dbc406335954a6cec2fd1b0a532857da6820a0edfe9925fcc70ac211f52d3090fbf1b2f9953051

data/lib/dependabot/swift/update_checker/xcode_version_resolver.rb

@@ -6,6 +6,7 @@ require "dependabot/git_commit_checker"
 require "dependabot/swift/update_checker"
 require "dependabot/swift/requirement"
 require "dependabot/swift/version"
+require "dependabot/swift/xcode_file_helpers"
 require "dependabot/update_checkers/version_filters"
 
 module Dependabot
@@ -145,12 +146,32 @@ module Dependabot
           # Only versionRange has an explicit upper bound that should be respected.
           return true if %w(exactVersion upToNextMajorVersion upToNextMinorVersion).include?(kind)
 
+          # For sub-dependencies that are not declared directly in project.pbxproj
+          # (e.g., transitive dependencies of local packages), kind will be nil and
+          # the requirement comes from Package.resolved as an equality pin.
+          # In this case, we allow updates since the actual constraint lives in
+          # the local package's Package.swift, which we don't have access to.
+          # This may produce a pin that is not resolvable for the full package graph.
+          # In Xcode mode we intentionally defer that validation to downstream
+          # SwiftPM/Xcode resolution.
+          return true if kind.nil? && package_resolved_requirement?
+
           requirement = dependency_requirement
           return true unless requirement
 
           requirement.satisfied_by?(version)
         end
 
+        # Returns true if the dependency's requirement originates from an
+        # Xcode-managed Package.resolved file (rather than project.pbxproj).
+        sig { returns(T::Boolean) }
+        def package_resolved_requirement?
+          dependency.requirements.any? do |req|
+            file = req[:file]
+            file.is_a?(String) && XcodeFileHelpers.xcode_resolved_path?(file)
+          end
+        end
+
         sig do
           params(
             tags: T::Array[T::Hash[Symbol, T.untyped]]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.368.0
+  version: 0.369.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.368.0
+        version: 0.369.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.368.0
+        version: 0.369.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -274,7 +274,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.368.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.369.0
 rdoc_options: []
 require_paths:
 - lib