dependabot-swift 0.391.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ecf967273053e6c62d8f9ec69dbf8107ff0e7720da9b82ee9bb30fbf467f4d05
-  data.tar.gz: 7f701d0432112af31d360659a51be50726bdb1d40a5eda41716417a8ce075597
+  metadata.gz: c6a333247d7e23cf5e8864c7f83ace86688a723b74ef1a0c25211fddbbde92f9
+  data.tar.gz: d22ef8c29b754afb10ce11b98f8010da8a32c81803ce4a6e8122c3569827bd62
 SHA512:
-  metadata.gz: 6559a6a5b51751081c2a2052872f59f1eaf47b264b3585218d5fedc825626de7360a841944c9227cda87b0e22d21ed6e6041e52a128ca661cb91dbb0c48a2cb2
-  data.tar.gz: 1da30c2a26fde87da25fbbcc1ff5e5d378680f325bc3cad1d29fb383ba984f7dc9d7e76e3fee86ca9c96b8bf958c2e0fc2ef963e0410af60f66c4c17628b2dcc
+  metadata.gz: '078abe54878e9667b261411ded8caffd38717dc8f620dcffb9806aca36bf9fa23bf71562b4d7297954d05b8b0c1d8f503d1401ade54da804b79c96079a0bbb0f'
+  data.tar.gz: aa477876d59ba302ae34d79d93b7c7e0299818a92d293190aab22cecf8561e04d9213f1f7c335db33dc992d10246b55afda15c4b37ce555c9161dbf1b67744c3

data/lib/dependabot/swift/file_parser/manifest_parser.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "dependabot/file_parsers/base"
+require "dependabot/dependency_requirement"
 require "dependabot/swift/native_requirement"
 
 module Dependabot
@@ -19,18 +20,18 @@ module Dependabot
         sig do
           params(
             manifest: Dependabot::DependencyFile,
-            source: T::Hash[Symbol, String]
+            requirement: Dependabot::DependencyRequirement
           ).void
         end
-        def initialize(manifest, source:)
+        def initialize(manifest, requirement:)
           @manifest = manifest
-          @source = source
+          @requirement = requirement
         end
 
         sig { returns(T::Array[T::Hash[Symbol, Object]]) }
         def requirements
           found = manifest.content&.scan(DEPENDENCY)&.find do |_declaration, url, _requirement|
-            SharedHelpers.scp_to_standard(url.to_s) == source[:url]
+            SharedHelpers.scp_to_standard(url.to_s) == requirement.source_string("url")
           end
 
           return [] unless found
@@ -43,7 +44,7 @@ module Dependabot
               requirement: requirement.to_s,
               groups: ["dependencies"],
               file: manifest.name,
-              source: source,
+              source: T.must(self.requirement.source_hash),
               metadata: { declaration_string: declaration, requirement_string: requirement.declaration }
             }
           ]
@@ -54,8 +55,8 @@ module Dependabot
         sig { returns(Dependabot::DependencyFile) }
         attr_reader :manifest
 
-        sig { returns(T::Hash[Symbol, String]) }
-        attr_reader :source
+        sig { returns(Dependabot::DependencyRequirement) }
+        attr_reader :requirement
       end
     end
   end

data/lib/dependabot/swift/file_parser/xcode_spm_resolver.rb

@@ -142,16 +142,18 @@ module Dependabot
           kind = req_info[:kind]
 
           new_requirements = dep.requirements.map do |req|
-            req.merge(
-              requirement: requirement_str || req[:requirement],
-              file: pbxproj_file,
-              metadata: {
-                # declaration_string is not applicable for Xcode-managed SPM
-                # (no Package.swift manifest to extract it from)
-                declaration_string: nil,
-                requirement_string: requirement_string,
-                kind: kind
-              }.compact
+            Dependabot::DependencyRequirement.create(
+              req.merge(
+                requirement: requirement_str || req.requirement,
+                file: pbxproj_file,
+                metadata: {
+                  # declaration_string is not applicable for Xcode-managed SPM
+                  # (no Package.swift manifest to extract it from)
+                  declaration_string: nil,
+                  requirement_string: requirement_string,
+                  kind: kind
+                }.compact
+              )
             )
           end
 

data/lib/dependabot/swift/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/dependency"
@@ -52,9 +52,12 @@ module Dependabot
 
         dependency_parser.parse.map do |dep|
           if dep.top_level?
-            source = T.must(dep.requirements.first)[:source]
+            requirement = T.must(dep.requirements.first)
 
-            requirements = ManifestParser.new(T.must(package_manifest_file), source: source).requirements
+            requirements = ManifestParser.new(
+              T.must(package_manifest_file),
+              requirement: requirement
+            ).requirements
 
             dependency_set << Dependency.new(
               name: dep.name,

data/lib/dependabot/swift/file_updater/manifest_updater.rb

@@ -14,8 +14,8 @@ module Dependabot
         sig do
           params(
             content: String,
-            old_requirements: T::Array[T::Hash[Symbol, Object]],
-            new_requirements: T::Array[T::Hash[Symbol, Object]]
+            old_requirements: T::Array[Dependabot::DependencyRequirement],
+            new_requirements: T::Array[Dependabot::DependencyRequirement]
           )
             .void
         end
@@ -30,13 +30,12 @@ module Dependabot
           updated_content = content
 
           old_requirements.zip(new_requirements).each do |old, new|
-            old_metadata = metadata(old)
-            new_metadata = metadata(T.must(new))
+            new_requirement = T.must(new)
             updated_content = RequirementReplacer.new(
               content: updated_content,
-              declaration: string_value(old_metadata, :declaration_string),
-              old_requirement: string_value(old_metadata, :requirement_string),
-              new_requirement: string_value(new_metadata, :requirement_string)
+              declaration: T.must(old.metadata_string("declaration_string")),
+              old_requirement: T.must(old.metadata_string("requirement_string")),
+              new_requirement: T.must(new_requirement.metadata_string("requirement_string"))
             ).updated_content
           end
 
@@ -48,27 +47,11 @@ module Dependabot
         sig { returns(String) }
         attr_reader :content
 
-        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :old_requirements
 
-        sig { returns(T::Array[T::Hash[Symbol, Object]]) }
+        sig { returns(T::Array[Dependabot::DependencyRequirement]) }
         attr_reader :new_requirements
-
-        sig { params(requirement: T::Hash[Symbol, Object]).returns(T::Hash[Symbol, Object]) }
-        def metadata(requirement)
-          value = requirement[:metadata]
-          raise TypeError, "Expected metadata to be a Hash" unless value.is_a?(Hash)
-
-          value
-        end
-
-        sig { params(hash: T::Hash[Symbol, Object], key: Symbol).returns(String) }
-        def string_value(hash, key)
-          value = hash.fetch(key)
-          raise TypeError, "Expected #{key} to be a String" unless value.is_a?(String)
-
-          value
-        end
       end
     end
   end

data/lib/dependabot/swift/file_updater/xcode_lockfile_updater.rb

@@ -169,9 +169,8 @@ module Dependabot
           state = pin["state"]
           return unless state.is_a?(Hash)
 
-          source = dependency.requirements.first&.dig(:source)
           new_version = dependency.version
-          new_ref = source&.dig(:ref)
+          new_ref = dependency.requirements.first&.source_string("ref")
 
           if new_version
             state["version"] = new_version
@@ -228,7 +227,7 @@ module Dependabot
           @dependencies_for_file ||= T.let(
             dependencies.select do |dep|
               dep.requirements.any? do |req|
-                req_file_matches_resolved_scope?(req[:file])
+                req_file_matches_resolved_scope?(req.file)
               end
             end,
             T.nilable(T::Array[Dependabot::Dependency])

data/lib/dependabot/swift/file_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/file_updaters"
@@ -141,7 +141,7 @@ module Dependabot
 
       sig { params(dep: Dependabot::Dependency).returns(T::Set[String]) }
       def requirement_files_for(dep)
-        files = dep.requirements.map { |req| req[:file] } + (dep.previous_requirements || []).map { |req| req[:file] }
+        files = dep.requirements.map(&:file) + (dep.previous_requirements || []).map(&:file)
         files.compact.to_set
       end
 

data/lib/dependabot/swift/native_requirement.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "dependabot/utils"
+require "dependabot/dependency_requirement"
 require "dependabot/swift/requirement"
 require "sorbet-runtime"
 
@@ -17,33 +18,46 @@ module Dependabot
       attr_reader :declaration
 
       sig do
-        type_parameters(:T)
-          .params(
-            requirements: T::Array[T::Hash[Symbol, Object]],
-            _blk: T.proc.params(declaration: NativeRequirement).returns(String)
-          )
-          .returns(T::Array[T::Hash[Symbol, Object]])
+        params(
+          requirements: T::Array[Dependabot::DependencyRequirement],
+          _blk: T.proc.params(declaration: NativeRequirement).returns(String)
+        )
+          .returns(T::Array[Dependabot::DependencyRequirement])
       end
       def self.map_requirements(requirements, &_blk)
         requirements.map do |requirement|
-          metadata = requirement[:metadata]
-          next requirement unless metadata.is_a?(Hash)
+          metadata = requirement.metadata
+          next requirement unless metadata
 
-          requirement_string = metadata[:requirement_string]
-          next requirement unless requirement_string.is_a?(String)
+          requirement_string = requirement.metadata_string("requirement_string")
+          next requirement unless requirement_string
 
           declaration = new(requirement_string)
 
           new_declaration = yield(declaration)
           new_requirement = new(new_declaration)
 
-          requirement.merge(
-            requirement: new_requirement.to_s,
-            metadata: { requirement_string: new_declaration }
+          Dependabot::DependencyRequirement.create(
+            requirement.merge(
+              requirement: new_requirement.to_s,
+              metadata: requirement_string_metadata(metadata, new_declaration)
+            )
           )
         end
       end
 
+      sig do
+        params(
+          metadata: Dependabot::DependencyRequirement::ObjectHash,
+          requirement_string: String
+        ).returns(Dependabot::DependencyRequirement::ObjectHash)
+      end
+      def self.requirement_string_metadata(metadata, requirement_string)
+        key = metadata.key?("requirement_string") ? "requirement_string" : :requirement_string
+        { key => requirement_string }
+      end
+      private_class_method :requirement_string_metadata
+
       sig { params(declaration: String).void }
       def initialize(declaration)
         @declaration = declaration

data/lib/dependabot/swift/update_checker/requirements_updater.rb

@@ -1,4 +1,4 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "dependabot/dependency_requirement"
@@ -70,23 +70,22 @@ module Dependabot
 
         sig { params(requirement: Dependabot::DependencyRequirement).returns(Dependabot::DependencyRequirement) }
         def update_xcode_requirement(requirement)
-          metadata = requirement[:metadata] || {}
-          requirement_string = metadata[:requirement_string]
-          kind = metadata[:kind]
+          metadata = requirement.metadata || {}
+          requirement_string = requirement.metadata_string("requirement_string")
+          kind = requirement.metadata_string("kind")
 
           new_requirement_string = build_xcode_requirement_string(requirement_string, kind)
           new_requirement = build_xcode_requirement(requirement_string, kind)
 
           # Update source ref to target version
-          updated_source = update_source_ref(requirement[:source])
+          updated_source = update_source_ref(requirement.source_hash)
+          updated_metadata = hash_with_value(metadata, "requirement_string", new_requirement_string)
 
           Dependabot::DependencyRequirement.create(
             requirement.merge(
               requirement: new_requirement,
               source: updated_source,
-              metadata: metadata.merge(
-                requirement_string: new_requirement_string
-              ).compact
+              metadata: updated_metadata
             )
           )
         end
@@ -103,10 +102,33 @@ module Dependabot
           # otherwise fall back to version string
           ref = target_commit_sha || target_version.to_s
 
-          updated_source = source.dup
-          updated_source[:ref] = ref
-          updated_source["ref"] = ref
-          updated_source
+          hash_with_value(source, "ref", ref)
+        end
+
+        sig do
+          params(
+            hash: Dependabot::DependencyRequirement::ObjectHash,
+            key: String,
+            value: T.nilable(Object)
+          ).returns(Dependabot::DependencyRequirement::ObjectHash)
+        end
+        def hash_with_value(hash, key, value)
+          updated = hash.dup
+          actual_key = if hash.key?(key.to_sym)
+                         key.to_sym
+                       elsif hash.key?(key)
+                         key
+                       elsif hash.keys.any?(Symbol)
+                         key.to_sym
+                       else
+                         key
+                       end
+          if value.nil?
+            updated.delete(actual_key)
+          else
+            updated[actual_key] = value
+          end
+          updated
         end
 
         sig do

data/lib/dependabot/swift/update_checker/xcode_version_resolver.rb

@@ -123,7 +123,7 @@ module Dependabot
 
         sig { returns(T.nilable(Dependabot::Swift::Requirement)) }
         def dependency_requirement
-          req_string = dependency.requirements.first&.dig(:requirement)
+          req_string = dependency.requirements.first&.requirement_string
           return nil unless req_string
 
           Dependabot::Swift::Requirement.new(req_string)
@@ -133,7 +133,7 @@ module Dependabot
 
         sig { returns(T.nilable(String)) }
         def requirement_kind
-          dependency.requirements.first&.dig(:metadata, :kind)
+          dependency.requirements.first&.metadata_string("kind")
         end
 
         sig { params(version: Object).returns(T::Boolean) }
@@ -171,8 +171,8 @@ module Dependabot
         sig { returns(T::Boolean) }
         def package_resolved_requirement?
           dependency.requirements.any? do |req|
-            file = req[:file]
-            file.is_a?(String) && XcodeFileHelpers.xcode_resolved_path?(file)
+            file = req.file
+            file && XcodeFileHelpers.xcode_resolved_path?(file)
           end
         end
 

data/lib/dependabot/swift/update_checker.rb

@@ -171,7 +171,10 @@ module Dependabot
         Version.new(lowest_resolvable_security_fix_version)
       end
 
-      sig { params(requirements: T::Array[T::Hash[Symbol, Object]]).returns(VersionResolver) }
+      sig do
+        params(requirements: T::Array[Dependabot::DependencyRequirement])
+          .returns(VersionResolver)
+      end
       def version_resolver_for(requirements)
         VersionResolver.new(
           dependency: dependency,
@@ -187,21 +190,24 @@ module Dependabot
         git_commit_checker.local_tag_for_latest_version(update_cooldown)
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def unlocked_requirements
         NativeRequirement.map_requirements(old_requirements) do |_old_requirement|
           "\"#{dependency.version}\"...\"#{latest_version}\""
         end
       end
 
-      sig { returns(T::Array[T::Hash[Symbol, Object]]) }
+      sig { returns(T::Array[Dependabot::DependencyRequirement]) }
       def force_lowest_security_fix_requirements
         NativeRequirement.map_requirements(old_requirements) do |_old_requirement|
           "\"#{lowest_security_fix_version}\"...\"#{lowest_security_fix_version}\""
         end
       end
 
-      sig { params(new_requirements: T::Array[T::Hash[Symbol, Object]]).returns(Dependabot::DependencyFile) }
+      sig do
+        params(new_requirements: T::Array[Dependabot::DependencyRequirement])
+          .returns(Dependabot::DependencyFile)
+      end
       def prepare_manifest_for(new_requirements)
         manifest_file = T.must(manifest)
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-swift
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -272,7 +272,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib