dependabot-nuget 0.118.1 → 0.118.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5f7f10f473bffa09c4a33d8aac12e6f92e9508cd7db69de390c61ac86d1c432
-  data.tar.gz: 6f60b22cfe18bd7be4c7e003dd566c53fe7a1730eb6656db885f85751d5eb311
+  metadata.gz: ed611fc9c6f6e2289f27d7153772b671119b0502a67b42b79c0201c40a793e39
+  data.tar.gz: 506beab2fac067b461d8e7657bfd563f1bbf5b81ef5a70d8fd8540e8307c47af
 SHA512:
-  metadata.gz: 8a7d0013b1b7f4d6d2833d71ed61d28b569412ca7206de972df540846ae91d39c2176a3b81fb5198ab9a6c57149554299d687c08e029db2aadeb561ef1b3b993
-  data.tar.gz: 04ca3f6ea2bf0eb1e94d59a23b6f473e5797f33141e5f7f444612e9199a3c2ac90cdec8a8d4ffc5bb813900c9a22faa0dadc4750eac798c1fa4c7cf8416cf5b2
+  metadata.gz: c1eeb65cb9895382c4b1fbf608ed5ccffcd7360dcdc8f0d96f148dd038a15a9fc26ddc311105285e1d1c2049afe41f11dea4efd72e58dc20b0bf1da421efa98e
+  data.tar.gz: e92a7061640ed8142d38821bcd73181b9d24b238886b41d27fb7d0d749c2976fde146874c9b28e6578c36516c4fa44d0eb345e61866b670277788504bd3c3389

data/lib/dependabot/nuget/file_fetcher.rb

@@ -117,6 +117,8 @@ module Dependabot
           possible_paths += [
             "Directory.Build.props",
             "Directory.build.props",
+            "Directory.Packages.props",
+            "Directory.packages.props",
             "Directory.Build.targets",
             "Directory.build.targets"
           ]
@@ -137,6 +139,8 @@ module Dependabot
         [
           Pathname.new(base + "/Directory.Build.props").cleanpath.to_path,
           Pathname.new(base + "/Directory.build.props").cleanpath.to_path,
+          Pathname.new(base + "/Directory.Packages.props").cleanpath.to_path,
+          Pathname.new(base + "/Directory.packages.props").cleanpath.to_path,
           Pathname.new(base + "/Directory.Build.targets").cleanpath.to_path,
           Pathname.new(base + "/Directory.build.targets").cleanpath.to_path
         ]

data/lib/dependabot/nuget/file_parser/project_file_parser.rb

@@ -16,6 +16,7 @@ module Dependabot
 
         DEPENDENCY_SELECTOR = "ItemGroup > PackageReference, "\
                               "ItemGroup > GlobalPackageReference, "\
+                              "ItemGroup > PackageVersion, "\
                               "ItemGroup > Dependency, "\
                               "ItemGroup > DevelopmentDependency"
 

data/lib/dependabot/nuget/file_parser/property_value_finder.rb

@@ -37,6 +37,12 @@ module Dependabot
               callsite_file: callsite_file
             )
 
+          node_details ||=
+            find_property_in_directory_build_packages(
+              property: property_name,
+              callsite_file: callsite_file
+            )
+
           node_details ||=
             find_property_in_packages_props(property: property_name)
 
@@ -112,6 +118,13 @@ module Dependabot
           deep_find_prop_node(property: property, file: file)
         end
 
+        def find_property_in_directory_build_packages(property:, callsite_file:)
+          file = build_packages_file_for_project(callsite_file)
+          return unless file
+
+          deep_find_prop_node(property: property, file: file)
+        end
+
         def find_property_in_packages_props(property:)
           file = packages_props_file
           return unless file
@@ -152,6 +165,22 @@ module Dependabot
           dependency_files.find { |f| f.name == path }
         end
 
+        def build_packages_file_for_project(project_file)
+          dir = File.dirname(project_file.name)
+
+          # Nuget walks up the directory structure looking for a
+          # Directory.Packages.props file
+          possible_paths = dir.split("/").map.with_index do |_, i|
+            base = dir.split("/").first(i + 1).join("/")
+            Pathname.new(base + "/Directory.Packages.props").cleanpath.to_path
+          end.reverse + ["Directory.Packages.props"]
+
+          path = possible_paths.uniq.
+                 find { |p| dependency_files.find { |f| f.name == p } }
+
+          dependency_files.find { |f| f.name == path }
+        end
+
         def packages_props_file
           dependency_files.find { |f| f.name.casecmp("Packages.props").zero? }
         end

data/lib/dependabot/nuget/file_updater/project_file_declaration_finder.rb

@@ -13,6 +13,8 @@ module Dependabot
             <PackageReference [^>]*?[^/]>.*?</PackageReference>|
             <GlobalPackageReference [^>]*?/>|
             <GlobalPackageReference [^>]*?[^/]>.*?</GlobalPackageReference>|
+            <PackageVersion [^>]*?/>|
+            <PackageVersion [^>]*?[^/]>.*?</PackageVersion>|
             <Dependency [^>]*?/>|
             <Dependency [^>]*?[^/]>.*?</Dependency>|
             <DevelopmentDependency [^>]*?/>|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.118.1
+  version: 0.118.6
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-04 00:00:00.000000000 Z
+date: 2020-06-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.1
+        version: 0.118.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.118.1
+        version: 0.118.6
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -114,28 +114,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: 0.85.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.83.0
+        version: 0.85.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: 6.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: 6.0.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement