dependabot-nuget 0.117.11 → 0.118.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '086c2197a6a562a6de05fa612462f340728ff5887bd9472a771394d56db84432'
-  data.tar.gz: 440a0ff6854def8b4af4b50f5735dcac5545e6da9f2f9e0c121b7e411cc77d5e
+  metadata.gz: 593ccd6084195d8ae51a71d0be6539d28e1abf7caff66e7bb549fa1c98b584a3
+  data.tar.gz: 132c26e7ce8b1b2734ae673cd31d4aaf7436ad7875667ae6e753aa9f3d8fcb6f
 SHA512:
-  metadata.gz: 116976d7995552011f5b9eaee9ce37e92ea1a7c17143998c70d8095bbe762407bd909ea8564f21a229a8ec420a375fa9e5dda4097375ece0e235711175b2cda8
-  data.tar.gz: 32af20a089e8013688f1b468e9e62259559241ea95c0e7caaa5869fc196a31844cd7195d4562abab9b1af2e0003cfdd1d4d87df7a0cf951de16a7a32727733f7
+  metadata.gz: c7febd892219555c08b32312de5cc29d4f76091c73ad1e5aaca81456e0d588f595dff61aceb92f9d651d2c1441c89e4c0938e970c8fe835f63622f41ab1d715a
+  data.tar.gz: 9195a3f8d85dadb32cfd38a36943f7da3d9413092cc8ed6a1b1837e5bc7da0dd1daf259d590712d94dfb718e7d7dee363fd9315c324fe2a578019f48fa4d2fa8

data/lib/dependabot/nuget/file_fetcher.rb

@@ -117,6 +117,8 @@ module Dependabot
           possible_paths += [
             "Directory.Build.props",
             "Directory.build.props",
+            "Directory.Packages.props",
+            "Directory.packages.props",
             "Directory.Build.targets",
             "Directory.build.targets"
           ]
@@ -137,6 +139,8 @@ module Dependabot
         [
           Pathname.new(base + "/Directory.Build.props").cleanpath.to_path,
           Pathname.new(base + "/Directory.build.props").cleanpath.to_path,
+          Pathname.new(base + "/Directory.Packages.props").cleanpath.to_path,
+          Pathname.new(base + "/Directory.packages.props").cleanpath.to_path,
           Pathname.new(base + "/Directory.Build.targets").cleanpath.to_path,
           Pathname.new(base + "/Directory.build.targets").cleanpath.to_path
         ]

data/lib/dependabot/nuget/file_parser/project_file_parser.rb

@@ -16,6 +16,7 @@ module Dependabot
 
         DEPENDENCY_SELECTOR = "ItemGroup > PackageReference, "\
                               "ItemGroup > GlobalPackageReference, "\
+                              "ItemGroup > PackageVersion, "\
                               "ItemGroup > Dependency, "\
                               "ItemGroup > DevelopmentDependency"
 

data/lib/dependabot/nuget/file_parser/property_value_finder.rb

@@ -37,6 +37,12 @@ module Dependabot
               callsite_file: callsite_file
             )
 
+          node_details ||=
+            find_property_in_directory_build_packages(
+              property: property_name,
+              callsite_file: callsite_file
+            )
+
           node_details ||=
             find_property_in_packages_props(property: property_name)
 
@@ -112,6 +118,13 @@ module Dependabot
           deep_find_prop_node(property: property, file: file)
         end
 
+        def find_property_in_directory_build_packages(property:, callsite_file:)
+          file = build_packages_file_for_project(callsite_file)
+          return unless file
+
+          deep_find_prop_node(property: property, file: file)
+        end
+
         def find_property_in_packages_props(property:)
           file = packages_props_file
           return unless file
@@ -152,6 +165,22 @@ module Dependabot
           dependency_files.find { |f| f.name == path }
         end
 
+        def build_packages_file_for_project(project_file)
+          dir = File.dirname(project_file.name)
+
+          # Nuget walks up the directory structure looking for a
+          # Directory.Packages.props file
+          possible_paths = dir.split("/").map.with_index do |_, i|
+            base = dir.split("/").first(i + 1).join("/")
+            Pathname.new(base + "/Directory.Packages.props").cleanpath.to_path
+          end.reverse + ["Directory.Packages.props"]
+
+          path = possible_paths.uniq.
+                 find { |p| dependency_files.find { |f| f.name == p } }
+
+          dependency_files.find { |f| f.name == path }
+        end
+
         def packages_props_file
           dependency_files.find { |f| f.name.casecmp("Packages.props").zero? }
         end

data/lib/dependabot/nuget/file_updater/project_file_declaration_finder.rb

@@ -13,6 +13,8 @@ module Dependabot
             <PackageReference [^>]*?[^/]>.*?</PackageReference>|
             <GlobalPackageReference [^>]*?/>|
             <GlobalPackageReference [^>]*?[^/]>.*?</GlobalPackageReference>|
+            <PackageVersion [^>]*?/>|
+            <PackageVersion [^>]*?[^/]>.*?</PackageVersion>|
             <Dependency [^>]*?/>|
             <Dependency [^>]*?[^/]>.*?</Dependency>|
             <DevelopmentDependency [^>]*?/>|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.117.11
+  version: 0.118.4
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-28 00:00:00.000000000 Z
+date: 2020-06-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.11
+        version: 0.118.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.11
+        version: 0.118.4
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -114,28 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: 0.85.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: 0.85.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: 6.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: 6.0.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement