dependabot-nuget 0.245.0 → 0.247.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e67c27ae4f1d9736ba0db82edf309551b56c5337213f72a71d5dc7502e2a91d
-  data.tar.gz: f04858bb986a722dbe26aae525f26885dbd7cc0dc514ee099ab5fed628dfbc43
+  metadata.gz: 9e8dda5e47b38dec152ba8797986aaaca62fde7dbed194960864b779932d6ff7
+  data.tar.gz: 4f1cb76b3dafc332d90ddf7acec0b39c6295d2d9749741e3229af6ad7d7e363d
 SHA512:
-  metadata.gz: 9fc5b619a387d372e8b91007cb3a1983e93b891874e87e475286d177e3075a911c98cda226746f7e8bb792ba83da409ba9abaa29402857d3b01e82850bffbbc9
-  data.tar.gz: '0919b3eb28f2d1c1aa5e3d137eb0ef4d443458f92aaddfca0628353d9b49d2ad6b2ccc6698102f55ada4c04517017c143d5115c1ff0d6ba701c422b6547923f2'
+  metadata.gz: c350131e183da643b7caf57a76acc2cb954e9d7f0a4532b340db90a064f0e1b7d735a531d2bea8efea6ee483060b3dbb8efb4a8e1567d2c9d30d88bc907848f2
+  data.tar.gz: 9f2a6505e1eca5a2fbe8369e8e21ce0b5eabc4c658bec9d628b5250c16f78f40a7c8b19bc0778b2b7fe6e0c3b215a71b2282407544eb0f6808bdfde3da35d8e0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs

@@ -48,7 +48,7 @@ internal static class PackagesConfigUpdater
         var packagesDirectory = PathHelper.JoinPath(projectDirectory, packagesSubDirectory);
         Directory.CreateDirectory(packagesDirectory);
 
-        var args = new List<string>
+        var updateArgs = new List<string>
         {
             "update",
             packagesConfigPath,
@@ -61,17 +61,29 @@ internal static class PackagesConfigUpdater
             "-NonInteractive",
         };
 
+        var restoreArgs = new List<string>
+        {
+            "restore",
+            projectPath,
+            "-PackagesDirectory",
+            packagesDirectory,
+            "-NonInteractive",
+        };
+
         logger.Log("    Finding MSBuild...");
         var msbuildDirectory = MSBuildHelper.MSBuildPath;
         if (msbuildDirectory is not null)
         {
-            args.Add("-MSBuildPath");
-            args.Add(msbuildDirectory); // e.g., /usr/share/dotnet/sdk/7.0.203
+            foreach (var args in new[] { updateArgs, restoreArgs })
+            {
+                args.Add("-MSBuildPath");
+                args.Add(msbuildDirectory); // e.g., /usr/share/dotnet/sdk/7.0.203
+            }
         }
 
         using (new WebApplicationTargetsConditionPatcher(projectPath))
         {
-            RunNuget(args, packagesDirectory, logger);
+            RunNuget(updateArgs, restoreArgs, packagesDirectory, logger);
         }
 
         projectBuildFile = ProjectBuildFile.Open(repoRootPath, projectPath);
@@ -84,7 +96,7 @@ internal static class PackagesConfigUpdater
         await projectBuildFile.SaveAsync();
     }
 
-    private static void RunNuget(List<string> args, string packagesDirectory, Logger logger)
+    private static void RunNuget(List<string> updateArgs, List<string> restoreArgs, string packagesDirectory, Logger logger)
     {
         var outputBuilder = new StringBuilder();
         var writer = new StringWriter(outputBuilder);
@@ -97,15 +109,38 @@ internal static class PackagesConfigUpdater
         var currentDir = Environment.CurrentDirectory;
         try
         {
-            logger.Log($"    Running NuGet.exe with args: {string.Join(" ", args)}");
 
             Environment.CurrentDirectory = packagesDirectory;
-            var result = Program.Main(args.ToArray());
+            var retryingAfterRestore = false;
+
+        doRestore:
+            logger.Log($"    Running NuGet.exe with args: {string.Join(" ", updateArgs)}");
+            outputBuilder.Clear();
+            var result = Program.Main(updateArgs.ToArray());
             var fullOutput = outputBuilder.ToString();
             logger.Log($"    Result: {result}");
             logger.Log($"    Output:\n{fullOutput}");
             if (result != 0)
             {
+                // If the `packages.config` file contains a delisted package, the initial `update` operation will fail
+                // with the message listed below.  The solution is to run `nuget.exe restore ...` and retry.
+                if (!retryingAfterRestore &&
+                    fullOutput.Contains("Existing packages must be restored before performing an install or update."))
+                {
+                    logger.Log($"    Running NuGet.exe with args: {string.Join(" ", restoreArgs)}");
+                    retryingAfterRestore = true;
+                    outputBuilder.Clear();
+                    var exitCodeAgain = Program.Main(restoreArgs.ToArray());
+                    var restoreOutput = outputBuilder.ToString();
+
+                    if (exitCodeAgain != 0)
+                    {
+                        throw new Exception($"Unable to restore.\nOutput:\n${restoreOutput}\n");
+                    }
+
+                    goto doRestore;
+                }
+
                 throw new Exception(fullOutput);
             }
         }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/SdkPackageUpdater.cs

@@ -20,132 +20,124 @@ internal static class SdkPackageUpdater
         string previousDependencyVersion,
         string newDependencyVersion,
         bool isTransitive,
-        Logger logger
-    )
+        Logger logger)
     {
         // SDK-style project, modify the XML directly
         logger.Log("  Running for SDK-style project");
-        var buildFiles = await MSBuildHelper.LoadBuildFiles(repoRootPath, projectPath);
-
-        var newDependencyNuGetVersion = NuGetVersion.Parse(newDependencyVersion);
 
-        // update all dependencies, including transitive
+        var buildFiles = await MSBuildHelper.LoadBuildFiles(repoRootPath, projectPath);
         var tfms = MSBuildHelper.GetTargetFrameworkMonikers(buildFiles);
 
         // Get the set of all top-level dependencies in the current project
         var topLevelDependencies = MSBuildHelper.GetTopLevelPackageDependencyInfos(buildFiles).ToArray();
+        if (!await DoesDependencyRequireUpdateAsync(repoRootPath, projectPath, tfms, topLevelDependencies, dependencyName, newDependencyVersion, logger))
+        {
+            return;
+        }
 
-        var packageFoundInDependencies = false;
-        var packageNeedsUpdating = false;
-
-        foreach (var tfm in tfms)
+        if (isTransitive)
         {
-            var dependencies = await MSBuildHelper.GetAllPackageDependenciesAsync(repoRootPath, projectPath, tfm, topLevelDependencies, logger);
-            foreach (var (packageName, packageVersion, _, _, _, _) in dependencies)
+            await UpdateTransitiveDependencyAsnyc(projectPath, dependencyName, newDependencyVersion, buildFiles, logger);
+        }
+        else
+        {
+            var peerDependencies = await GetUpdatedPeerDependenciesAsync(repoRootPath, projectPath, tfms, dependencyName, newDependencyVersion, logger);
+            if (peerDependencies is null)
             {
-                if (packageName.Equals(dependencyName, StringComparison.OrdinalIgnoreCase))
-                {
-                    packageFoundInDependencies = true;
-
-                    var nugetVersion = NuGetVersion.Parse(packageVersion);
-                    if (nugetVersion < newDependencyNuGetVersion)
-                    {
-                        packageNeedsUpdating = true;
-                    }
-                }
+                return;
             }
-        }
 
-        // Skip updating the project if the dependency does not exist in the graph
-        if (!packageFoundInDependencies)
-        {
-            logger.Log($"    Package [{dependencyName}] Does not exist as a dependency in [{projectPath}].");
-            return;
+            UpdateTopLevelDepdendency(buildFiles, dependencyName, previousDependencyVersion, newDependencyVersion, peerDependencies, logger);
         }
 
-        // Skip updating the project if the dependency version meets or exceeds the newDependencyVersion
-        if (!packageNeedsUpdating)
+        if (!await AreDependenciesCoherentAsync(repoRootPath, projectPath, dependencyName, logger, buildFiles, tfms))
         {
-            logger.Log($"    Package [{dependencyName}] already meets the requested dependency version in [{projectPath}].");
             return;
         }
 
-        var newDependency = new[] { new Dependency(dependencyName, newDependencyVersion, DependencyType.Unknown) };
-        var tfmsAndDependencies = new Dictionary<string, Dependency[]>();
-        foreach (var tfm in tfms)
-        {
-            var dependencies = await MSBuildHelper.GetAllPackageDependenciesAsync(repoRootPath, projectPath, tfm, newDependency, logger);
-            tfmsAndDependencies[tfm] = dependencies;
-        }
+        await SaveBuildFilesAsync(buildFiles, logger);
+    }
 
-        // stop update process if we find conflicting package versions
-        var conflictingPackageVersionsFound = false;
-        var packagesAndVersions = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
-        foreach (var (_, dependencies) in tfmsAndDependencies)
+    /// <summary>
+    /// Verifies that the package does not already satisfy the requested dependency version.
+    /// </summary>
+    /// <returns>Returns false if the package is not found or does not need to be updated.</returns>
+    private static async Task<bool> DoesDependencyRequireUpdateAsync(
+        string repoRootPath,
+        string projectPath,
+        string[] tfms,
+        Dependency[] topLevelDependencies,
+        string dependencyName,
+        string newDependencyVersion,
+        Logger logger)
+    {
+        var newDependencyNuGetVersion = NuGetVersion.Parse(newDependencyVersion);
+
+        bool packageFound = false;
+        bool needsUpdate = false;
+
+        foreach (var tfm in tfms)
         {
+            var dependencies = await MSBuildHelper.GetAllPackageDependenciesAsync(
+                repoRootPath,
+                projectPath,
+                tfm,
+                topLevelDependencies,
+                logger);
             foreach (var (packageName, packageVersion, _, _, _, _) in dependencies)
             {
-                if (packagesAndVersions.TryGetValue(packageName, out var existingVersion) &&
-                    existingVersion != packageVersion)
+                if (packageVersion is null)
                 {
-                    logger.Log($"    Package [{packageName}] tried to update to version [{packageVersion}], but found conflicting package version of [{existingVersion}].");
-                    conflictingPackageVersionsFound = true;
+                    continue;
                 }
-                else
+
+                if (packageName.Equals(dependencyName, StringComparison.OrdinalIgnoreCase))
                 {
-                    packagesAndVersions[packageName] = packageVersion!;
+                    packageFound = true;
+
+                    var nugetVersion = NuGetVersion.Parse(packageVersion);
+                    if (nugetVersion < newDependencyNuGetVersion)
+                    {
+                        needsUpdate = true;
+                        break;
+                    }
                 }
             }
-        }
 
-        if (conflictingPackageVersionsFound)
-        {
-            return;
+            if (packageFound && needsUpdate)
+            {
+                break;
+            }
         }
 
-        var unupgradableTfms = tfmsAndDependencies.Where(kvp => !kvp.Value.Any()).Select(kvp => kvp.Key);
-        if (unupgradableTfms.Any())
+        // Skip updating the project if the dependency does not exist in the graph
+        if (!packageFound)
         {
-            logger.Log($"    The following target frameworks could not find packages to upgrade: {string.Join(", ", unupgradableTfms)}");
-            return;
+            logger.Log($"    Package [{dependencyName}] Does not exist as a dependency in [{projectPath}].");
+            return false;
         }
 
-        if (isTransitive)
-        {
-            var directoryPackagesWithPinning = buildFiles.OfType<ProjectBuildFile>()
-                .FirstOrDefault(bf => IsCpmTransitivePinningEnabled(bf));
-            if (directoryPackagesWithPinning is not null)
-            {
-                PinTransitiveDependency(directoryPackagesWithPinning, dependencyName, newDependencyVersion, logger);
-            }
-            else
-            {
-                await AddTransitiveDependencyAsync(projectPath, dependencyName, newDependencyVersion, logger);
-            }
-        }
-        else
+        // Skip updating the project if the dependency version meets or exceeds the newDependencyVersion
+        if (!needsUpdate)
         {
-            UpdateTopLevelDepdendency(buildFiles, dependencyName, previousDependencyVersion, newDependencyVersion, packagesAndVersions, logger);
+            logger.Log($"    Package [{dependencyName}] already meets the requested dependency version in [{projectPath}].");
+            return false;
         }
 
-        var updatedTopLevelDependencies = MSBuildHelper.GetTopLevelPackageDependencyInfos(buildFiles);
-        foreach (var tfm in tfms)
+        return true;
+    }
+
+    private static async Task UpdateTransitiveDependencyAsnyc(string projectPath, string dependencyName, string newDependencyVersion, ImmutableArray<ProjectBuildFile> buildFiles, Logger logger)
+    {
+        var directoryPackagesWithPinning = buildFiles.OfType<ProjectBuildFile>()
+            .FirstOrDefault(bf => IsCpmTransitivePinningEnabled(bf));
+        if (directoryPackagesWithPinning is not null)
         {
-            var updatedPackages = await MSBuildHelper.GetAllPackageDependenciesAsync(repoRootPath, projectPath, tfm, updatedTopLevelDependencies.ToArray(), logger);
-            var dependenciesAreCoherent = await MSBuildHelper.DependenciesAreCoherentAsync(repoRootPath, projectPath, tfm, updatedPackages, logger);
-            if (!dependenciesAreCoherent)
-            {
-                logger.Log($"    Package [{dependencyName}] could not be updated in [{projectPath}] because it would cause a dependency conflict.");
-                return;
-            }
+            PinTransitiveDependency(directoryPackagesWithPinning, dependencyName, newDependencyVersion, logger);
         }
-
-        foreach (var buildFile in buildFiles)
+        else
         {
-            if (await buildFile.SaveAsync())
-            {
-                logger.Log($"    Saved [{buildFile.RepoRelativePath}].");
-            }
+            await AddTransitiveDependencyAsync(projectPath, dependencyName, newDependencyVersion, logger);
         }
     }
 
@@ -246,14 +238,68 @@ internal static class SdkPackageUpdater
         }
     }
 
+    /// <summary>
+    /// Gets the set of peer dependencies that need to be updated.
+    /// </summary>
+    /// <returns>Returns null if there are conflicting versions.</returns>
+    private static async Task<Dictionary<string, string>?> GetUpdatedPeerDependenciesAsync(
+        string repoRootPath,
+        string projectPath,
+        string[] tfms,
+        string dependencyName,
+        string newDependencyVersion,
+        Logger logger)
+    {
+        var newDependency = new[] { new Dependency(dependencyName, newDependencyVersion, DependencyType.Unknown) };
+        var tfmsAndDependencies = new Dictionary<string, Dependency[]>();
+        foreach (var tfm in tfms)
+        {
+            var dependencies = await MSBuildHelper.GetAllPackageDependenciesAsync(repoRootPath, projectPath, tfm, newDependency, logger);
+            tfmsAndDependencies[tfm] = dependencies;
+        }
+
+        var unupgradableTfms = tfmsAndDependencies.Where(kvp => !kvp.Value.Any()).Select(kvp => kvp.Key);
+        if (unupgradableTfms.Any())
+        {
+            logger.Log($"    The following target frameworks could not find packages to upgrade: {string.Join(", ", unupgradableTfms)}");
+            return null;
+        }
+
+        var conflictingPackageVersionsFound = false;
+        var packagesAndVersions = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var (_, dependencies) in tfmsAndDependencies)
+        {
+            foreach (var (packageName, packageVersion, _, _, _, _) in dependencies)
+            {
+                if (packagesAndVersions.TryGetValue(packageName, out var existingVersion) &&
+                    existingVersion != packageVersion)
+                {
+                    logger.Log($"    Package [{packageName}] tried to update to version [{packageVersion}], but found conflicting package version of [{existingVersion}].");
+                    conflictingPackageVersionsFound = true;
+                }
+                else
+                {
+                    packagesAndVersions[packageName] = packageVersion!;
+                }
+            }
+        }
+
+        // stop update process if we find conflicting package versions
+        if (conflictingPackageVersionsFound)
+        {
+            return null;
+        }
+
+        return packagesAndVersions;
+    }
+
     private static void UpdateTopLevelDepdendency(
         ImmutableArray<ProjectBuildFile> buildFiles,
         string dependencyName,
         string previousDependencyVersion,
         string newDependencyVersion,
-        IDictionary<string, string> packagesAndVersions,
-        Logger logger
-    )
+        IDictionary<string, string> peerDependencies,
+        Logger logger)
     {
         var result = TryUpdateDependencyVersion(buildFiles, dependencyName, previousDependencyVersion, newDependencyVersion, logger);
         if (result == UpdateResult.NotFound)
@@ -262,7 +308,7 @@ internal static class SdkPackageUpdater
             return;
         }
 
-        foreach (var (packageName, packageVersion) in packagesAndVersions.Where(kvp => string.Compare(kvp.Key, dependencyName, StringComparison.OrdinalIgnoreCase) != 0))
+        foreach (var (packageName, packageVersion) in peerDependencies.Where(kvp => string.Compare(kvp.Key, dependencyName, StringComparison.OrdinalIgnoreCase) != 0))
         {
             TryUpdateDependencyVersion(buildFiles, packageName, previousDependencyVersion: null, newDependencyVersion: packageVersion, logger);
         }
@@ -515,4 +561,32 @@ internal static class SdkPackageUpdater
                 packageName,
                 StringComparison.OrdinalIgnoreCase) &&
             (e.GetAttributeOrSubElementValue("Version", StringComparison.OrdinalIgnoreCase) ?? e.GetAttributeOrSubElementValue("VersionOverride", StringComparison.OrdinalIgnoreCase)) is not null);
+
+    private static async Task<bool> AreDependenciesCoherentAsync(string repoRootPath, string projectPath, string dependencyName, Logger logger, ImmutableArray<ProjectBuildFile> buildFiles, string[] tfms)
+    {
+        var updatedTopLevelDependencies = MSBuildHelper.GetTopLevelPackageDependencyInfos(buildFiles).ToArray();
+        foreach (var tfm in tfms)
+        {
+            var updatedPackages = await MSBuildHelper.GetAllPackageDependenciesAsync(repoRootPath, projectPath, tfm, updatedTopLevelDependencies, logger);
+            var dependenciesAreCoherent = await MSBuildHelper.DependenciesAreCoherentAsync(repoRootPath, projectPath, tfm, updatedPackages, logger);
+            if (!dependenciesAreCoherent)
+            {
+                logger.Log($"    Package [{dependencyName}] could not be updated in [{projectPath}] because it would cause a dependency conflict.");
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private static async Task SaveBuildFilesAsync(ImmutableArray<ProjectBuildFile> buildFiles, Logger logger)
+    {
+        foreach (var buildFile in buildFiles)
+        {
+            if (await buildFile.SaveAsync())
+            {
+                logger.Log($"    Saved [{buildFile.RepoRelativePath}].");
+            }
+        }
+    }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdaterWorker.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
+using System.Linq;
 using System.Threading.Tasks;
 
 namespace NuGetUpdater.Core;
@@ -9,6 +10,7 @@ public class UpdaterWorker
 {
     private readonly Logger _logger;
     private readonly HashSet<string> _processedGlobalJsonPaths = new(StringComparer.OrdinalIgnoreCase);
+    private readonly HashSet<string> _processedProjectPaths = new(StringComparer.OrdinalIgnoreCase);
 
     public UpdaterWorker(Logger logger)
     {
@@ -49,6 +51,7 @@ public class UpdaterWorker
         }
 
         _processedGlobalJsonPaths.Clear();
+        _processedProjectPaths.Clear();
     }
 
     private async Task RunForSolutionAsync(
@@ -101,7 +104,40 @@ public class UpdaterWorker
         string newDependencyVersion,
         bool isTransitive)
     {
-        _logger.Log($"Running for project [{projectPath}]");
+        _logger.Log($"Running for project file [{Path.GetRelativePath(repoRootPath, projectPath)}]");
+        if (!File.Exists(projectPath))
+        {
+            _logger.Log($"File [{projectPath}] does not exist.");
+            return;
+        }
+
+        var projectFilePaths = MSBuildHelper.GetProjectPathsFromProject(projectPath);
+        foreach (var projectFullPath in projectFilePaths.Concat([projectPath]))
+        {
+            // If there is some MSBuild logic that needs to run to fully resolve the path skip the project
+            if (File.Exists(projectFullPath))
+            {
+                await RunUpdaterAsync(repoRootPath, projectFullPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+            }
+        }
+    }
+
+    private async Task RunUpdaterAsync(
+        string repoRootPath,
+        string projectPath,
+        string dependencyName,
+        string previousDependencyVersion,
+        string newDependencyVersion,
+        bool isTransitive)
+    {
+        if (_processedProjectPaths.Contains(projectPath))
+        {
+            return;
+        }
+
+        _processedProjectPaths.Add(projectPath);
+
+        _logger.Log($"Updating project [{projectPath}]");
 
         if (!isTransitive
             && MSBuildHelper.GetGlobalJsonPath(repoRootPath, projectPath) is { } globalJsonPath
@@ -111,7 +147,7 @@ public class UpdaterWorker
             await GlobalJsonUpdater.UpdateDependencyAsync(repoRootPath, globalJsonPath, dependencyName, previousDependencyVersion, newDependencyVersion, _logger);
         }
 
-        if (NuGetHelper.HasProjectConfigFile(projectPath))
+        if (NuGetHelper.HasPackagesConfigFile(projectPath))
         {
             await PackagesConfigUpdater.UpdateDependencyAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive, _logger);
         }