dependabot-swift 0.386.0 → 0.387.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b519a5e6fa6c528dbf17979ac4f6098c72fd5d2dd8556227d54cbfb037c1f798
-  data.tar.gz: aa846626e5bd32753a4693312002ae13e64940d1274693c15d8fc5fd042c9db1
+  metadata.gz: b354cacba27d8bed15800f9406537dfab055c1ddd4f71805b578e8d7a443e1a7
+  data.tar.gz: '00208626e381f350b287ca78ac59a30066243f925503454145b3c7cca8c143f1'
 SHA512:
-  metadata.gz: cefbb851396594af4d6d7085975b6b60a6eebacdb9ee6c77c4341d4e48ac1368b3eb127283a33d0eb0f104e3a06327fed46da5c73d44459ff657bbe33a54dbe9
-  data.tar.gz: 12fdf67a310d1433d310527eb29c8bbf2b36fa4beff1fa2f2a4767f6bd61120e12e9cc5fabb1136d66070a1c7152c5480ccea74f9057eeb468a5184e7494204b
+  metadata.gz: 9043fdeb9fffbb3fb4473c687a5e7cbb75c3405c767739be645efc8b57cba715e139394f41d1729652c021f14347154f62b288b37bf7feb6e76832269e624682
+  data.tar.gz: a7568ae5132652a801a449504187e19e6ce10ad59f8290ed696bf556f6612f52edd1b9435137cf14586fd8984191987266e20e66a89d0059efe949bd4be0c561

data/lib/dependabot/swift/file_parser/dependency_parser.rb

@@ -48,7 +48,7 @@ module Dependabot
           end
         end
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(T::Hash[String, Object]) }
         def formatted_deps
           deps = SharedHelpers.run_shell_command(
             "swift package show-dependencies --format json",
@@ -60,30 +60,41 @@ module Dependabot
 
         sig do
           params(
-            data: T::Hash[String, T.untyped],
+            data: T::Hash[String, Object],
             level: Integer
           )
             .returns(T::Array[Dependabot::Dependency])
         end
         def subdependencies(data, level: 0)
-          data["dependencies"].flat_map { |root| all_dependencies(root, level: level) }
+          dependencies = data["dependencies"]
+          return [] unless dependencies.is_a?(Array)
+
+          dependencies.flat_map do |root|
+            next [] unless root.is_a?(Hash)
+
+            all_dependencies(root, level: level)
+          end
         end
 
         sig do
           params(
-            data: T::Hash[String, T.untyped],
+            data: T::Hash[String, Object],
             level: Integer
           )
             .returns(T::Array[Dependabot::Dependency])
         end
         def all_dependencies(data, level: 0)
           identity = data["identity"]
-          url = SharedHelpers.scp_to_standard(data["url"])
-          name = UrlHelpers.normalize_name(url)
+          url_value = data["url"]
           version = data["version"]
+          return subdependencies(data, level: level + 1) unless url_value.is_a?(String)
+
+          url = SharedHelpers.scp_to_standard(url_value)
+          name = UrlHelpers.normalize_name(url)
+          version = nil unless version.is_a?(String)
 
           source = { type: "git", url: url, ref: version, branch: nil }
-          metadata = { identity: identity }
+          metadata = { identity: identity.is_a?(String) ? identity : nil }
           args = { name: name, version: version, package_manager: "swift", requirements: [], metadata: metadata }
 
           if level.zero?
@@ -92,7 +103,7 @@ module Dependabot
             args[:subdependency_metadata] = [{ source: source }]
           end
 
-          dep = Dependency.new(**args) if data["version"] != "unspecified"
+          dep = Dependency.new(**args) if version != "unspecified"
 
           [dep, *subdependencies(data, level: level + 1)].compact
         end

data/lib/dependabot/swift/file_parser/manifest_parser.rb

@@ -27,7 +27,7 @@ module Dependabot
           @source = source
         end
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         def requirements
           found = manifest.content&.scan(DEPENDENCY)&.find do |_declaration, url, _requirement|
             SharedHelpers.scp_to_standard(url.to_s) == source[:url]

data/lib/dependabot/swift/file_parser/package_resolved_parser.rb

@@ -46,7 +46,7 @@ module Dependabot
         sig { returns(Dependabot::DependencyFile) }
         attr_reader :resolved_file
 
-        sig { returns(T::Hash[String, T.untyped]) }
+        sig { returns(T::Hash[String, Object]) }
         def parse_json
           content = resolved_file.content
           unless content
@@ -64,7 +64,7 @@ module Dependabot
           )
         end
 
-        sig { params(parsed: T::Hash[String, T.untyped]).returns(Integer) }
+        sig { params(parsed: T::Hash[String, Object]).returns(Integer) }
         def detect_schema_version(parsed)
           version = parsed["version"]
 
@@ -81,13 +81,14 @@ module Dependabot
 
         sig do
           params(
-            parsed: T::Hash[String, T.untyped],
+            parsed: T::Hash[String, Object],
             schema_version: Integer
-          ).returns(T::Array[T::Hash[String, T.untyped]])
+          ).returns(T::Array[T::Hash[String, Object]])
         end
         def extract_pins(parsed, schema_version)
           pins = if schema_version == 1
-                   parsed.dig("object", "pins")
+                   object = parsed["object"]
+                   object["pins"] if object.is_a?(Hash)
                  else
                    # v2 and v3 use the same top-level "pins" key
                    parsed["pins"]
@@ -106,7 +107,7 @@ module Dependabot
 
         sig do
           params(
-            pin: T::Hash[String, T.untyped],
+            pin: T::Hash[String, Object],
             schema_version: Integer
           ).returns(T.nilable(Dependabot::Dependency))
         end
@@ -115,21 +116,34 @@ module Dependabot
           url = pin[T.must(keys[:url])]
           return nil unless url.is_a?(String) && !url.empty?
 
-          state = pin[T.must(keys[:state])] || {}
-          identity = pin[T.must(keys[:identity])]
-          # v1 uses a display name for "package"; normalize to lowercase like v2/v3 "identity".
-          # v2/v3 identity is always lowercase per spec, so only v1 needs downcasing.
-          identity = identity&.downcase if schema_version == 1
+          state = pin_state(pin, T.must(keys[:state]))
 
           build_dependency_object(
-            identity: identity,
+            identity: pin_identity(pin, T.must(keys[:identity]), schema_version),
             url: url,
-            version: state["version"],
-            revision: state["revision"],
-            branch: state["branch"]
+            version: string_value(state["version"]),
+            revision: string_value(state["revision"]),
+            branch: string_value(state["branch"])
           )
         end
 
+        sig { params(pin: T::Hash[String, Object], state_key: String).returns(T::Hash[String, Object]) }
+        def pin_state(pin, state_key)
+          state = pin[state_key]
+          state.is_a?(Hash) ? state : {}
+        end
+
+        sig { params(pin: T::Hash[String, Object], identity_key: String, schema_version: Integer).returns(T.nilable(String)) }
+        def pin_identity(pin, identity_key, schema_version)
+          identity = string_value(pin[identity_key])
+          schema_version == 1 ? identity&.downcase : identity
+        end
+
+        sig { params(value: T.nilable(Object)).returns(T.nilable(String)) }
+        def string_value(value)
+          value if value.is_a?(String)
+        end
+
         sig do
           params(
             identity: T.nilable(String),

data/lib/dependabot/swift/file_parser/pbxproj_parser.rb

@@ -49,12 +49,12 @@ module Dependabot
         # Returns a hash mapping normalized URL to requirement metadata.
         # Each entry includes the Dependabot requirement string and the raw
         # Xcode requirement kind/version info for use in metadata.
-        sig { returns(T::Hash[String, T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Hash[String, T::Hash[Symbol, Object]]) }
         def parse
           content = pbxproj_file.content
           return {} unless content
 
-          requirements = T.let({}, T::Hash[String, T::Hash[Symbol, T.untyped]])
+          requirements = T.let({}, T::Hash[String, T::Hash[Symbol, Object]])
 
           content.scan(PACKAGE_REF_BLOCK).each do |url, requirement_block|
             url = T.cast(url, String)
@@ -81,7 +81,7 @@ module Dependabot
 
         sig do
           params(block: String)
-            .returns(T.nilable(T::Hash[Symbol, T.untyped]))
+            .returns(T.nilable(T::Hash[Symbol, Object]))
         end
         def parse_requirement_block(block)
           kind = block.match(KIND_PATTERN)&.captures&.first
@@ -103,7 +103,7 @@ module Dependabot
           end
         end
 
-        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(block: String).returns(T::Hash[Symbol, Object]) }
         def build_up_to_next_major(block)
           min_version = extract_version(block, MIN_VERSION_PATTERN)
           requirement_string = "from: \"#{min_version}\""
@@ -116,7 +116,7 @@ module Dependabot
           }
         end
 
-        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(block: String).returns(T::Hash[Symbol, Object]) }
         def build_up_to_next_minor(block)
           min_version = extract_version(block, MIN_VERSION_PATTERN)
           requirement_string = ".upToNextMinor(from: \"#{min_version}\")"
@@ -129,7 +129,7 @@ module Dependabot
           }
         end
 
-        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(block: String).returns(T::Hash[Symbol, Object]) }
         def build_exact(block)
           version = extract_version(block, MIN_VERSION_PATTERN) || extract_version(block, VERSION_PATTERN)
           requirement_string = "exact: \"#{version}\""
@@ -142,7 +142,7 @@ module Dependabot
           }
         end
 
-        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(block: String).returns(T::Hash[Symbol, Object]) }
         def build_range(block)
           min_version = extract_version(block, MIN_VERSION_PATTERN)
           max_version = extract_version(block, MAX_VERSION_PATTERN)
@@ -156,7 +156,7 @@ module Dependabot
           }
         end
 
-        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(block: String).returns(T::Hash[Symbol, Object]) }
         def build_branch(block)
           branch = block.match(BRANCH_PATTERN)&.captures&.first
 
@@ -168,7 +168,7 @@ module Dependabot
           }
         end
 
-        sig { params(block: String).returns(T::Hash[Symbol, T.untyped]) }
+        sig { params(block: String).returns(T::Hash[Symbol, Object]) }
         def build_revision(block)
           revision = block.match(REVISION_PATTERN)&.captures&.first
 

data/lib/dependabot/swift/file_parser/xcode_spm_resolver.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -65,9 +65,9 @@ module Dependabot
         # Collects requirement info from all project.pbxproj support files,
         # keyed by Xcode scope directory so each resolved file can be enriched
         # by requirements from its closest matching Xcode scope.
-        sig { returns(T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]]) }
+        sig { returns(T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, Object]]]) }
         def aggregate_pbxproj_requirements
-          scoped = T.let({}, T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]])
+          scoped = T.let({}, T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, Object]]])
 
           pbxproj_files.each do |pbxproj_file|
             xcode_scope_dir = extract_xcode_scope_dir(pbxproj_file.name)
@@ -83,8 +83,8 @@ module Dependabot
 
         sig do
           params(
-            scoped_requirements: T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]]
-          ).returns(T::Hash[String, T::Hash[Symbol, T.untyped]])
+            scoped_requirements: T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, Object]]]
+          ).returns(T::Hash[String, T::Hash[Symbol, Object]])
         end
         def merge_scopes(scoped_requirements)
           scoped_requirements.values.each_with_object({}) do |requirements, merged|
@@ -94,9 +94,9 @@ module Dependabot
 
         sig do
           params(
-            scoped_requirements: T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, T.untyped]]],
+            scoped_requirements: T::Hash[T.nilable(String), T::Hash[String, T::Hash[Symbol, Object]]],
             resolved_file_name: String
-          ).returns(T::Hash[String, T::Hash[Symbol, T.untyped]])
+          ).returns(T::Hash[String, T::Hash[Symbol, Object]])
         end
         def requirements_for_resolved_file(scoped_requirements:, resolved_file_name:)
           scope_dir = extract_xcode_scope_dir(resolved_file_name)
@@ -129,7 +129,7 @@ module Dependabot
         sig do
           params(
             dep: Dependabot::Dependency,
-            pbxproj_requirements: T::Hash[String, T::Hash[Symbol, T.untyped]]
+            pbxproj_requirements: T::Hash[String, T::Hash[Symbol, Object]]
           ).returns(Dependabot::Dependency)
         end
         def enrich_with_pbxproj_requirements(dep, pbxproj_requirements)

data/lib/dependabot/swift/file_updater/manifest_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_updaters/base"
@@ -14,8 +14,8 @@ module Dependabot
         sig do
           params(
             content: String,
-            old_requirements: T::Array[T::Hash[Symbol, T.untyped]],
-            new_requirements: T::Array[T::Hash[Symbol, T.untyped]]
+            old_requirements: T::Array[T::Hash[Symbol, Object]],
+            new_requirements: T::Array[T::Hash[Symbol, Object]]
           )
             .void
         end
@@ -30,11 +30,13 @@ module Dependabot
           updated_content = content
 
           old_requirements.zip(new_requirements).each do |old, new|
+            old_metadata = metadata(old)
+            new_metadata = metadata(T.must(new))
             updated_content = RequirementReplacer.new(
               content: updated_content,
-              declaration: old[:metadata][:declaration_string],
-              old_requirement: old[:metadata][:requirement_string],
-              new_requirement: T.must(new)[:metadata][:requirement_string]
+              declaration: string_value(old_metadata, :declaration_string),
+              old_requirement: string_value(old_metadata, :requirement_string),
+              new_requirement: string_value(new_metadata, :requirement_string)
             ).updated_content
           end
 
@@ -46,11 +48,27 @@ module Dependabot
         sig { returns(String) }
         attr_reader :content
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         attr_reader :old_requirements
 
-        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         attr_reader :new_requirements
+
+        sig { params(requirement: T::Hash[Symbol, Object]).returns(T::Hash[Symbol, Object]) }
+        def metadata(requirement)
+          value = requirement[:metadata]
+          raise TypeError, "Expected metadata to be a Hash" unless value.is_a?(Hash)
+
+          value
+        end
+
+        sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(String) }
+        def string_value(hash, key)
+          value = hash.fetch(key)
+          raise TypeError, "Expected #{key} to be a String" unless value.is_a?(String)
+
+          value
+        end
       end
     end
   end

data/lib/dependabot/swift/file_updater/requirement_replacer.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_updaters/base"

data/lib/dependabot/swift/file_updater/xcode_lockfile_updater.rb

@@ -26,7 +26,7 @@ module Dependabot
             2 => { url: "location", identity: "identity", pins_path: ["pins"] },
             3 => { url: "location", identity: "identity", pins_path: ["pins"] }
           }.freeze,
-          T::Hash[Integer, T::Hash[Symbol, T.untyped]]
+          T::Hash[Integer, T::Hash[Symbol, Object]]
         )
 
         sig do
@@ -87,7 +87,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::DependencyFile]) }
         attr_reader :workspace_files
 
-        sig { params(content: String).returns(T::Hash[String, T.untyped]) }
+        sig { params(content: String).returns(T::Hash[String, Object]) }
         def parse_json(content)
           JSON.parse(content)
         rescue JSON::ParserError => e
@@ -97,7 +97,7 @@ module Dependabot
           )
         end
 
-        sig { params(parsed: T::Hash[String, T.untyped]).returns(Integer) }
+        sig { params(parsed: T::Hash[String, Object]).returns(Integer) }
         def detect_schema_version(parsed)
           version = parsed["version"]
 
@@ -114,9 +114,9 @@ module Dependabot
 
         sig do
           params(
-            parsed: T::Hash[String, T.untyped],
+            parsed: T::Hash[String, Object],
             schema_version: Integer,
-            keys: T::Hash[Symbol, T.untyped]
+            keys: T::Hash[Symbol, Object]
           ).void
         end
         def update_pins(parsed, schema_version, keys)
@@ -138,14 +138,14 @@ module Dependabot
 
         sig do
           params(
-            parsed: T::Hash[String, T.untyped],
+            parsed: T::Hash[String, Object],
             path: T::Array[String]
-          ).returns(T.untyped)
+          ).returns(Object)
         end
         def dig_pins(parsed, path)
           # Navigate nested hash using path keys
           # Path is either ["object", "pins"] for v1 or ["pins"] for v2/v3
-          current = T.let(parsed, T.untyped)
+          current = T.let(parsed, Object)
           path.each do |key|
             break unless current.is_a?(Hash)
 
@@ -156,9 +156,9 @@ module Dependabot
 
         sig do
           params(
-            pins: T::Array[T::Hash[String, T.untyped]],
+            pins: T::Array[T::Hash[String, Object]],
             dependency: Dependabot::Dependency,
-            keys: T::Hash[Symbol, T.untyped],
+            keys: T::Hash[Symbol, Object],
             schema_version: Integer
           ).void
         end
@@ -192,11 +192,11 @@ module Dependabot
 
         sig do
           params(
-            pins: T::Array[T::Hash[String, T.untyped]],
+            pins: T::Array[T::Hash[String, Object]],
             dependency: Dependabot::Dependency,
-            keys: T::Hash[Symbol, T.untyped],
+            keys: T::Hash[Symbol, Object],
             schema_version: Integer
-          ).returns(T.nilable(T::Hash[String, T.untyped]))
+          ).returns(T.nilable(T::Hash[String, Object]))
         end
         def find_pin_for_dependency(pins, dependency, keys, schema_version)
           identity_key = T.cast(keys[:identity], String)
@@ -205,6 +205,7 @@ module Dependabot
 
           pins.find do |pin|
             pin_identity = pin[identity_key]
+            pin_identity = nil unless pin_identity.is_a?(String)
             pin_identity = pin_identity&.downcase if schema_version == 1
 
             if identity && pin_identity == identity

data/lib/dependabot/swift/native_requirement.rb

@@ -22,14 +22,20 @@ module Dependabot
       sig do
         type_parameters(:T)
           .params(
-            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            requirements: T::Array[T::Hash[Symbol, Object]],
             _blk: T.proc.params(declaration: NativeRequirement).returns(String)
           )
-          .returns(T::Array[T::Hash[Symbol, T.untyped]])
+          .returns(T::Array[T::Hash[Symbol, Object]])
       end
       def self.map_requirements(requirements, &_blk)
         requirements.map do |requirement|
-          declaration = new(requirement[:metadata][:requirement_string])
+          metadata = requirement[:metadata]
+          next requirement unless metadata.is_a?(Hash)
+
+          requirement_string = metadata[:requirement_string]
+          next requirement unless requirement_string.is_a?(String)
+
+          declaration = new(requirement_string)
 
           new_declaration = yield(declaration)
           new_requirement = new(new_declaration)

data/lib/dependabot/swift/requirement.rb

@@ -5,12 +5,47 @@ require "sorbet-runtime"
 
 require "dependabot/requirement"
 require "dependabot/utils"
+require "dependabot/swift/version"
 
 module Dependabot
   module Swift
     class Requirement < Dependabot::Requirement
       extend T::Sig
 
+      quoted = OPS.keys.map { |k| Regexp.quote(k) }.join("|")
+      # Swift requirement grammar (intentionally not strict SemVer): allows multi-segment numeric
+      # cores like "4.2.5.1" for compatibility bounds, but still rejects leading zeros and malformed
+      # prerelease/build tails via SemVer-style dot-separated identifiers.
+      num = "(?:0|[1-9][0-9]*)"
+      pre_id = "(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)"
+      version_pattern = "#{num}(?:\\.#{num})*" \
+                        "(?:-#{pre_id}(?:\\.#{pre_id})*)?" \
+                        '(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?'
+
+      PATTERN = T.let(/\A\s*(#{quoted})?\s*(#{version_pattern})\s*\z/, Regexp)
+
+      # Parse each boundary into a Swift::Version so prerelease boundaries use SemVer section 11 ordering.
+      sig { override.params(obj: T.any(Gem::Version, String)).returns([String, Gem::Version]) }
+      def self.parse(obj)
+        # Preserve a Swift::Version; convert other stable Gem::Versions so the boundary stays orderable.
+        return ["=", obj] if obj.is_a?(Swift::Version)
+
+        if obj.is_a?(Gem::Version)
+          # Reject prerelease Gem::Versions: #to_s is lossily canonicalized (e.g. "1.0.0-alpha" -> "1.0.0.pre.alpha").
+          raise BadRequirementError, "Illformed requirement [#{obj.inspect}]" if obj.prerelease?
+
+          return ["=", Swift::Version.new(obj.to_s)]
+        end
+
+        unless (matches = PATTERN.match(obj.to_s))
+          raise BadRequirementError, "Illformed requirement [#{obj.inspect}]"
+        end
+
+        return DefaultRequirement if matches[1] == ">=" && matches[2] == "0"
+
+        [matches[1] || "=", Swift::Version.new(T.must(matches[2]))]
+      end
+
       # For consistency with other languages, we define a requirements array.
       # Swift doesn't have an `OR` separator for requirements, so it
       # always contains a single element.

data/lib/dependabot/swift/update_checker/requirements_updater.rb

@@ -93,8 +93,8 @@ module Dependabot
 
         sig do
           params(
-            source: T.nilable(T::Hash[T.any(String, Symbol), T.untyped])
-          ).returns(T.nilable(T::Hash[T.any(String, Symbol), T.untyped]))
+            source: T.nilable(T::Hash[T.any(String, Symbol), Object])
+          ).returns(T.nilable(T::Hash[T.any(String, Symbol), Object]))
         end
         def update_source_ref(source)
           return source unless source && target_version

data/lib/dependabot/swift/update_checker/xcode_version_resolver.rb

@@ -38,16 +38,19 @@ module Dependabot
           tag = latest_resolvable_version_tag
           return nil unless tag
 
-          Version.new(tag.fetch(:version))
+          version = tag_version(tag)
+          return nil unless version
+
+          Version.new(version)
         end
 
         # Returns the full tag info including commit_sha for the latest resolvable version
         # Memoized to avoid redundant computation when called from UpdateChecker
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def latest_resolvable_version_tag
           @latest_resolvable_version_tag ||= T.let(
             compute_latest_resolvable_version_tag,
-            T.nilable(T::Hash[Symbol, T.untyped])
+            T.nilable(T::Hash[Symbol, Object])
           )
         end
 
@@ -56,16 +59,17 @@ module Dependabot
           return nil unless version_pinned?
 
           tags = git_commit_checker.local_tags_for_allowed_versions
-          relevant_tags = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
-            tags,
+          relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
+            tags.filter_map { |tag| tag_version(tag) },
             security_advisories
           )
+          relevant_tags = tags.select { |tag| (version = tag_version(tag)) && relevant_versions.include?(version) }
           relevant_tags = filter_lower_tags(relevant_tags)
 
-          lowest_tag = relevant_tags.min_by { |tag| tag.fetch(:version) }
+          lowest_tag = relevant_tags.min_by { |tag| T.must(tag_version(tag)) }
           return nil unless lowest_tag
 
-          Version.new(lowest_tag.fetch(:version))
+          Version.new(T.must(tag_version(lowest_tag)))
         end
 
         sig { returns(T::Boolean) }
@@ -86,7 +90,7 @@ module Dependabot
         sig { returns(T::Array[Dependabot::SecurityAdvisory]) }
         attr_reader :security_advisories
 
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def compute_latest_resolvable_version_tag
           return nil unless version_pinned?
 
@@ -106,7 +110,7 @@ module Dependabot
         # For versionRange requirements, find the highest version that satisfies
         # the explicit upper bound constraint. We don't filter out lower versions here
         # because `can_update?` will decide whether an update is actually needed.
-        sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+        sig { returns(T.nilable(T::Hash[Symbol, Object])) }
         def compute_latest_version_in_range
           requirement = dependency_requirement
           return nil unless requirement
@@ -132,7 +136,7 @@ module Dependabot
           dependency.requirements.first&.dig(:metadata, :kind)
         end
 
-        sig { params(version: T.untyped).returns(T::Boolean) }
+        sig { params(version: Object).returns(T::Boolean) }
         def version_meets_requirements?(version)
           kind = requirement_kind
 
@@ -174,14 +178,23 @@ module Dependabot
 
         sig do
           params(
-            tags: T::Array[T::Hash[Symbol, T.untyped]]
-          ).returns(T::Array[T::Hash[Symbol, T.untyped]])
+            tags: T::Array[T::Hash[Symbol, Object]]
+          ).returns(T::Array[T::Hash[Symbol, Object]])
         end
         def filter_lower_tags(tags)
           current = current_version
           return tags unless current
 
-          tags.select { |tag| tag.fetch(:version) > current }
+          tags.select do |tag|
+            version = tag_version(tag)
+            version && version > current
+          end
+        end
+
+        sig { params(tag: T::Hash[Symbol, Object]).returns(T.nilable(Gem::Version)) }
+        def tag_version(tag)
+          version = tag[:version]
+          version if version.is_a?(Gem::Version)
         end
 
         sig { returns(T.nilable(Dependabot::Version)) }

data/lib/dependabot/swift/update_checker.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "sorbet-runtime"
@@ -81,7 +81,8 @@ module Dependabot
         latest = latest_resolvable_version
         if latest && target == latest
           tag = xcode_version_resolver.latest_resolvable_version_tag
-          commit_sha = tag&.fetch(:commit_sha, nil)
+          tag_commit_sha = tag&.fetch(:commit_sha, nil)
+          commit_sha = tag_commit_sha if tag_commit_sha.is_a?(String)
         end
 
         RequirementsUpdater.new(
@@ -111,7 +112,7 @@ module Dependabot
         tag = latest_version_tag
         return unless tag
 
-        tag.fetch(:version)
+        tag_version(tag)
       end
 
       sig { returns(T.nilable(Dependabot::Version)) }
@@ -123,7 +124,7 @@ module Dependabot
         tag = latest_version_tag
         return unless tag
 
-        tag.fetch(:version)
+        tag_version(tag)
       end
 
       sig { returns(T.nilable(Dependabot::Version)) }
@@ -135,7 +136,7 @@ module Dependabot
         tag = lowest_security_fix_version_tag
         return unless tag
 
-        tag.fetch(:version)
+        tag_version(tag)
       end
 
       sig { returns(T.nilable(Dependabot::Version)) }
@@ -170,7 +171,7 @@ module Dependabot
         Version.new(lowest_resolvable_security_fix_version)
       end
 
-      sig { params(requirements: T::Array[T::Hash[Symbol, T.untyped]]).returns(VersionResolver) }
+      sig { params(requirements: T::Array[T::Hash[Symbol, Object]]).returns(VersionResolver) }
       def version_resolver_for(requirements)
         VersionResolver.new(
           dependency: dependency,
@@ -181,26 +182,26 @@ module Dependabot
         )
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, Object])) }
       def latest_version_tag
         git_commit_checker.local_tag_for_latest_version(update_cooldown)
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
       def unlocked_requirements
         NativeRequirement.map_requirements(old_requirements) do |_old_requirement|
           "\"#{dependency.version}\"...\"#{latest_version}\""
         end
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
       def force_lowest_security_fix_requirements
         NativeRequirement.map_requirements(old_requirements) do |_old_requirement|
           "\"#{lowest_security_fix_version}\"...\"#{lowest_security_fix_version}\""
         end
       end
 
-      sig { params(new_requirements: T::Array[T::Hash[Symbol, T.untyped]]).returns(Dependabot::DependencyFile) }
+      sig { params(new_requirements: T::Array[T::Hash[Symbol, Object]]).returns(Dependabot::DependencyFile) }
       def prepare_manifest_for(new_requirements)
         manifest_file = T.must(manifest)
 
@@ -256,26 +257,39 @@ module Dependabot
         )
       end
 
-      sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { returns(T.nilable(T::Hash[Symbol, Object])) }
       def lowest_security_fix_version_tag
         tags = git_commit_checker.local_tags_for_allowed_versions
         find_lowest_secure_version(tags)
       end
 
-      sig { params(tags: T::Array[T::Hash[Symbol, T.untyped]]).returns(T.nilable(T::Hash[Symbol, T.untyped])) }
+      sig { params(tags: T::Array[T::Hash[Symbol, Object]]).returns(T.nilable(T::Hash[Symbol, Object])) }
       def find_lowest_secure_version(tags)
-        relevant_tags = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(tags, security_advisories)
+        relevant_versions = Dependabot::UpdateCheckers::VersionFilters.filter_vulnerable_versions(
+          tags.filter_map { |tag| tag_version(tag) },
+          security_advisories
+        )
+        relevant_tags = tags.select { |tag| (version = tag_version(tag)) && relevant_versions.include?(version) }
         relevant_tags = filter_lower_tags(relevant_tags)
 
-        relevant_tags.min_by { |tag| tag.fetch(:version) }
+        relevant_tags.min_by { |tag| T.must(tag_version(tag)) }
       end
 
-      sig { params(tags_array: T::Array[T::Hash[Symbol, T.untyped]]).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { params(tags_array: T::Array[T::Hash[Symbol, Object]]).returns(T::Array[T::Hash[Symbol, Object]]) }
       def filter_lower_tags(tags_array)
         return tags_array unless current_version
 
         tags_array
-          .select { |tag| tag.fetch(:version) > current_version }
+          .select do |tag|
+            version = tag_version(tag)
+            version && version > current_version
+          end
+      end
+
+      sig { params(tag: T::Hash[Symbol, Object]).returns(T.nilable(Dependabot::Version)) }
+      def tag_version(tag)
+        version = tag[:version]
+        Dependabot::Swift::Version.new(version.to_s) if version.is_a?(Gem::Version)
       end
 
       sig { returns(XcodeVersionResolver) }

data/lib/dependabot/swift/version.rb

@@ -1,12 +1,226 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "sorbet-runtime"
+
 require "dependabot/utils"
 require "dependabot/version"
 
 module Dependabot
   module Swift
+    # Swift uses SemVer: strict validation in .correct?, section 11 pre-release precedence in #<=>.
+    # #initialize stays tolerant because GitCommitChecker builds unchecked versions (e.g. "0.0.0.0").
     class Version < Dependabot::Version
+      extend T::Sig
+
+      # SEMVER_REGEX uses ^/$ line anchors; anchor to the whole string to reject multiline.
+      SEMVER_ANCHORED = T.let(/\A#{SEMVER_REGEX.source}\z/x, Regexp)
+
+      sig { override.params(version: VersionParameter).returns(T::Boolean) }
+      def self.correct?(version)
+        return false if version.nil?
+
+        # Strict SemVer only: rejects "1.0.0.alpha", "0.0.0.0", "01.2.3" and multiline input.
+        version.to_s.delete_prefix("v").match?(SEMVER_ANCHORED)
+      end
+
+      sig { override.params(version: VersionParameter).void }
+      def initialize(version)
+        @version_string = T.let(version.to_s.dup.freeze, String)
+
+        stripped = version.to_s.delete_prefix("v")
+        pre_part, plus, build = stripped.partition("+")
+        # Strip only well-formed build metadata (SemVer rule 10 ignores it); a malformed "+…" tail is
+        # kept so it stays distinct and sorts below the release instead of canonicalizing to it.
+        build_ok = plus.empty? || build.match?(/\A[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*\z/)
+        @semver = T.let((build_ok ? pre_part : stripped).freeze, String)
+
+        base, suffix = pre_part.split("-", 2)
+        # Split on "-" only when the core before it is numeric (else the hyphen is part of the tail).
+        if suffix && !base.to_s.match?(/\A[0-9]+(?:\.[0-9]+)*\z/)
+          base = pre_part
+          suffix = nil
+        end
+        release, inferred = normalize_release(T.must(base))
+        suffix ||= inferred
+        # Fold a malformed build tail into the pre-release suffix so it stays distinct and orderable.
+        suffix = [suffix, "+#{build}"].compact.join(".") unless build_ok
+        @prerelease_suffix = T.let(suffix, T.nilable(String))
+        @release_core = T.let(Gem::Version.new(release), Gem::Version)
+        # Seed the superclass with a strict-SemVer form so tolerant tags never raise, while mixed
+        # comparisons still see the pre-release state.
+        super(semver_seed(release, @prerelease_suffix))
+      end
+
+      sig { override.returns(String) }
+      def to_s
+        @version_string
+      end
+
+      sig { override.returns(String) }
+      def to_semver
+        @semver
+      end
+
+      sig { returns(Gem::Version) }
+      def bump
+        # Bump the full-precision release core so "~>" bounds ignore the padded 3-segment seed.
+        @release_core.bump
+      end
+
+      sig { override.returns(T::Boolean) }
+      def prerelease?
+        return true unless @prerelease_suffix.nil?
+
+        super
+      end
+
+      # Strict-SemVer range with "-0" bounds (earliest prerelease) so the grammar accepts it.
+      sig { override.returns(T::Array[String]) }
+      def ignored_minor_versions
+        parts = to_semver.split(".")
+        major = parts[0].to_i
+        minor = parts.fetch(1, 0).to_i
+        [">= #{major}.#{minor + 1}.0-0, < #{major + 1}.0.0-0"]
+      end
+
+      # Strict-SemVer floor at "-0" (earliest prerelease) so a semver-major ignore covers numeric prereleases too.
+      sig { override.returns(T::Array[String]) }
+      def ignored_major_versions
+        major = T.must(to_semver.split(".").first).to_i
+        [">= #{major + 1}.0.0-0"]
+      end
+
+      sig { params(other: Object).returns(T::Boolean) }
+      def eql?(other)
+        return false unless other.is_a?(Version)
+
+        to_semver == other.to_semver
+      end
+
+      sig { override.returns(Integer) }
+      def hash
+        to_semver.hash
+      end
+
+      sig { params(other: Object).returns(T::Boolean) }
+      def ==(other)
+        cmp = self <=> other
+        !cmp.nil? && cmp.zero?
+      end
+
+      sig { params(other: Object).returns(T.nilable(Integer)) }
+      def <=>(other)
+        return nil if other.nil?
+
+        resolved = coerce_operand(other)
+        return nil if resolved.nil?
+
+        # Compare release cores directly (not via super, whose seeded state uses RubyGems
+        # pre-release ordering) so section 11 governs the pre-release tiebreak.
+        release_cmp = release_core <=> resolved.release_core
+        return release_cmp unless release_cmp&.zero?
+
+        compare_semver_prerelease(@prerelease_suffix, resolved.prerelease_suffix)
+      rescue ArgumentError
+        nil
+      end
+
+      protected
+
+      sig { returns(T.nilable(String)) }
+      attr_reader :prerelease_suffix
+
+      sig { returns(Gem::Version) }
+      attr_reader :release_core
+
+      private
+
+      # Coerce an operand to a Swift::Version for section 11 ordering, or nil if not orderable.
+      # A raw Gem::Version pre-release is declined (lossy #to_s, divergent RubyGems ordering); any
+      # #to_s failure also yields nil to keep comparison safe (never raises).
+      sig { params(other: Object).returns(T.nilable(Version)) }
+      def coerce_operand(other)
+        return other if other.is_a?(Version)
+        return nil if other.is_a?(Gem::Version) && other.prerelease?
+
+        normalized = other.to_s.delete_prefix("v")
+        if normalized.include?("+")
+          return nil unless Version.correct?(normalized)
+
+          normalized = T.must(normalized.split("+").first)
+        end
+        return nil unless Gem::Version.correct?(normalized)
+
+        T.cast(Version.new(normalized), Version)
+      rescue StandardError
+        nil
+      end
+
+      # Returns [release core, inferred pre-release or nil]: a non-SemVer tag is reduced to its
+      # numeric core with the non-numeric tail as pre-release ("1.0.0.alpha" -> "alpha").
+      sig { params(base: String).returns([String, T.nilable(String)]) }
+      def normalize_release(base)
+        return [base, nil] if self.class.correct?(base)
+
+        parts = base.split(".")
+        numeric = parts.take_while { |s| s.match?(/\A\d+\z/) }
+        raise ArgumentError, "Malformed version number string #{@version_string}" if numeric.empty?
+
+        tail = parts.drop(numeric.length)
+        # Preserve every numeric segment so multi-segment requirement bounds keep full precision.
+        release = numeric.map { |s| s.to_i.to_s }.join(".")
+        [release, tail.empty? ? nil : tail.join(".")]
+      end
+
+      # Strict-SemVer seed for the Gem superclass: Gem::Version#initialize validates via
+      # self.class.correct? (strict 3-part SemVer here), so the seed is a 3-segment core plus the
+      # suffix only when it is valid SemVer, letting tolerant tags (e.g. "0.0.0.0") never raise.
+      sig { params(release: String, suffix: T.nilable(String)).returns(String) }
+      def semver_seed(release, suffix)
+        core = (release.split(".").first(3) + %w(0 0 0)).first(3).join(".")
+        return core unless suffix && self.class.correct?("0.0.0-#{suffix}")
+
+        "#{core}-#{suffix}"
+      end
+
+      # SemVer section 11 pre-release precedence: 1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0.
+      sig { params(left: T.nilable(String), right: T.nilable(String)).returns(Integer) }
+      def compare_semver_prerelease(left, right)
+        return 0 if left.nil? && right.nil?
+        return 1 if left.nil?
+        return -1 if right.nil?
+
+        left_ids = left.split(".")
+        right_ids = right.split(".")
+
+        # Compare identifiers pairwise over the common prefix.
+        [left_ids.length, right_ids.length].min.times do |i|
+          cmp = compare_semver_identifier(T.must(left_ids[i]), T.must(right_ids[i]))
+          return cmp unless cmp.zero?
+        end
+
+        # All shared identifiers equal: more pre-release fields ranks higher.
+        left_ids.length <=> right_ids.length
+      end
+
+      sig { params(left: String, right: String).returns(Integer) }
+      def compare_semver_identifier(left, right)
+        left_numeric = left.match?(/\A\d+\z/)
+        right_numeric = right.match?(/\A\d+\z/)
+
+        if left_numeric && right_numeric
+          cmp = left.to_i <=> right.to_i
+          # Tiebreak textually so SemVer-invalid leading-zero ids ("01" vs "1") stay distinct.
+          cmp.zero? ? T.must(left <=> right) : cmp
+        elsif left_numeric
+          -1
+        elsif right_numeric
+          1
+        else
+          T.must(left <=> right)
+        end
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.386.0
+  version: 0.387.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.387.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -272,7 +272,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.387.0
 rdoc_options: []
 require_paths:
 - lib