dependabot-nuget 0.263.0 → 0.264.0

data/lib/dependabot/nuget/native_update_checker/native_requirements_updater.rb

@@ -0,0 +1,105 @@
+# typed: strict
+# frozen_string_literal: true
+
+#######################################################################
+# For more details on Dotnet version constraints, see:                #
+# https://docs.microsoft.com/en-us/nuget/reference/package-versioning #
+#######################################################################
+
+require "sorbet-runtime"
+
+require "dependabot/update_checkers/base"
+require "dependabot/nuget/native_discovery/native_dependency_details"
+require "dependabot/nuget/version"
+
+module Dependabot
+  module Nuget
+    class NativeUpdateChecker < Dependabot::UpdateCheckers::Base
+      class NativeRequirementsUpdater
+        extend T::Sig
+
+        sig do
+          params(
+            requirements: T::Array[T::Hash[Symbol, T.untyped]],
+            dependency_details: T.nilable(Dependabot::Nuget::NativeDependencyDetails)
+          )
+            .void
+        end
+        def initialize(requirements:, dependency_details:)
+          @requirements = requirements
+          @dependency_details = dependency_details
+        end
+
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        def updated_requirements
+          return requirements unless clean_version
+
+          # NOTE: Order is important here. The FileUpdater needs the updated
+          # requirement at index `i` to correspond to the previous requirement
+          # at the same index.
+          requirements.map do |req|
+            next req if req.fetch(:requirement).nil?
+            next req if req.fetch(:requirement).include?(",")
+
+            new_req =
+              if req.fetch(:requirement).include?("*")
+                update_wildcard_requirement(req.fetch(:requirement))
+              else
+                # Since range requirements are excluded by the line above we can
+                # replace anything that looks like a version with the new
+                # version
+                req[:requirement].sub(
+                  /#{Nuget::Version::VERSION_PATTERN}/o,
+                  clean_version.to_s
+                )
+              end
+
+            next req if new_req == req.fetch(:requirement)
+
+            new_source = req[:source]&.dup
+            unless @dependency_details.nil?
+              new_source = {
+                type: "nuget_repo",
+                source_url: @dependency_details.info_url
+              }
+            end
+
+            req.merge({ requirement: new_req, source: new_source })
+          end
+        end
+
+        private
+
+        sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+        attr_reader :requirements
+
+        sig { returns(T.class_of(Dependabot::Nuget::Version)) }
+        def version_class
+          Dependabot::Nuget::Version
+        end
+
+        sig { returns(T.nilable(Dependabot::Nuget::Version)) }
+        def clean_version
+          return unless @dependency_details&.version
+
+          version_class.new(@dependency_details.version)
+        end
+
+        sig { params(req_string: String).returns(String) }
+        def update_wildcard_requirement(req_string)
+          return req_string if req_string == "*-*"
+
+          return req_string if req_string == "*"
+
+          precision = T.must(req_string.split("*").first).split(/\.|\-/).count
+          wildcard_section = req_string.partition(/(?=[.\-]\*)/).last
+
+          version_parts = T.must(clean_version).segments.first(precision)
+          version = version_parts.join(".")
+
+          version + wildcard_section
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/nuget/native_update_checker/native_update_checker.rb

@@ -0,0 +1,200 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/nuget/analysis/analysis_json_reader"
+require "dependabot/nuget/native_discovery/native_discovery_json_reader"
+require "dependabot/update_checkers"
+require "dependabot/update_checkers/base"
+require "sorbet-runtime"
+
+module Dependabot
+  module Nuget
+    class NativeUpdateChecker < Dependabot::UpdateCheckers::Base
+      extend T::Sig
+
+      require_relative "native_requirements_updater"
+
+      sig { override.returns(T.nilable(String)) }
+      def latest_version
+        # No need to find latest version for transitive dependencies unless they have a vulnerability.
+        return dependency.version if !dependency.top_level? && !vulnerable?
+
+        # if no update sources have the requisite package, then we can only assume that the current version is correct
+        @latest_version = T.let(
+          update_analysis.dependency_analysis.updated_version,
+          T.nilable(String)
+        )
+      end
+
+      sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
+      def latest_resolvable_version
+        # We always want a full unlock since any package update could update peer dependencies as well.
+        # To force a full unlock instead of an own unlock, we return nil.
+        nil
+      end
+
+      sig { override.returns(Dependabot::Nuget::Version) }
+      def lowest_security_fix_version
+        update_analysis.dependency_analysis.numeric_updated_version
+      end
+
+      sig { override.returns(T.nilable(Dependabot::Nuget::Version)) }
+      def lowest_resolvable_security_fix_version
+        return nil if version_comes_from_multi_dependency_property?
+
+        update_analysis.dependency_analysis.numeric_updated_version
+      end
+
+      sig { override.returns(NilClass) }
+      def latest_resolvable_version_with_no_unlock
+        # Irrelevant, since Nuget has a single dependency file
+        nil
+      end
+
+      sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      def updated_requirements
+        dep_details = updated_dependency_details.find { |d| d.name.casecmp?(dependency.name) }
+        NativeRequirementsUpdater.new(
+          requirements: dependency.requirements,
+          dependency_details: dep_details
+        ).updated_requirements
+      end
+
+      sig { returns(T::Boolean) }
+      def up_to_date?
+        !update_analysis.dependency_analysis.can_update
+      end
+
+      sig { returns(T::Boolean) }
+      def requirements_unlocked_or_can_be?
+        update_analysis.dependency_analysis.can_update
+      end
+
+      sig { returns(T::Boolean) }
+      def public_latest_version_resolvable_with_full_unlock?
+        latest_version_resolvable_with_full_unlock?
+      end
+
+      sig { returns(T::Array[Dependabot::Dependency]) }
+      def public_updated_dependencies_after_full_unlock
+        updated_dependencies_after_full_unlock
+      end
+
+      private
+
+      sig { returns(AnalysisJsonReader) }
+      def update_analysis
+        @update_analysis ||= T.let(request_analysis, T.nilable(AnalysisJsonReader))
+      end
+
+      sig { returns(String) }
+      def dependency_file_path
+        File.join(NativeDiscoveryJsonReader.temp_directory, "dependency", "#{dependency.name}.json")
+      end
+
+      sig { returns(AnalysisJsonReader) }
+      def request_analysis
+        discovery_file_path = NativeDiscoveryJsonReader.get_discovery_file_path_from_dependency_files(dependency_files)
+        analysis_folder_path = AnalysisJsonReader.temp_directory
+
+        write_dependency_info
+
+        NativeHelpers.run_nuget_analyze_tool(repo_root: T.must(repo_contents_path),
+                                             discovery_file_path: discovery_file_path,
+                                             dependency_file_path: dependency_file_path,
+                                             analysis_folder_path: analysis_folder_path,
+                                             credentials: credentials)
+
+        analysis_json = AnalysisJsonReader.analysis_json(dependency_name: dependency.name)
+
+        AnalysisJsonReader.new(analysis_json: T.must(analysis_json))
+      end
+
+      sig { void }
+      def write_dependency_info
+        dependency_info = {
+          Name: dependency.name,
+          Version: dependency.version.to_s,
+          IsVulnerable: vulnerable?,
+          IgnoredVersions: ignored_versions,
+          Vulnerabilities: security_advisories.map do |vulnerability|
+            {
+              DependencyName: vulnerability.dependency_name,
+              PackageManager: vulnerability.package_manager,
+              VulnerableVersions: vulnerability.vulnerable_versions.map(&:to_s),
+              SafeVersions: vulnerability.safe_versions.map(&:to_s)
+            }
+          end
+        }.to_json
+        dependency_directory = File.dirname(dependency_file_path)
+
+        begin
+          Dir.mkdir(dependency_directory)
+        rescue StandardError
+          nil?
+        end
+
+        File.write(dependency_file_path, dependency_info)
+      end
+
+      sig { returns(Dependabot::FileParsers::Base::DependencySet) }
+      def discovered_dependencies
+        discovery_json_reader = NativeDiscoveryJsonReader.get_discovery_from_dependency_files(dependency_files)
+        discovery_json_reader.dependency_set
+      end
+
+      sig { override.returns(T::Boolean) }
+      def latest_version_resolvable_with_full_unlock?
+        # We always want a full unlock since any package update could update peer dependencies as well.
+        true
+      end
+
+      sig { override.returns(T::Array[Dependabot::Dependency]) }
+      def updated_dependencies_after_full_unlock
+        dependencies = discovered_dependencies.dependencies
+        updated_dependency_details.filter_map do |dependency_details|
+          dep = dependencies.find { |d| d.name.casecmp(dependency_details.name)&.zero? }
+          next unless dep
+
+          metadata = {}
+          # For peer dependencies, instruct updater to not directly update this dependency
+          metadata = { information_only: true } unless dependency.name.casecmp(dependency_details.name)&.zero?
+
+          # rebuild the new requirements with the updated dependency details
+          updated_reqs = dep.requirements.map do |r|
+            r = r.clone
+            r[:requirement] = dependency_details.version
+            r[:source] = {
+              type: "nuget_repo",
+              source_url: dependency_details.info_url
+            }
+            r
+          end
+
+          Dependency.new(
+            name: dep.name,
+            version: dependency_details.version,
+            requirements: updated_reqs,
+            previous_version: dep.version,
+            previous_requirements: dep.requirements,
+            package_manager: dep.package_manager,
+            metadata: metadata
+          )
+        end
+      end
+
+      sig { returns(T::Array[Dependabot::Nuget::NativeDependencyDetails]) }
+      def updated_dependency_details
+        @updated_dependency_details ||= T.let(update_analysis.dependency_analysis.updated_dependencies,
+                                              T.nilable(T::Array[Dependabot::Nuget::NativeDependencyDetails]))
+      end
+
+      sig { returns(T::Boolean) }
+      def version_comes_from_multi_dependency_property?
+        update_analysis.dependency_analysis.version_comes_from_multi_dependency_property
+      end
+    end
+  end
+end
+
+Dependabot::UpdateCheckers.register("nuget", Dependabot::Nuget::UpdateChecker)

data/lib/dependabot/nuget/nuget_config_credential_helpers.rb

@@ -69,12 +69,13 @@ module Dependabot
         begin
           yield
         rescue StandardError => e
-          Dependabot.logger.error(
+          log_message =
             <<~LOG_MESSAGE
               Block argument of NuGetConfigCredentialHelpers::patch_nuget_config_for_action causes an exception #{e}:
               #{e.message}
             LOG_MESSAGE
-          )
+          Dependabot.logger.error(log_message)
+          puts log_message
         ensure
           restore_user_nuget_config
         end

data/lib/dependabot/nuget/update_checker.rb

@@ -16,10 +16,19 @@ module Dependabot
       require_relative "update_checker/requirements_updater"
       require_relative "update_checker/dependency_finder"
 
+      require_relative "native_update_checker/native_update_checker"
+
       PROPERTY_REGEX = /\$\((?<property>.*?)\)/
 
+      sig { returns(T::Boolean) }
+      def self.native_analysis_enabled?
+        Dependabot::Experiments.enabled?(:nuget_native_analysis)
+      end
+
       sig { override.returns(T.nilable(String)) }
       def latest_version
+        return native_update_checker.latest_version if UpdateChecker.native_analysis_enabled?
+
         # No need to find latest version for transitive dependencies unless they have a vulnerability.
         return dependency.version if !dependency.top_level? && !vulnerable?
 
@@ -32,6 +41,8 @@ module Dependabot
 
       sig { override.returns(T.nilable(T.any(String, Gem::Version))) }
       def latest_resolvable_version
+        return native_update_checker.latest_resolvable_version if UpdateChecker.native_analysis_enabled?
+
         # We always want a full unlock since any package update could update peer dependencies as well.
         # To force a full unlock instead of an own unlock, we return nil.
         nil
@@ -39,6 +50,8 @@ module Dependabot
 
       sig { override.returns(Dependabot::Nuget::Version) }
       def lowest_security_fix_version
+        return native_update_checker.lowest_security_fix_version if UpdateChecker.native_analysis_enabled?
+
         lowest_security_fix_version_details&.fetch(:version)
       end
 
@@ -51,12 +64,16 @@ module Dependabot
 
       sig { override.returns(NilClass) }
       def latest_resolvable_version_with_no_unlock
+        return native_update_checker.latest_resolvable_version_with_no_unlock if UpdateChecker.native_analysis_enabled?
+
         # Irrelevant, since Nuget has a single dependency file
         nil
       end
 
       sig { override.returns(T::Array[T::Hash[Symbol, T.untyped]]) }
       def updated_requirements
+        return native_update_checker.updated_requirements if UpdateChecker.native_analysis_enabled?
+
         RequirementsUpdater.new(
           requirements: dependency.requirements,
           latest_version: preferred_resolvable_version_details&.fetch(:version, nil)&.to_s,
@@ -66,6 +83,8 @@ module Dependabot
 
       sig { returns(T::Boolean) }
       def up_to_date?
+        return native_update_checker.up_to_date? if UpdateChecker.native_analysis_enabled?
+
         # No need to update transitive dependencies unless they have a vulnerability.
         return true if !dependency.top_level? && !vulnerable?
 
@@ -89,6 +108,26 @@ module Dependabot
 
       private
 
+      sig { returns(Dependabot::Nuget::NativeUpdateChecker) }
+      def native_update_checker
+        @native_update_checker ||=
+          T.let(
+            Dependabot::Nuget::NativeUpdateChecker.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              repo_contents_path: repo_contents_path,
+              ignored_versions: ignored_versions,
+              raise_on_ignored: raise_on_ignored,
+              security_advisories: security_advisories,
+              requirements_update_strategy: requirements_update_strategy,
+              dependency_group: dependency_group,
+              options: options
+            ),
+            T.nilable(Dependabot::Nuget::NativeUpdateChecker)
+          )
+      end
+
       sig { returns(T.nilable(T::Hash[Symbol, T.untyped])) }
       def preferred_resolvable_version_details
         # If this dependency is vulnerable, prefer trying to update to the
@@ -101,6 +140,10 @@ module Dependabot
 
       sig { override.returns(T::Boolean) }
       def latest_version_resolvable_with_full_unlock?
+        if UpdateChecker.native_analysis_enabled?
+          return native_update_checker.public_latest_version_resolvable_with_full_unlock?
+        end
+
         # We always want a full unlock since any package update could update peer dependencies as well.
         return true unless version_comes_from_multi_dependency_property?
 
@@ -109,6 +152,10 @@ module Dependabot
 
       sig { override.returns(T::Array[Dependabot::Dependency]) }
       def updated_dependencies_after_full_unlock
+        if UpdateChecker.native_analysis_enabled?
+          return native_update_checker.public_updated_dependencies_after_full_unlock
+        end
+
         return property_updater.updated_dependencies if version_comes_from_multi_dependency_property?
 
         puts "Finding updated dependencies for #{dependency.name}."

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.263.0
+  version: 0.264.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-27 00:00:00.000000000 Z
+date: 2024-07-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.263.0
+        version: 0.264.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.263.0
+        version: 0.264.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -290,15 +290,24 @@ files:
 - helpers/lib/NuGetUpdater/NuGetProjects/NuGet.Resolver/NuGet.Resolver.csproj
 - helpers/lib/NuGetUpdater/NuGetProjects/NuGet.Versioning/NuGet.Versioning.csproj
 - helpers/lib/NuGetUpdater/NuGetProjects/README.md
+- helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Analyze.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Discover.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTests.FrameworkCheck.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Update.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/NuGetUpdater.Cli.Test.csproj
+- helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/AnalyzeCommand.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/DiscoverCommand.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/FrameworkCheckCommand.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/UpdateCommand.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli/NuGetUpdater.Cli.csproj
 - helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Program.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTestBase.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/CompatibilityCheckerTests.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/ExpectedAnalysisResult.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/RequirementTests.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/SecurityVulnerabilityExtensionsTests.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/VersionFinderTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTestBase.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.DotNetToolsJson.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.GlobalJson.cs
@@ -332,6 +341,19 @@ files:
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/JsonHelperTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/SdkPackageUpdaterHelperTests.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/AnalysisResult.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/AnalyzeWorker.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/CompatabilityChecker.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/DependencyFinder.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/DependencyInfo.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/Extensions.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/NuGetContext.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/Requirement.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/RequirementConverter.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/SecurityVulnerability.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/SecurityVulnerabilityExtensions.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/VersionFinder.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/VersionResult.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Dependency.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyType.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DirectoryPackagesPropsDiscovery.cs
@@ -385,6 +407,8 @@ files:
 - helpers/lib/NuGetUpdater/global.json
 - helpers/lib/NuGetUpdater/xunit.runner.json
 - lib/dependabot/nuget.rb
+- lib/dependabot/nuget/analysis/analysis_json_reader.rb
+- lib/dependabot/nuget/analysis/dependency_analysis.rb
 - lib/dependabot/nuget/cache_manager.rb
 - lib/dependabot/nuget/discovery/dependency_details.rb
 - lib/dependabot/nuget/discovery/dependency_file_discovery.rb
@@ -401,7 +425,17 @@ files:
 - lib/dependabot/nuget/file_updater.rb
 - lib/dependabot/nuget/http_response_helpers.rb
 - lib/dependabot/nuget/metadata_finder.rb
+- lib/dependabot/nuget/native_discovery/native_dependency_details.rb
+- lib/dependabot/nuget/native_discovery/native_dependency_file_discovery.rb
+- lib/dependabot/nuget/native_discovery/native_directory_packages_props_discovery.rb
+- lib/dependabot/nuget/native_discovery/native_discovery_json_reader.rb
+- lib/dependabot/nuget/native_discovery/native_evaluation_details.rb
+- lib/dependabot/nuget/native_discovery/native_project_discovery.rb
+- lib/dependabot/nuget/native_discovery/native_property_details.rb
+- lib/dependabot/nuget/native_discovery/native_workspace_discovery.rb
 - lib/dependabot/nuget/native_helpers.rb
+- lib/dependabot/nuget/native_update_checker/native_requirements_updater.rb
+- lib/dependabot/nuget/native_update_checker/native_update_checker.rb
 - lib/dependabot/nuget/nuget_client.rb
 - lib/dependabot/nuget/nuget_config_credential_helpers.rb
 - lib/dependabot/nuget/requirement.rb
@@ -422,7 +456,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.263.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.264.0
 post_install_message: 
 rdoc_options: []
 require_paths: