dependabot-nuget 0.241.0 → 0.242.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4785ffa6c4f7a334d8c7d57932d82420af791410a4ebfe9a38f2ee73da5d271
-  data.tar.gz: 0cfcaa2b152867cccce8907eb64d98a72d217626467ee25bfb5ea2bb1839e0c0
+  metadata.gz: 11b0607da6a75d27dbe0c012d5b3917a226fd3da340cbcc59bf70dc1ab49dea3
+  data.tar.gz: f757ea68e946791be5d44df566a91dff248f98c60be84253a25d399c24b881bd
 SHA512:
-  metadata.gz: f3dd5df35c8cd6e2991e61c6327f9144c6c600578c477309b7a0624a0a768d356fada0d2e33e3a9d5695cb8c8271e75e639f0b5246db9795c97425d23e1ae99f
-  data.tar.gz: b8424ae0c6d11cba9066601d4db01e16e2382d633814b091cd5ae14f38da505d6504bed7c2285eb634bf173a1353245bbefeaedeee26b8cbebf513c1188955cb
+  metadata.gz: cce478626cb19d1d3daec2b23b2448445ddbf02fde1ffa80cd1372600852cb9e7c5fc2026303f9dfb8de3938870db16a2b531c04b160ede96c7c473bb673b3e3
+  data.tar.gz: 9f084e5dfc866baa1b38cb01d2a55a9c6738b1e06703961fb33676353e4fda8095c36a951bb0a3515c503fe351582089b93d0faeac709e3e3e4f3706b158ec09

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Dependency.cs

@@ -1,3 +1,3 @@
 namespace NuGetUpdater.Core;
 
-public sealed record Dependency(string Name, string? Version, DependencyType Type, bool IsDevDependency = false, bool IsOverride = false);
+public sealed record Dependency(string Name, string? Version, DependencyType Type, bool IsDevDependency = false, bool IsOverride = false, bool IsUpdate = false);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/DotNetToolsJsonBuildFile.cs

@@ -1,4 +1,3 @@
-using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
@@ -8,11 +7,11 @@ namespace NuGetUpdater.Core;
 
 internal sealed class DotNetToolsJsonBuildFile : JsonBuildFile
 {
-    public static DotNetToolsJsonBuildFile Open(string repoRootPath, string path)
-        => new(repoRootPath, path, File.ReadAllText(path));
+    public static DotNetToolsJsonBuildFile Open(string repoRootPath, string path, Logger logger)
+        => new(repoRootPath, path, File.ReadAllText(path), logger);
 
-    public DotNetToolsJsonBuildFile(string repoRootPath, string path, string contents)
-        : base(repoRootPath, path, contents)
+    public DotNetToolsJsonBuildFile(string repoRootPath, string path, string contents, Logger logger)
+        : base(repoRootPath, path, contents, logger)
     {
     }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/GlobalJsonBuildFile.cs

@@ -7,18 +7,29 @@ namespace NuGetUpdater.Core;
 
 internal sealed class GlobalJsonBuildFile : JsonBuildFile
 {
-    public static GlobalJsonBuildFile Open(string repoRootPath, string path)
-        => new(repoRootPath, path, File.ReadAllText(path));
+    public static GlobalJsonBuildFile Open(string repoRootPath, string path, Logger logger)
+        => new(repoRootPath, path, File.ReadAllText(path), logger);
 
-    public GlobalJsonBuildFile(string repoRootPath, string path, string contents)
-        : base(repoRootPath, path, contents)
+    public GlobalJsonBuildFile(string repoRootPath, string path, string contents, Logger logger)
+        : base(repoRootPath, path, contents, logger)
     {
     }
 
-    public JsonObject? Sdk => Node.Value?["sdk"]?.AsObject();
+    public JsonObject? Sdk
+    {
+        get
+        {
+            return Node.Value is JsonObject root ? root["sdk"]?.AsObject() : null;
+        }
+    }
 
-    public JsonObject? MSBuildSdks =>
-        Node.Value?["msbuild-sdks"]?.AsObject();
+    public JsonObject? MSBuildSdks
+    {
+        get
+        {
+            return Node.Value is JsonObject root ? root["msbuild-sdks"]?.AsObject() : null;
+        }
+    }
 
     public IEnumerable<Dependency> GetDependencies() => MSBuildSdks?.AsObject().Select(
         t => new Dependency(t.Key, t.Value?.GetValue<string>() ?? string.Empty, DependencyType.MSBuildSdk)) ?? Enumerable.Empty<Dependency>();

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/JsonBuildFile.cs

@@ -8,11 +8,13 @@ namespace NuGetUpdater.Core;
 internal abstract class JsonBuildFile : BuildFile<string>
 {
     protected Lazy<JsonNode?> Node;
+    private readonly Logger logger;
 
-    public JsonBuildFile(string repoRootPath, string path, string contents)
+    public JsonBuildFile(string repoRootPath, string path, string contents, Logger logger)
         : base(repoRootPath, path, contents)
     {
         Node = new Lazy<JsonNode?>(() => null);
+        this.logger = logger;
         ResetNode();
     }
 
@@ -27,6 +29,19 @@ internal abstract class JsonBuildFile : BuildFile<string>
 
     private void ResetNode()
     {
-        Node = new Lazy<JsonNode?>(() => JsonHelper.ParseNode(Contents));
+        Node = new Lazy<JsonNode?>(() =>
+        {
+            try
+            {
+                return JsonHelper.ParseNode(Contents);
+            }
+            catch (System.Text.Json.JsonException ex)
+            {
+                // We can't police that people have legal JSON files.
+                // If they don't, we just return null.
+                logger.Log($"Failed to parse JSON file: {RepoRelativePath}, got {ex}");
+                return null;
+            }
+        });
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/DotNetToolsJsonUpdater.cs

@@ -10,7 +10,7 @@ internal static partial class DotNetToolsJsonUpdater
 {
     public static async Task UpdateDependencyAsync(string repoRootPath, string dependencyName, string previousDependencyVersion, string newDependencyVersion, Logger logger)
     {
-        var buildFiles = LoadBuildFiles(repoRootPath);
+        var buildFiles = LoadBuildFiles(repoRootPath, logger);
         if (buildFiles.Length == 0)
         {
             logger.Log($"  No dotnet-tools.json files found.");
@@ -49,7 +49,7 @@ internal static partial class DotNetToolsJsonUpdater
         }
     }
 
-    private static ImmutableArray<DotNetToolsJsonBuildFile> LoadBuildFiles(string repoRootPath)
+    private static ImmutableArray<DotNetToolsJsonBuildFile> LoadBuildFiles(string repoRootPath, Logger logger)
     {
         var options = new EnumerationOptions()
         {
@@ -60,7 +60,7 @@ internal static partial class DotNetToolsJsonUpdater
             MatchCasing = MatchCasing.CaseInsensitive,
         };
         return Directory.EnumerateFiles(repoRootPath, "dotnet-tools.json", options)
-            .Select(path => DotNetToolsJsonBuildFile.Open(repoRootPath, path))
+            .Select(path => DotNetToolsJsonBuildFile.Open(repoRootPath, path, logger))
             .ToImmutableArray();
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/GlobalJsonUpdater.cs

@@ -15,7 +15,7 @@ internal static partial class GlobalJsonUpdater
             return;
         }
 
-        var globalJsonFile = GlobalJsonBuildFile.Open(repoRootPath, globalJsonPath);
+        var globalJsonFile = GlobalJsonBuildFile.Open(repoRootPath, globalJsonPath, logger);
 
         logger.Log($"  Updating [{globalJsonFile.RepoRelativePath}] file.");
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/SdkPackageUpdater.cs

@@ -34,7 +34,7 @@ internal static partial class SdkPackageUpdater
         foreach (var tfm in tfms)
         {
             var dependencies = await MSBuildHelper.GetAllPackageDependenciesAsync(repoRootPath, projectPath, tfm, topLevelDependencies, logger);
-            foreach (var (packageName, packageVersion, _, _, _) in dependencies)
+            foreach (var (packageName, packageVersion, _, _, _, _) in dependencies)
             {
                 if (packageName.Equals(dependencyName, StringComparison.OrdinalIgnoreCase))
                 {
@@ -76,7 +76,7 @@ internal static partial class SdkPackageUpdater
         var packagesAndVersions = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
         foreach (var (tfm, dependencies) in tfmsAndDependencies)
         {
-            foreach (var (packageName, packageVersion, _, _, _) in dependencies)
+            foreach (var (packageName, packageVersion, _, _, _, _) in dependencies)
             {
                 if (packagesAndVersions.TryGetValue(packageName, out var existingVersion) &&
                     existingVersion != packageVersion)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -136,7 +136,7 @@ internal static partial class MSBuildHelper
 
     public static IEnumerable<Dependency> GetTopLevelPackageDependenyInfos(ImmutableArray<ProjectBuildFile> buildFiles)
     {
-        Dictionary<string, string> packageInfo = new(StringComparer.OrdinalIgnoreCase);
+        Dictionary<string, (string, bool)> packageInfo = new(StringComparer.OrdinalIgnoreCase);
         Dictionary<string, string> packageVersionInfo = new(StringComparer.OrdinalIgnoreCase);
         Dictionary<string, string> propertyInfo = new(StringComparer.OrdinalIgnoreCase);
 
@@ -154,7 +154,22 @@ internal static partial class MSBuildHelper
                 {
                     if (!string.IsNullOrWhiteSpace(attributeValue))
                     {
-                        packageInfo[attributeValue] = versionSpecification;
+                        if (packageInfo.TryGetValue(attributeValue, out var existingInfo))
+                        {
+                            var existingVersion = existingInfo.Item1;
+                            var existingUpdate = existingInfo.Item2;
+                            // Retain the version from the Update reference since the intention
+                            // would be to override the version of the Include reference.
+                            var vSpec = string.IsNullOrEmpty(versionSpecification) || existingUpdate ? existingVersion : versionSpecification;
+
+                            var isUpdate = existingUpdate && string.IsNullOrEmpty(packageItem.Include);
+                            packageInfo[attributeValue] = (vSpec, isUpdate);
+                        }
+                        else
+                        {
+                            var isUpdate = !string.IsNullOrEmpty(packageItem.Update);
+                            packageInfo[attributeValue] = (versionSpecification, isUpdate);
+                        }
                     }
                 }
             }
@@ -180,8 +195,9 @@ internal static partial class MSBuildHelper
             }
         }
 
-        foreach (var (name, version) in packageInfo)
+        foreach (var (name, info) in packageInfo)
         {
+            var (version, isUpdate) = info;
             if (version.Length != 0 || !packageVersionInfo.TryGetValue(name, out var packageVersion))
             {
                 packageVersion = version;
@@ -195,8 +211,8 @@ internal static partial class MSBuildHelper
             // We don't know the version for range requirements or wildcard
             // requirements, so return "" for these.
             yield return packageVersion.Contains(',') || packageVersion.Contains('*')
-                ? new Dependency(name, string.Empty, DependencyType.Unknown)
-                : new Dependency(name, packageVersion, DependencyType.Unknown);
+                ? new Dependency(name, string.Empty, DependencyType.Unknown, IsUpdate: isUpdate)
+                : new Dependency(name, packageVersion, DependencyType.Unknown, IsUpdate: isUpdate);
         }
     }
 
@@ -284,7 +300,8 @@ internal static partial class MSBuildHelper
             Environment.NewLine,
             packages
                 .Where(p => !string.IsNullOrWhiteSpace(p.Version)) // empty `Version` attributes will cause the temporary project to not build
-                .Select(static p => $"<PackageReference Include=\"{p.Name}\" Version=\"[{p.Version}]\" />"));
+                // If all PackageReferences for a package are update-only mark it as such, otherwise it can cause package incoherence errors which do not exist in the repo.
+                .Select(static p => $"<PackageReference {(p.IsUpdate ? "Update" : "Include")}=\"{p.Name}\" Version=\"[{p.Version}]\" />"));
 
         var projectContents = $"""
                 <Project Sdk="Microsoft.NET.Sdk">

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/ProcessExtensions.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Diagnostics;
 using System.Text;
+using System.Threading;
 using System.Threading.Tasks;
 
 namespace NuGetUpdater.Core;
@@ -11,6 +12,7 @@ public static class ProcessEx
     {
         var tcs = new TaskCompletionSource<(int, string, string)>();
 
+        var redirectInitiated = new ManualResetEventSlim();
         var process = new Process
         {
             StartInfo =
@@ -37,8 +39,21 @@ public static class ProcessEx
 
         process.Exited += (sender, args) =>
         {
-            tcs.TrySetResult((process.ExitCode, stdout.ToString(), stderr.ToString()));
-            process.Dispose();
+            // It is necessary to wait until we have invoked 'BeginXReadLine' for our redirected IO. Then,
+            // we must call WaitForExit to make sure we've received all OutputDataReceived/ErrorDataReceived calls
+            // or else we'll be returning a list we're still modifying. For paranoia, we'll start a task here rather
+            // than enter right back into the Process type and start a wait which isn't guaranteed to be safe.
+            Task.Run(() =>
+            {
+               redirectInitiated.Wait();
+               redirectInitiated.Dispose();
+               redirectInitiated = null;
+
+               process.WaitForExit();
+
+               tcs.TrySetResult((process.ExitCode, stdout.ToString(), stderr.ToString()));
+               process.Dispose();
+            });
         };
 
 #if DEBUG
@@ -61,6 +76,8 @@ public static class ProcessEx
         process.BeginOutputReadLine();
         process.BeginErrorReadLine();
 
+        redirectInitiated.Set();
+
         return tcs.Task;
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Files/DotNetToolsJsonBuildFileTests.cs

@@ -32,7 +32,8 @@ public class DotnetToolsJsonBuildFileTests
     private static DotNetToolsJsonBuildFile GetBuildFile() => new(
         repoRootPath: "/",
         path: "/.config/dotnet-tools.json",
-        contents: DotnetToolsJson);
+        contents: DotnetToolsJson,
+        logger: new Logger(verbose: true));
 
     [Fact]
     public void GetDependencies_ReturnsDependencies()

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Files/GlobalJsonBuildFileTests.cs

@@ -31,7 +31,24 @@ public class GlobalJsonBuildFileTests
     private static GlobalJsonBuildFile GetBuildFile(string contents) => new(
         repoRootPath: "/",
         path: "/global.json",
-        contents: contents);
+        contents: contents,
+        logger: new Logger(verbose: true));
+
+    [Fact]
+    public void GlobalJson_Malformed_DoesNotThrow()
+    {
+        var buildFile = GetBuildFile("""[{ "Random": "stuff"}]""");
+
+        Assert.Null(buildFile.MSBuildSdks);
+    }
+
+    [Fact]
+    public void GlobalJson_NotJson_DoesNotThrow()
+    {
+        var buildFile = GetBuildFile("not json");
+
+        Assert.Null(buildFile.MSBuildSdks);
+    }
 
     [Fact]
     public void GlobalJson_GetDependencies_ReturnsDependencies()

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs

@@ -171,6 +171,144 @@ public class MSBuildHelperTests
         Assert.Equal(expectedDependencies, actualDependencies);
     }
 
+    [Fact]
+    public async Task AllPackageDependencies_DoNotTruncateLongDependencyLists()
+    {
+        using var temp = new TemporaryDirectory();
+        var expectedDependencies = new Dependency[]
+        {
+            new("Castle.Core", "4.4.1", DependencyType.Unknown),
+            new("Microsoft.ApplicationInsights", "2.10.0", DependencyType.Unknown),
+            new("Microsoft.ApplicationInsights.Agent.Intercept", "2.4.0", DependencyType.Unknown),
+            new("Microsoft.ApplicationInsights.DependencyCollector", "2.10.0", DependencyType.Unknown),
+            new("Microsoft.ApplicationInsights.PerfCounterCollector", "2.10.0", DependencyType.Unknown),
+            new("Microsoft.ApplicationInsights.WindowsServer", "2.10.0", DependencyType.Unknown),
+            new("Microsoft.ApplicationInsights.WindowsServer.TelemetryChannel", "2.10.0", DependencyType.Unknown),
+            new("Microsoft.AspNet.TelemetryCorrelation", "1.0.5", DependencyType.Unknown),
+            new("Microsoft.Bcl.AsyncInterfaces", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Caching.Abstractions", "1.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Caching.Memory", "1.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.DependencyInjection", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.DependencyInjection.Abstractions", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.DiagnosticAdapter", "1.1.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Http", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Logging", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Logging.Abstractions", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Options", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.PlatformAbstractions", "1.1.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Primitives", "7.0.0", DependencyType.Unknown),
+            new("Moq", "4.16.1", DependencyType.Unknown),
+            new("MSTest.TestFramework", "2.1.0", DependencyType.Unknown),
+            new("Newtonsoft.Json", "12.0.1", DependencyType.Unknown),
+            new("System", "4.1.311.2", DependencyType.Unknown),
+            new("System.Buffers", "4.5.1", DependencyType.Unknown),
+            new("System.Collections.Concurrent", "4.3.0", DependencyType.Unknown),
+            new("System.Collections.Immutable", "1.3.0", DependencyType.Unknown),
+            new("System.Collections.NonGeneric", "4.3.0", DependencyType.Unknown),
+            new("System.Collections.Specialized", "4.3.0", DependencyType.Unknown),
+            new("System.ComponentModel", "4.3.0", DependencyType.Unknown),
+            new("System.ComponentModel.Annotations", "5.0.0", DependencyType.Unknown),
+            new("System.ComponentModel.Primitives", "4.3.0", DependencyType.Unknown),
+            new("System.ComponentModel.TypeConverter", "4.3.0", DependencyType.Unknown),
+            new("System.Core", "3.5.21022.801", DependencyType.Unknown),
+            new("System.Data.Common", "4.3.0", DependencyType.Unknown),
+            new("System.Diagnostics.DiagnosticSource", "7.0.0", DependencyType.Unknown),
+            new("System.Diagnostics.PerformanceCounter", "4.5.0", DependencyType.Unknown),
+            new("System.Diagnostics.StackTrace", "4.3.0", DependencyType.Unknown),
+            new("System.Dynamic.Runtime", "4.3.0", DependencyType.Unknown),
+            new("System.IO.FileSystem.Primitives", "4.3.0", DependencyType.Unknown),
+            new("System.Linq", "4.3.0", DependencyType.Unknown),
+            new("System.Linq.Expressions", "4.3.0", DependencyType.Unknown),
+            new("System.Memory", "4.5.5", DependencyType.Unknown),
+            new("System.Net.WebHeaderCollection", "4.3.0", DependencyType.Unknown),
+            new("System.Numerics.Vectors", "4.4.0", DependencyType.Unknown),
+            new("System.ObjectModel", "4.3.0", DependencyType.Unknown),
+            new("System.Private.DataContractSerialization", "4.3.0", DependencyType.Unknown),
+            new("System.Reflection.Emit", "4.3.0", DependencyType.Unknown),
+            new("System.Reflection.Emit.ILGeneration", "4.3.0", DependencyType.Unknown),
+            new("System.Reflection.Emit.Lightweight", "4.3.0", DependencyType.Unknown),
+            new("System.Reflection.Metadata", "1.4.1", DependencyType.Unknown),
+            new("System.Reflection.TypeExtensions", "4.3.0", DependencyType.Unknown),
+            new("System.Runtime.CompilerServices.Unsafe", "6.0.0", DependencyType.Unknown),
+            new("System.Runtime.InteropServices.RuntimeInformation", "4.3.0", DependencyType.Unknown),
+            new("System.Runtime.Numerics", "4.3.0", DependencyType.Unknown),
+            new("System.Runtime.Serialization.Json", "4.3.0", DependencyType.Unknown),
+            new("System.Runtime.Serialization.Primitives", "4.3.0", DependencyType.Unknown),
+            new("System.Security.Claims", "4.3.0", DependencyType.Unknown),
+            new("System.Security.Cryptography.OpenSsl", "4.3.0", DependencyType.Unknown),
+            new("System.Security.Cryptography.Primitives", "4.3.0", DependencyType.Unknown),
+            new("System.Security.Principal", "4.3.0", DependencyType.Unknown),
+            new("System.Text.RegularExpressions", "4.3.0", DependencyType.Unknown),
+            new("System.Threading", "4.3.0", DependencyType.Unknown),
+            new("System.Threading.Tasks.Extensions", "4.5.4", DependencyType.Unknown),
+            new("System.Threading.Thread", "4.3.0", DependencyType.Unknown),
+            new("System.Threading.ThreadPool", "4.3.0", DependencyType.Unknown),
+            new("System.Xml.ReaderWriter", "4.3.0", DependencyType.Unknown),
+            new("System.Xml.XDocument", "4.3.0", DependencyType.Unknown),
+            new("System.Xml.XmlDocument", "4.3.0", DependencyType.Unknown),
+            new("System.Xml.XmlSerializer", "4.3.0", DependencyType.Unknown),
+            new("Microsoft.ApplicationInsights.Web", "2.10.0", DependencyType.Unknown),
+            new("MSTest.TestAdapter", "2.1.0", DependencyType.Unknown),
+            new("NETStandard.Library", "2.0.3", DependencyType.Unknown),
+        };
+        var packages = new[] {
+            new Dependency("System", "4.1.311.2", DependencyType.Unknown),
+            new Dependency("System.Core", "3.5.21022.801", DependencyType.Unknown),
+            new Dependency("Moq", "4.16.1", DependencyType.Unknown),
+            new Dependency("Castle.Core", "4.4.1", DependencyType.Unknown),
+            new Dependency("MSTest.TestAdapter", "2.1.0", DependencyType.Unknown),
+            new Dependency("MSTest.TestFramework", "2.1.0", DependencyType.Unknown),
+            new Dependency("Microsoft.ApplicationInsights", "2.10.0", DependencyType.Unknown),
+            new Dependency("Microsoft.ApplicationInsights.Agent.Intercept", "2.4.0", DependencyType.Unknown),
+            new Dependency("Microsoft.ApplicationInsights.DependencyCollector", "2.10.0", DependencyType.Unknown),
+            new Dependency("Microsoft.ApplicationInsights.PerfCounterCollector", "2.10.0", DependencyType.Unknown),
+            new Dependency("Microsoft.ApplicationInsights.Web", "2.10.0", DependencyType.Unknown),
+            new Dependency("Microsoft.ApplicationInsights.WindowsServer.TelemetryChannel", "2.10.0", DependencyType.Unknown),
+            new Dependency("Microsoft.ApplicationInsights.WindowsServer", "2.10.0", DependencyType.Unknown),
+            new Dependency("Microsoft.Extensions.Http", "7.0.0", DependencyType.Unknown),
+            new Dependency("Newtonsoft.Json", "12.0.1", DependencyType.Unknown)
+        };
+        var actualDependencies = await MSBuildHelper.GetAllPackageDependenciesAsync(temp.DirectoryPath, temp.DirectoryPath, "netstandard2.0", packages);
+        for(int i = 0; i < actualDependencies.Length; i++)
+        {
+            var ad = actualDependencies[i];
+            var ed = expectedDependencies[i];
+            Assert.Equal(ed, ad);
+        }
+        Assert.Equal(expectedDependencies, actualDependencies);
+    }
+
+    [Fact]
+    public async Task AllPackageDependencies_DoNotIncludeUpdateOnlyPackages()
+    {
+        using var temp = new TemporaryDirectory();
+        var expectedDependencies = new Dependency[]
+        {
+            new("Microsoft.Bcl.AsyncInterfaces", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.DependencyInjection", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.DependencyInjection.Abstractions", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Http", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Logging", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Logging.Abstractions", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Options", "7.0.0", DependencyType.Unknown),
+            new("Microsoft.Extensions.Primitives", "7.0.0", DependencyType.Unknown),
+            new("System.Buffers", "4.5.1", DependencyType.Unknown),
+            new("System.ComponentModel.Annotations", "5.0.0", DependencyType.Unknown),
+            new("System.Diagnostics.DiagnosticSource", "7.0.0", DependencyType.Unknown),
+            new("System.Memory", "4.5.5", DependencyType.Unknown),
+            new("System.Numerics.Vectors", "4.4.0", DependencyType.Unknown),
+            new("System.Runtime.CompilerServices.Unsafe", "6.0.0", DependencyType.Unknown),
+            new("System.Threading.Tasks.Extensions", "4.5.4", DependencyType.Unknown),
+            new("NETStandard.Library", "2.0.3", DependencyType.Unknown),
+        };
+        var packages = new[] {
+            new Dependency("Microsoft.Extensions.Http", "7.0.0", DependencyType.Unknown),
+            new Dependency("Newtonsoft.Json", "12.0.1", DependencyType.Unknown, IsUpdate: true)
+        };
+        var actualDependencies = await MSBuildHelper.GetAllPackageDependenciesAsync(temp.DirectoryPath, temp.DirectoryPath, "netstandard2.0", packages);
+        Assert.Equal(expectedDependencies, actualDependencies);
+    }
+
     [Fact]
     public async Task AllPackageDependenciesCanBeFoundWithNuGetConfig()
     {
@@ -349,6 +487,72 @@ public class MSBuildHelperTests
                 new("Newtonsoft.Json", "12.0.1", DependencyType.Unknown)
             }
         };
+
+        // version is set in one file, used in another
+        yield return new object[]
+        {
+            // build file contents
+            new[]
+            {
+                ("Packages.props", """
+                    <Project>
+                      <ItemGroup>
+                        <PackageReference Update="Azure.Identity" Version="1.6.0" />
+                        <PackageReference Update="Microsoft.Data.SqlClient" Version="5.1.4" />
+                      </ItemGroup>
+                    </Project>
+                """),
+                ("project.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>netstandard2.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Azure.Identity" Version="1.6.1" />
+                      </ItemGroup>
+                    </Project>
+                    """)
+            },
+            // expected dependencies
+            new Dependency[]
+            {
+                new("Azure.Identity", "1.6.0", DependencyType.Unknown),
+                new("Microsoft.Data.SqlClient", "5.1.4", DependencyType.Unknown, IsUpdate: true)
+            }
+        };
+
+        // version is set in one file, used in another
+        yield return new object[]
+        {
+            // build file contents
+            new[]
+            {
+                ("project.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>netstandard2.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Azure.Identity" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("Packages.props", """
+                    <Project>
+                      <ItemGroup>
+                        <PackageReference Update="Azure.Identity" Version="1.6.0" />
+                        <PackageReference Update="Microsoft.Data.SqlClient" Version="5.1.4" />
+                      </ItemGroup>
+                    </Project>
+                """)
+            },
+            // expected dependencies
+            new Dependency[]
+            {
+                new("Azure.Identity", "1.6.0", DependencyType.Unknown),
+                new("Microsoft.Data.SqlClient", "5.1.4", DependencyType.Unknown, IsUpdate: true)
+            }
+        };
     }
 
     public static IEnumerable<object[]> SolutionProjectPathTestData()

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.241.0
+  version: 0.242.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-01-18 00:00:00.000000000 Z
+date: 2024-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.241.0
+        version: 0.242.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.241.0
+        version: 0.242.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -369,7 +369,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.241.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.242.0
 post_install_message: 
 rdoc_options: []
 require_paths: