docs: add Swift/SPM ecosystem to CHANGELOG and README

Author: bug-ops

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- **Swift/SPM ecosystem support** — New `deps-swift` crate with full Package.swift and Package.resolved support
+  - Regex-based Package.swift parser covering all 9 `.package()` call signatures (from, upToNextMajor, upToNextMinor, exact, half-open range, closed range, branch, revision, path)
+  - Comment stripping with byte-offset preservation for accurate LSP positions
+  - Multiline `.package()` call support
+  - GitHub API registry — version resolution via repository tags, package search via GitHub Search API
+  - Package identity as `owner/repo` extracted from Git URLs
+  - Version requirements normalized to semver ranges at parse time
+  - Package.resolved lockfile support for all 3 schema versions (v1, v2, v3)
+  - Owner/repo validation to prevent URL injection in GitHub API calls
+  - Feature-gated registration in deps-lsp (`swift`)
+
 ## [0.8.0] - 2026-02-23
 
 ### Added

README.md

@@ -8,14 +8,14 @@
 [![MSRV](https://img.shields.io/badge/MSRV-1.89-blue)](https://blog.rust-lang.org/)
 [![unsafe forbidden](https://img.shields.io/badge/unsafe-forbidden-success.svg)](https://github.com/rust-secure-code/safety-dance/)
 
-A universal Language Server Protocol (LSP) server for dependency management across Cargo, npm, PyPI, Go, Bundler, Dart, Maven, and Gradle ecosystems.
+A universal Language Server Protocol (LSP) server for dependency management across Cargo, npm, PyPI, Go, Bundler, Dart, Maven, Gradle, and Swift ecosystems.
 
 ## Features
 
 - **Intelligent autocomplete** — Package names, versions, and feature flags
 - **Version hints** — Inlay hints showing latest available versions
 - **Loading indicators** — Visual feedback during registry fetches with LSP progress support
-- **Lock file support** — Reads resolved versions from Cargo.lock, package-lock.json, poetry.lock, uv.lock, go.sum, Gemfile.lock, pubspec.lock
+- **Lock file support** — Reads resolved versions from Cargo.lock, package-lock.json, poetry.lock, uv.lock, go.sum, Gemfile.lock, pubspec.lock, Package.resolved
 - **Diagnostics** — Warnings for outdated, unknown, or yanked dependencies
 - **Hover information** — Package descriptions with resolved version from lock file
 - **Code actions** — Quick fixes to update dependencies
@@ -49,9 +49,17 @@ deps-lsp is optimized for responsiveness:
 | Dart | Pub | `pubspec.yaml` | ✅ Supported |
 | Java | Maven | `pom.xml` | ✅ Supported |
 | Java | Gradle | `libs.versions.toml`, `build.gradle.kts`, `build.gradle`, `settings.gradle` | ✅ Supported |
+| Swift | SPM | `Package.swift` | ✅ Supported |
 
 > [!NOTE]
-> PyPI support includes PEP 621, PEP 735 (dependency-groups), and Poetry formats. Go support includes require, replace, and exclude directives with pseudo-version handling. Bundler support includes git, path, and GitHub sources plus pessimistic version requirements (`~>`). Dart support includes hosted, git, path, and SDK dependency sources with caret version semantics. Maven support covers `dependencies`, `dependencyManagement`, and `build/plugins` sections with Maven qualifier-aware version comparison. Gradle support covers Version Catalogs (`libs.versions.toml`), Kotlin DSL (`build.gradle.kts`), Groovy DSL (`build.gradle`), and `settings.gradle` plugin declarations with version.ref resolution. Packages are resolved from Maven Central, Google Maven (Android), and Gradle Plugin Portal (fallback).
+> **Ecosystem details:**
+> - **PyPI** — PEP 621, PEP 735 (dependency-groups), Poetry formats
+> - **Go** — `require`, `replace`, `exclude` directives, pseudo-version handling
+> - **Bundler** — git/path/GitHub sources, pessimistic operator (`~>`)
+> - **Dart** — hosted, git, path, SDK sources, caret version semantics
+> - **Maven** — `dependencies`, `dependencyManagement`, `build/plugins`, qualifier-aware version comparison
+> - **Gradle** — Version Catalogs, Kotlin/Groovy DSL, `settings.gradle` plugins; resolves from Maven Central, Google Maven, Gradle Plugin Portal
+> - **Swift** — all `.package()` forms (from, upToNextMajor/Minor, exact, range, branch, revision, path); versions via GitHub API tags
 
 ## Installation
 
@@ -117,6 +125,7 @@ cargo install deps-lsp --no-default-features --features "pypi"
 | `dart` | Dart | pubspec.yaml | ✅ |
 | `maven` | Java | pom.xml | ✅ |
 | `gradle` | Java | libs.versions.toml, build.gradle.kts, build.gradle | ✅ |
+| `swift` | Swift | Package.swift | ✅ |
 
 ## Usage
 
@@ -154,7 +163,7 @@ Enable inlay hints in Zed settings:
 ```lua
 require('lspconfig').deps_lsp.setup({
   cmd = { "deps-lsp", "--stdio" },
-  filetypes = { "toml", "json", "gomod", "ruby", "yaml", "xml" },
+  filetypes = { "toml", "json", "gomod", "ruby", "yaml", "xml", "swift" },
 })
 
 -- Enable inlay hints (Neovim 0.10+)
@@ -297,6 +306,7 @@ deps-lsp/
 │   ├── deps-dart/      # pubspec.yaml parser + pub.dev registry
 │   ├── deps-maven/     # pom.xml parser + Maven Central registry
 │   ├── deps-gradle/    # Gradle parser (Version Catalog, Kotlin/Groovy DSL)
+│   ├── deps-swift/     # Package.swift parser + GitHub API registry
 │   ├── deps-lsp/       # Main LSP server
 │   └── deps-zed/       # Zed extension (WASM)
 ├── .config/            # nextest configuration