dependabot-nuget 0.252.0 → 0.254.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.PackagesConfig.cs

@@ -9,13 +9,64 @@ public partial class UpdateWorkerTests
 {
     public class PackagesConfig : UpdateWorkerTestBase
     {
-        public PackagesConfig()
+        [Fact]
+        public async Task UpdateSingleDependencyInPackagesConfig()
         {
-            MSBuildHelper.RegisterMSBuild();
+            // update Newtonsoft.Json from 7.0.1 to 13.0.1
+            await TestUpdateForProject("Newtonsoft.Json", "7.0.1", "13.0.1",
+                // existing
+                projectContents: """
+                <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                  <PropertyGroup>
+                    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <None Include="packages.config" />
+                  </ItemGroup>
+                  <ItemGroup>
+                    <Reference Include="Newtonsoft.Json, Version=7.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed">
+                      <HintPath>packages\Newtonsoft.Json.7.0.1\lib\net45\Newtonsoft.Json.dll</HintPath>
+                      <Private>True</Private>
+                    </Reference>
+                  </ItemGroup>
+                  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                </Project>
+                """,
+                packagesConfigContents: """
+                <packages>
+                  <package id="Newtonsoft.Json" version="7.0.1" targetFramework="net45" />
+                </packages>
+                """,
+                // expected
+                expectedProjectContents: """
+                <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                  <PropertyGroup>
+                    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <None Include="packages.config" />
+                  </ItemGroup>
+                  <ItemGroup>
+                    <Reference Include="Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed">
+                      <HintPath>packages\Newtonsoft.Json.13.0.1\lib\net45\Newtonsoft.Json.dll</HintPath>
+                      <Private>True</Private>
+                    </Reference>
+                  </ItemGroup>
+                  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                </Project>
+                """,
+                expectedPackagesConfigContents: """
+                <?xml version="1.0" encoding="utf-8"?>
+                <packages>
+                  <package id="Newtonsoft.Json" version="13.0.1" targetFramework="net45" />
+                </packages>
+                """);
         }
 
         [Fact]
-        public async Task UpdateSingleDependencyInPackagesConfig()
+        public async Task UpdateSingleDependencyInPackagesConfig_ReferenceHasNoAssemblyVersion()
         {
             // update Newtonsoft.Json from 7.0.1 to 13.0.1
             await TestUpdateForProject("Newtonsoft.Json", "7.0.1", "13.0.1",
@@ -30,7 +81,7 @@ public partial class UpdateWorkerTests
                     <None Include="packages.config" />
                   </ItemGroup>
                   <ItemGroup>
-                    <Reference Include="Newtonsoft.Json, Version=7.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed">
+                    <Reference Include="Newtonsoft.Json">
                       <HintPath>packages\Newtonsoft.Json.7.0.1\lib\net45\Newtonsoft.Json.dll</HintPath>
                       <Private>True</Private>
                     </Reference>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.Sdk.cs

@@ -8,11 +8,6 @@ public partial class UpdateWorkerTests
 {
     public class Sdk : UpdateWorkerTestBase
     {
-        public Sdk()
-        {
-            MSBuildHelper.RegisterMSBuild();
-        }
-
         [Theory]
         [InlineData("net472")]
         [InlineData("netstandard2.0")]
@@ -175,24 +170,6 @@ public partial class UpdateWorkerTests
                 ]);
         }
 
-        [Fact]
-        public async Task NoChange_WhenPackageHasVersionConstraint()
-        {
-            // Dependency package has version constraint
-            await TestNoChangeforProject("AWSSDK.Core", "3.3.21.19", "3.7.300.20",
-                projectContents: $"""
-                <Project Sdk="Microsoft.NET.Sdk">
-                  <PropertyGroup>
-                    <TargetFramework>netstandard2.0</TargetFramework>
-                  </PropertyGroup>
-                  <ItemGroup>
-                    <PackageReference Include="AWSSDK.S3" Version="3.3.17.3" />
-                    <PackageReference Include="AWSSDK.Core" Version="3.3.21.19" />
-                  </ItemGroup>
-                </Project>
-                """);
-        }
-
         [Fact]
         public async Task UpdateVersionAttribute_InProjectFile_ForPackageReferenceInclude_Windows()
         {
@@ -2558,5 +2535,35 @@ public partial class UpdateWorkerTests
                     """
             );
         }
+
+        [Fact]
+        public async Task UpdatingPackageAlsoUpdatesAnythingWithADependencyOnTheUpdatedPackage()
+        {
+            // updating SpecFlow from 3.3.30 requires that SpecFlow.Tools.MsBuild.Generation also be updated
+            await TestUpdateForProject("SpecFlow", "3.3.30", "3.4.3",
+                projectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>netstandard2.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="SpecFlow" Version="3.3.30" />
+                        <PackageReference Include="SpecFlow.Tools.MsBuild.Generation" Version="3.3.30" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                expectedProjectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>netstandard2.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="SpecFlow" Version="3.4.3" />
+                        <PackageReference Include="SpecFlow.Tools.MsBuild.Generation" Version="3.4.3" />
+                      </ItemGroup>
+                    </Project>
+                    """
+                );
+        }
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/JsonHelperTests.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Text.Json;
 
 using NuGetUpdater.Core.Utilities;
 
@@ -9,6 +10,11 @@ namespace NuGetUpdater.Core.Test.Utilities;
 
 public class JsonHelperTests
 {
+    private static readonly JsonDocumentOptions DocumentOptions = new()
+    {
+        CommentHandling = JsonCommentHandling.Skip,
+    };
+
     [Theory]
     [MemberData(nameof(JsonUpdaterTestData))]
     public void UpdateJsonPreservingComments(string json, string[] propertyPath, string newValue, string expectedJson)
@@ -16,6 +22,8 @@ public class JsonHelperTests
         var updatedJson = JsonHelper.UpdateJsonProperty(json, propertyPath, newValue, StringComparison.OrdinalIgnoreCase).Replace("\r", string.Empty);
         expectedJson = expectedJson.Replace("\r", string.Empty);
         Assert.Equal(expectedJson, updatedJson);
+        using var document = JsonDocument.Parse(updatedJson, DocumentOptions);
+        Assert.Equal(JsonValueKind.Object, document.RootElement.ValueKind);
     }
 
     public static IEnumerable<object[]> JsonUpdaterTestData()
@@ -237,5 +245,54 @@ public class JsonHelperTests
             }
             """
         ];
+
+        // https://github.com/dependabot/dependabot-core/issues/9170
+        yield return
+        [
+            // original json
+            """
+            {
+              "sdk": {
+                "version": "8.0.201",
+                "allowPrerelease": true,
+                "rollForward": "major"
+              },
+
+              "tools": {
+                "dotnet": "8.0.201"
+              },
+
+              "msbuild-sdks": {
+                "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.23463.1",
+                "Microsoft.DotNet.Helix.Sdk": "8.0.0-beta.23463.1"
+              }
+            }
+            """,
+            // property path
+            new[]
+            {
+                "msbuild-sdks",
+                "Microsoft.DotNet.Helix.Sdk",
+            },
+            // new value
+            "8.0.0-beta.24123.1",
+            // expected json
+            """
+            {
+              "sdk": {
+                "version": "8.0.201",
+                "allowPrerelease": true,
+                "rollForward": "major"
+              },
+              "tools": {
+                "dotnet": "8.0.201"
+              },
+              "msbuild-sdks": {
+                "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.23463.1",
+                "Microsoft.DotNet.Helix.Sdk": "8.0.0-beta.24123.1"
+              }
+            }
+            """
+        ];
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs

@@ -6,13 +6,8 @@ namespace NuGetUpdater.Core.Test.Utilities;
 
 using TestFile = (string Path, string Content);
 
-public class MSBuildHelperTests
+public class MSBuildHelperTests : TestBase
 {
-    public MSBuildHelperTests()
-    {
-        MSBuildHelper.RegisterMSBuild();
-    }
-
     [Fact]
     public void GetRootedValue_FindsValue()
     {
@@ -110,15 +105,16 @@ public class MSBuildHelperTests
     [InlineData("<Project><PropertyGroup><TargetFrameworks>netstandard2.0</TargetFrameworks></PropertyGroup></Project>", "netstandard2.0", null)]
     [InlineData("<Project><PropertyGroup><TargetFrameworks>  ; netstandard2.0 ; </TargetFrameworks></PropertyGroup></Project>", "netstandard2.0", null)]
     [InlineData("<Project><PropertyGroup><TargetFrameworks>netstandard2.0 ; netstandard2.1 ; </TargetFrameworks></PropertyGroup></Project>", "netstandard2.0", "netstandard2.1")]
-    public void TfmsCanBeDeterminedFromProjectContents(string projectContents, string? expectedTfm1, string? expectedTfm2)
+    [InlineData("<Project><PropertyGroup><TargetFramework>netstandard2.0</TargetFramework><TargetFrameworkVersion Condition='False'>v4.7.2</TargetFrameworkVersion></PropertyGroup></Project>", "netstandard2.0", null)]
+    [InlineData("<Project><PropertyGroup><TargetFramework>$(PropertyThatCannotBeResolved)</TargetFramework></PropertyGroup></Project>", null, null)]
+    public async Task TfmsCanBeDeterminedFromProjectContents(string projectContents, string? expectedTfm1, string? expectedTfm2)
     {
         var projectPath = Path.GetTempFileName();
         try
         {
             File.WriteAllText(projectPath, projectContents);
             var expectedTfms = new[] { expectedTfm1, expectedTfm2 }.Where(tfm => tfm is not null).ToArray();
-            var buildFile = ProjectBuildFile.Open(Path.GetDirectoryName(projectPath)!, projectPath);
-            var actualTfms = MSBuildHelper.GetTargetFrameworkMonikers(ImmutableArray.Create(buildFile));
+            var (_buildFiles, actualTfms) = await MSBuildHelper.LoadBuildFilesAndTargetFrameworksAsync(Path.GetDirectoryName(projectPath)!, projectPath);
             AssertEx.Equal(expectedTfms, actualTfms);
         }
         finally
@@ -493,6 +489,45 @@ public class MSBuildHelperTests
         }
     }
 
+    [Fact]
+    public async Task DependencyConflictsCanBeResolved()
+    {
+        // the package `SpecFlow` was already updated from 3.3.30 to 3.4.3, but this causes a conflict with
+        // `SpecFlow.Tools.MsBuild.Generation` that needs to be resolved
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolved)}_");
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>netstandard2.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="SpecFlow" Version="3.4.3" />
+                    <PackageReference Include="SpecFlow.Tools.MsBuild.Generation" Version="3.3.30" />
+                  </ItemGroup>
+                </Project>
+                """);
+            var dependencies = new[]
+            {
+                new Dependency("SpecFlow", "3.4.3", DependencyType.PackageReference),
+                new Dependency("SpecFlow.Tools.MsBuild.Generation", "3.3.30", DependencyType.PackageReference),
+            };
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "netstandard2.0", dependencies, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(2, resolvedDependencies.Length);
+            Assert.Equal("SpecFlow", resolvedDependencies[0].Name);
+            Assert.Equal("3.4.3", resolvedDependencies[0].Version);
+            Assert.Equal("SpecFlow.Tools.MsBuild.Generation", resolvedDependencies[1].Name);
+            Assert.Equal("3.4.3", resolvedDependencies[1].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
     public static IEnumerable<object[]> GetTopLevelPackageDependencyInfosTestData()
     {
         // simple case

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/SdkPackageUpdaterHelperTests.cs

@@ -167,7 +167,7 @@ namespace NuGetUpdater.Core.Test.Utilities
 
         private static async Task<string[]> LoadBuildFilesFromTemp(TemporaryDirectory temporaryDirectory, string relativeProjectPath)
         {
-            var buildFiles = await MSBuildHelper.LoadBuildFilesAsync(temporaryDirectory.DirectoryPath, $"{temporaryDirectory.DirectoryPath}/{relativeProjectPath}");
+            var (buildFiles, _tfms) = await MSBuildHelper.LoadBuildFilesAndTargetFrameworksAsync(temporaryDirectory.DirectoryPath, $"{temporaryDirectory.DirectoryPath}/{relativeProjectPath}");
             var buildFilePaths = buildFiles.Select(f => f.RelativePath.NormalizePathToUnix()).ToArray();
             return buildFilePaths;
         }

data/lib/dependabot/nuget/discovery/discovery_json_reader.rb

@@ -65,8 +65,6 @@ module Dependabot
         @workspace_discovery ||= T.let(begin
           return nil unless discovery_json.content
 
-          Dependabot.logger.info("Discovery JSON content: #{discovery_json.content}")
-
           parsed_json = T.let(JSON.parse(T.must(discovery_json.content)), T::Hash[String, T.untyped])
           WorkspaceDiscovery.from_json(parsed_json)
         end, T.nilable(WorkspaceDiscovery))

data/lib/dependabot/nuget/file_parser.rb

@@ -22,13 +22,19 @@ module Dependabot
         workspace_path = project_files.first&.directory
         return [] unless workspace_path
 
-        # run discovery for the repo
-        NativeHelpers.run_nuget_discover_tool(repo_root: T.must(repo_contents_path),
-                                              workspace_path: workspace_path,
-                                              output_path: DiscoveryJsonReader.discovery_file_path,
-                                              credentials: credentials)
+        # `workspace_path` is the only unique value here so we use it as the cache key
+        cache = T.let(CacheManager.cache("file_parser.parse"), T::Hash[String, T::Array[Dependabot::Dependency]])
+        key = workspace_path
+        cache[key] ||= begin
+          # run discovery for the repo
+          NativeHelpers.run_nuget_discover_tool(repo_root: T.must(repo_contents_path),
+                                                workspace_path: workspace_path,
+                                                output_path: DiscoveryJsonReader.discovery_file_path,
+                                                credentials: credentials)
+          discovered_dependencies.dependencies
+        end
 
-        discovered_dependencies.dependencies
+        T.must(cache[key])
       end
 
       private
@@ -38,6 +44,8 @@ module Dependabot
         discovery_json = DiscoveryJsonReader.discovery_json
         return DependencySet.new unless discovery_json
 
+        Dependabot.logger.info("Discovery JSON content: #{discovery_json.content}")
+
         DiscoveryJsonReader.new(
           discovery_json: discovery_json
         ).dependency_set

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.252.0
+  version: 0.254.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-04-11 00:00:00.000000000 Z
+date: 2024-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.252.0
+        version: 0.254.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.252.0
+        version: 0.254.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -50,14 +50,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: 1.9.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: 1.9.2
 - !ruby/object:Gem::Dependency
   name: gpgme
   requirement: !ruby/object:Gem::Requirement
@@ -134,70 +134,56 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.58.0
+        version: 1.63.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.58.0
+        version: 1.63.2
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.19.0
+        version: 1.21.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.19.0
+        version: 1.21.0
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.27.1
+        version: 2.29.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.27.1
+        version: 2.29.1
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.7.3
-- !ruby/object:Gem::Dependency
-  name: stackprof
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.2.16
+        version: 0.8.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.2.16
+        version: 0.8.1
 - !ruby/object:Gem::Dependency
   name: turbo_tests
   requirement: !ruby/object:Gem::Requirement
@@ -314,6 +300,7 @@ files:
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/FrameworkChecker/SupportedFrameworkFacts.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/NuGetUpdater.Core.Test.csproj
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/TemporaryDirectory.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/TestBase.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/TestExtensions.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/PackagesConfigUpdaterTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTestBase.cs
@@ -417,7 +404,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.252.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.254.0
 post_install_message: 
 rdoc_options: []
 require_paths: