dependabot-nuget 0.266.0 → 0.267.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4669e522f1ce196d5657096bdf738e6ab353c5a697ea1b0acb1f0c87f9815a44
-  data.tar.gz: 33657445578fcd52b0370490b3c1f4b2fe165ad9f00e22d831d6a216b89458f5
+  metadata.gz: 19fd9d2635d3d1f5737870ebe8bcd155fb5e90557c7eec2b6832233bb0573b29
+  data.tar.gz: d1bd4ff99ae3fd8319a796cf04ba3a859c084cd465013cd5a1c8b106969a8183
 SHA512:
-  metadata.gz: 0ca40a2a42e55b376edc0694253f81a54eb30d75748c3a5572e3a754b64aab96fe86b34f753d0f4566bdf66816da3318aed0eba31fc195581cb2072f89c0d8cb
-  data.tar.gz: 115640e60d1b2a59edb5b6956c9e8d3c35105dafa6ce00d60aa5de52561da96670606af7862d1a24ab1f24bc4fd91651b4856eeb4b7fc545ca230cc72a529493
+  metadata.gz: 4b1c5c0ed9ca379e3c209c21dbc047e7364a9c3f7eda956ebd11a6f0f44b5a3a3e5a7fe9493ccafe82ac98bad132ab2323a56817c2f234c135814282cd229c30
+  data.tar.gz: c0f297752cb28d6c32df1261ab10199a5f39e17af23f3c3e46ed76aafd59785e79cd43c81e1a164b8fe92b9f7763f50e3d2c4a8d34c9bb59a4976d0e6eb44be4

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Analyze.cs

@@ -134,6 +134,179 @@ public partial class EntryPointTests
             );
         }
 
+        [Fact]
+        public async Task DotNetToolsJsonCanBeAnalyzed()
+        {
+            var repoMetadata = XElement.Parse("""<repository type="git" url="https://nuget.example.com/some-global-tool" />""");
+            await RunAsync(path =>
+                [
+                    "analyze",
+                    "--repo-root",
+                    path,
+                    "--discovery-file-path",
+                    Path.Join(path, "discovery.json"),
+                    "--dependency-file-path",
+                    Path.Join(path, "some-global-tool.json"),
+                    "--analysis-folder-path",
+                    Path.Join(path, AnalyzeWorker.AnalysisDirectoryName),
+                    "--verbose",
+                ],
+                packages:
+                [
+                    MockNuGetPackage.CreateDotNetToolPackage("some-global-tool", "1.0.0", "net8.0", additionalMetadata: [repoMetadata]),
+                    MockNuGetPackage.CreateDotNetToolPackage("some-global-tool", "1.1.0", "net8.0", additionalMetadata: [repoMetadata]),
+                ],
+                dependencyName: "some-global-tool",
+                initialFiles:
+                [
+                    (".config/dotnet-tools.json", """
+                        {
+                          "version": 1,
+                          "isRoot": true,
+                          "tools": {
+                            "some-global-tool": {
+                              "version": "1.0.0",
+                              "commands": [
+                                "some-global-tool"
+                              ]
+                            }
+                          }
+                        }
+                        """),
+                    ("discovery.json", """
+                        {
+                          "Path": "",
+                          "IsSuccess": true,
+                          "Projects": [],
+                          "DotNetToolsJson": {
+                            "FilePath": ".config/dotnet-tools.json",
+                            "IsSuccess": true,
+                            "Dependencies": [
+                              {
+                                "Name": "some-global-tool",
+                                "Version": "1.0.0",
+                                "Type": "DotNetTool",
+                                "EvaluationResult": null,
+                                "TargetFrameworks": null,
+                                "IsDevDependency": false,
+                                "IsDirect": false,
+                                "IsTransitive": false,
+                                "IsOverride": false,
+                                "IsUpdate": false,
+                                "InfoUrl": null
+                              }
+                            ]
+                          }
+                        }
+                        """),
+                    ("some-global-tool.json", """
+                        {
+                          "Name": "some-global-tool",
+                          "Version": "1.0.0",
+                          "IsVulnerable": false,
+                          "IgnoredVersions": [],
+                          "Vulnerabilities": []
+                        }
+                        """),
+                ],
+                expectedResult: new()
+                {
+                    UpdatedVersion = "1.1.0",
+                    CanUpdate = true,
+                    VersionComesFromMultiDependencyProperty = false,
+                    UpdatedDependencies =
+                    [
+                        new Dependency("some-global-tool", "1.1.0", DependencyType.DotNetTool, TargetFrameworks: null, IsDirect: true, InfoUrl: "https://nuget.example.com/some-global-tool")
+                    ],
+                }
+            );
+        }
+
+        [Fact]
+        public async Task GlobalJsonCanBeAnalyzed()
+        {
+            var repoMetadata = XElement.Parse("""<repository type="git" url="https://nuget.example.com/some.msbuild.sdk" />""");
+            await RunAsync(path =>
+                [
+                    "analyze",
+                    "--repo-root",
+                    path,
+                    "--discovery-file-path",
+                    Path.Join(path, "discovery.json"),
+                    "--dependency-file-path",
+                    Path.Join(path, "Some.MSBuild.Sdk.json"),
+                    "--analysis-folder-path",
+                    Path.Join(path, AnalyzeWorker.AnalysisDirectoryName),
+                    "--verbose",
+                ],
+                packages:
+                [
+                    MockNuGetPackage.CreateMSBuildSdkPackage("Some.MSBuild.Sdk", "1.0.0", "net8.0", additionalMetadata: [repoMetadata]),
+                    MockNuGetPackage.CreateMSBuildSdkPackage("Some.MSBuild.Sdk", "1.1.0", "net8.0", additionalMetadata: [repoMetadata]),
+                ],
+                dependencyName: "Some.MSBuild.Sdk",
+                initialFiles:
+                [
+                    ("global.json", """
+                        {
+                          "sdk": {
+                            "version": "8.0.300",
+                            "rollForward": "latestPatch"
+                          },
+                          "msbuild-sdks": {
+                            "Some.MSBuild.Sdk": "1.0.0"
+                          }
+                        }
+                        """),
+                    ("discovery.json", """
+                        {
+                          "Path": "",
+                          "IsSuccess": true,
+                          "Projects": [],
+                          "GlobalJson": {
+                            "FilePath": "global.json",
+                            "IsSuccess": true,
+                            "Dependencies": [
+                              {
+                                "Name": "Some.MSBuild.Sdk",
+                                "Version": "1.0.0",
+                                "Type": "MSBuildSdk",
+                                "EvaluationResult": null,
+                                "TargetFrameworks": null,
+                                "IsDevDependency": false,
+                                "IsDirect": false,
+                                "IsTransitive": false,
+                                "IsOverride": false,
+                                "IsUpdate": false,
+                                "InfoUrl": null
+                              }
+                            ]
+                          }
+                        }
+                        """),
+                    ("Some.MSBuild.Sdk.json", """
+                        {
+                          "Name": "Some.MSBuild.Sdk",
+                          "Version": "1.0.0",
+                          "IsVulnerable": false,
+                          "IgnoredVersions": [],
+                          "Vulnerabilities": []
+                        }
+                        """),
+                ],
+                expectedResult: new()
+                {
+                    UpdatedVersion = "1.1.0",
+                    CanUpdate = true,
+                    VersionComesFromMultiDependencyProperty = false,
+                    UpdatedDependencies =
+                    [
+                        new Dependency("Some.MSBuild.Sdk", "1.1.0", DependencyType.MSBuildSdk, TargetFrameworks: null, IsDirect: true, InfoUrl: "https://nuget.example.com/some.msbuild.sdk")
+                    ],
+                }
+            );
+        }
+
         private static async Task RunAsync(Func<string, string[]> getArgs, string dependencyName, TestFile[] initialFiles, ExpectedAnalysisResult expectedResult, MockNuGetPackage[]? packages = null)
         {
             var actualResult = await RunAnalyzerAsync(dependencyName, initialFiles, async path =>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/AnalyzeWorker.cs

@@ -51,23 +51,21 @@ public partial class AnalyzeWorker
             => p.Dependencies.Where(d => !d.IsTransitive &&
                 d.EvaluationResult?.RootPropertyName is not null)
             ).ToImmutableArray();
+        var dotnetToolsHasDependency = discovery.DotNetToolsJson?.Dependencies.Any(d => d.Name.Equals(dependencyInfo.Name, StringComparison.OrdinalIgnoreCase)) == true;
+        var globalJsonHasDependency = discovery.GlobalJson?.Dependencies.Any(d => d.Name.Equals(dependencyInfo.Name, StringComparison.OrdinalIgnoreCase)) == true;
 
         bool usesMultiDependencyProperty = false;
         NuGetVersion? updatedVersion = null;
         ImmutableArray<Dependency> updatedDependencies = [];
 
-        bool isUpdateNecessary = IsUpdateNecessary(dependencyInfo, projectsWithDependency);
+        bool isProjectUpdateNecessary = IsUpdateNecessary(dependencyInfo, projectsWithDependency);
+        var isUpdateNecessary = isProjectUpdateNecessary || dotnetToolsHasDependency || globalJsonHasDependency;
         using var nugetContext = new NuGetContext(startingDirectory);
         AnalysisResult result;
         try
         {
             if (isUpdateNecessary)
             {
-                if (!Directory.Exists(nugetContext.TempPackageDirectory))
-                {
-                    Directory.CreateDirectory(nugetContext.TempPackageDirectory);
-                }
-
                 _logger.Log($"  Determining multi-dependency property.");
                 var multiDependencies = DetermineMultiDependencyDetails(
                     discovery,
@@ -99,16 +97,35 @@ public partial class AnalyzeWorker
                     CancellationToken.None);
 
                 _logger.Log($"  Finding updated peer dependencies.");
-                updatedDependencies = updatedVersion is not null
-                    ? await FindUpdatedDependenciesAsync(
+                if (updatedVersion is null)
+                {
+                    updatedDependencies = [];
+                }
+                else if (isProjectUpdateNecessary)
+                {
+                    updatedDependencies = await FindUpdatedDependenciesAsync(
                         repoRoot,
                         discovery,
                         dependenciesToUpdate,
                         updatedVersion,
                         nugetContext,
                         _logger,
-                        CancellationToken.None)
-                    : [];
+                        CancellationToken.None);
+                }
+                else if (dotnetToolsHasDependency)
+                {
+                    var infoUrl = await nugetContext.GetPackageInfoUrlAsync(dependencyInfo.Name, updatedVersion.ToNormalizedString(), CancellationToken.None);
+                    updatedDependencies = [new Dependency(dependencyInfo.Name, updatedVersion.ToNormalizedString(), DependencyType.DotNetTool, IsDirect: true, InfoUrl: infoUrl)];
+                }
+                else if (globalJsonHasDependency)
+                {
+                    var infoUrl = await nugetContext.GetPackageInfoUrlAsync(dependencyInfo.Name, updatedVersion.ToNormalizedString(), CancellationToken.None);
+                    updatedDependencies = [new Dependency(dependencyInfo.Name, updatedVersion.ToNormalizedString(), DependencyType.MSBuildSdk, IsDirect: true, InfoUrl: infoUrl)];
+                }
+                else
+                {
+                    throw new InvalidOperationException("Unreachable.");
+                }
 
                 //TODO: At this point we should add the peer dependencies to a queue where
                 // we will analyze them one by one to see if they themselves are part of a

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/NuGetContext.cs

@@ -37,12 +37,23 @@ internal record NuGetContext : IDisposable
             .Where(p => p.IsEnabled)
             .ToImmutableArray();
         Logger = logger ?? NullLogger.Instance;
-        TempPackageDirectory = Path.Combine(Path.GetTempPath(), ".dependabot", "packages");
+        TempPackageDirectory = Path.Combine(Path.GetTempPath(), $"dependabot-packages_{Guid.NewGuid():d}");
+        Directory.CreateDirectory(TempPackageDirectory);
     }
 
     public void Dispose()
     {
         SourceCacheContext.Dispose();
+        if (Directory.Exists(TempPackageDirectory))
+        {
+            try
+            {
+                Directory.Delete(TempPackageDirectory, recursive: true);
+            }
+            catch
+            {
+            }
+        }
     }
 
     private readonly Dictionary<PackageIdentity, string?> _packageInfoUrlCache = new();

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/Requirement.cs

@@ -12,7 +12,59 @@ namespace NuGetUpdater.Core.Analyze;
 /// See Gem::Version for a description on how versions and requirements work
 /// together in RubyGems.
 /// </remarks>
-public class Requirement
+public abstract class Requirement
+{
+    public abstract bool IsSatisfiedBy(NuGetVersion version);
+
+    private static readonly Dictionary<string, Version> BumpMap = [];
+    /// <summary>
+    /// Return a new version object where the next to the last revision
+    /// number is one greater (e.g., 5.3.1 => 5.4).
+    /// </summary>
+    /// <remarks>
+    /// This logic intended to be similar to RubyGems Gem::Version#bump
+    /// </remarks>
+    public static Version Bump(NuGetVersion version)
+    {
+        if (BumpMap.TryGetValue(version.OriginalVersion!, out var bumpedVersion))
+        {
+            return bumpedVersion;
+        }
+
+        var versionParts = version.OriginalVersion! // Get the original string this version was created from
+            .Split('-')[0] // Get the version part without pre-release
+            .Split('.') // Split into Major.Minor.Patch.Revision if present
+            .Select(int.Parse)
+            .ToArray();
+
+        if (versionParts.Length > 1)
+        {
+            versionParts = versionParts[..^1]; // Remove the last part
+        }
+
+        versionParts[^1]++; // Increment the new last part
+
+        bumpedVersion = NuGetVersion.Parse(string.Join('.', versionParts)).Version;
+        BumpMap[version.OriginalVersion!] = bumpedVersion;
+
+        return bumpedVersion;
+    }
+
+    public static Requirement Parse(string requirement)
+    {
+        var specificParts = requirement.Split(',');
+        if (specificParts.Length == 1)
+        {
+            return IndividualRequirement.ParseIndividual(requirement);
+        }
+
+        var specificRequirements = specificParts.Select(IndividualRequirement.ParseIndividual).ToArray();
+        return new MultiPartRequirement(specificRequirements);
+    }
+}
+
+
+public class IndividualRequirement : Requirement
 {
     private static readonly ImmutableDictionary<string, Func<NuGetVersion, NuGetVersion, bool>> Operators = new Dictionary<string, Func<NuGetVersion, NuGetVersion, bool>>()
     {
@@ -25,30 +77,10 @@ public class Requirement
         ["~>"] = (v, r) => v >= r && v.Version < Bump(r),
     }.ToImmutableDictionary();
 
-    public static Requirement Parse(string requirement)
-    {
-        var splitIndex = requirement.LastIndexOfAny(['=', '>', '<']);
-
-        // Throw if the requirement is all operator and no version.
-        if (splitIndex == requirement.Length - 1)
-        {
-            throw new ArgumentException($"`{requirement}` is a invalid requirement string", nameof(requirement));
-        }
-
-        string[] parts = splitIndex == -1
-            ? [requirement.Trim()]
-            : [requirement[..(splitIndex + 1)].Trim(), requirement[(splitIndex + 1)..].Trim()];
-
-        var op = parts.Length == 1 ? "=" : parts[0];
-        var version = NuGetVersion.Parse(parts[^1]);
-
-        return new Requirement(op, version);
-    }
-
     public string Operator { get; }
     public NuGetVersion Version { get; }
 
-    public Requirement(string op, NuGetVersion version)
+    public IndividualRequirement(string op, NuGetVersion version)
     {
         if (!Operators.ContainsKey(op))
         {
@@ -64,42 +96,53 @@ public class Requirement
         return $"{Operator} {Version}";
     }
 
-    public bool IsSatisfiedBy(NuGetVersion version)
+    public override bool IsSatisfiedBy(NuGetVersion version)
     {
         return Operators[Operator](version, Version);
     }
 
-    private static readonly Dictionary<string, Version> BumpMap = [];
-    /// <summary>
-    /// Return a new version object where the next to the last revision
-    /// number is one greater (e.g., 5.3.1 => 5.4).
-    /// </summary>
-    /// <remarks>
-    /// This logic intended to be similar to RubyGems Gem::Version#bump
-    /// </remarks>
-    public static Version Bump(NuGetVersion version)
+    public static IndividualRequirement ParseIndividual(string requirement)
     {
-        if (BumpMap.TryGetValue(version.OriginalVersion!, out var bumpedVersion))
+        var splitIndex = requirement.LastIndexOfAny(['=', '>', '<']);
+
+        // Throw if the requirement is all operator and no version.
+        if (splitIndex == requirement.Length - 1)
         {
-            return bumpedVersion;
+            throw new ArgumentException($"`{requirement}` is a invalid requirement string", nameof(requirement));
         }
 
-        var versionParts = version.OriginalVersion! // Get the original string this version was created from
-            .Split('-')[0] // Get the version part without pre-release
-            .Split('.') // Split into Major.Minor.Patch.Revision if present
-            .Select(int.Parse)
-            .ToArray();
+        string[] parts = splitIndex == -1
+            ? [requirement.Trim()]
+            : [requirement[..(splitIndex + 1)].Trim(), requirement[(splitIndex + 1)..].Trim()];
 
-        if (versionParts.Length > 1)
+        var op = parts.Length == 1 ? "=" : parts[0];
+        var version = NuGetVersion.Parse(parts[^1]);
+
+        return new IndividualRequirement(op, version);
+    }
+}
+
+public class MultiPartRequirement : Requirement
+{
+    public ImmutableArray<IndividualRequirement> Parts { get; }
+
+    public MultiPartRequirement(IndividualRequirement[] parts)
+    {
+        if (parts.Length <= 1)
         {
-            versionParts = versionParts[..^1]; // Remove the last part
+            throw new ArgumentException("At least two parts are required", nameof(parts));
         }
 
-        versionParts[^1]++; // Increment the new last part
+        Parts = parts.ToImmutableArray();
+    }
 
-        bumpedVersion = NuGetVersion.Parse(string.Join('.', versionParts)).Version;
-        BumpMap[version.OriginalVersion!] = bumpedVersion;
+    public override string ToString()
+    {
+        return string.Join(", ", Parts);
+    }
 
-        return bumpedVersion;
+    public override bool IsSatisfiedBy(NuGetVersion version)
+    {
+        return Parts.All(part => part.IsSatisfiedBy(version));
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/ErrorType.cs

@@ -5,4 +5,5 @@ public enum ErrorType
     // TODO: add `Unknown` option to track all other failure types
     None,
     AuthenticationFailure,
+    MissingFile,
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/MissingFileException.cs

@@ -0,0 +1,11 @@
+namespace NuGetUpdater.Core;
+
+internal class MissingFileException : Exception
+{
+    public string FilePath { get; }
+
+    public MissingFileException(string filePath)
+    {
+        FilePath = filePath;
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs

@@ -149,42 +149,6 @@ internal static class BindingRedirectManager
             return (element.Name == "None" && string.Equals(path, "app.config", StringComparison.OrdinalIgnoreCase))
                    || (element.Name == "Content" && string.Equals(path, "web.config", StringComparison.OrdinalIgnoreCase));
         }
-
-        static string GetConfigFileName(XmlDocumentSyntax document)
-        {
-            var guidValue = document.Descendants()
-                .Where(static x => x.Name == "PropertyGroup")
-                .SelectMany(static x => x.Elements.Where(static x => x.Name == "ProjectGuid"))
-                .FirstOrDefault()
-                ?.GetContentValue();
-            return guidValue switch
-            {
-                "{E24C65DC-7377-472B-9ABA-BC803B73C61A}" or "{349C5851-65DF-11DA-9384-00065B846F21}" => "Web.config",
-                _ => "App.config"
-            };
-        }
-
-        static string GenerateDefaultAppConfig(XmlDocumentSyntax document)
-        {
-            var frameworkVersion = GetFrameworkVersion(document);
-            return $"""
-                <?xml version="1.0" encoding="utf-8" ?>
-                <configuration>
-                    <startup>
-                        <supportedRuntime version="v4.0" sku=".NETFramework,Version={frameworkVersion}" />
-                    </startup>
-                </configuration>
-                """;
-        }
-
-        static string? GetFrameworkVersion(XmlDocumentSyntax document)
-        {
-            return document.Descendants()
-                .Where(static x => x.Name == "PropertyGroup")
-                .SelectMany(static x => x.Elements.Where(static x => x.Name == "TargetFrameworkVersion"))
-                .FirstOrDefault()
-                ?.GetContentValue();
-        }
     }
 
     private static string AddBindingRedirects(ConfigurationFile configFile, IEnumerable<Runtime_AssemblyBinding> bindingRedirects)
@@ -213,10 +177,24 @@ internal static class BindingRedirectManager
 
         foreach (var bindingRedirect in bindingRedirects)
         {
-            // Look to see if we already have this in the list of bindings already in config.
-            if (currentBindings.TryGetValue((bindingRedirect.Name, bindingRedirect.PublicKeyToken), out var existingBinding))
+            // If the binding redirect already exists in config, update it. Otherwise, add it.
+            var bindingAssemblyIdentity = new AssemblyIdentity(bindingRedirect.Name, bindingRedirect.PublicKeyToken);
+            if (currentBindings.Contains(bindingAssemblyIdentity))
             {
-                UpdateBindingRedirectElement(existingBinding, bindingRedirect);
+                // Check if there are multiple bindings in config for this assembly and remove all but the first one.
+                // Normally there should only be one binding per assembly identity unless the config is malformed, which we'll fix here like NuGet.exe would.
+                var existingBindings = currentBindings[bindingAssemblyIdentity];
+                if (existingBindings.Any())
+                {
+                    // Remove all but the first element
+                    foreach (var bindingElement in existingBindings.Skip(1))
+                    {
+                        RemoveElement(bindingElement);
+                    }
+
+                    // Update the first one with the new binding
+                    UpdateBindingRedirectElement(existingBindings.First(), bindingRedirect);
+                }
             }
             else
             {
@@ -228,7 +206,10 @@ internal static class BindingRedirectManager
             }
         }
 
-        return document.ToString();
+        return string.Concat(
+            document.Declaration?.ToString() ?? String.Empty, // Ensure the <?xml> declaration node is preserved, if present
+            document.ToString()
+        );
 
         static XDocument GetConfiguration(string configFileContent)
         {
@@ -278,7 +259,7 @@ internal static class BindingRedirectManager
             }
         }
 
-        static Dictionary<(string Name, string PublicKeyToken), XElement> GetAssemblyBindings(XElement runtime)
+        static ILookup<AssemblyIdentity, XElement> GetAssemblyBindings(XElement runtime)
         {
             var dependencyAssemblyElements = runtime.Elements(AssemblyBindingName)
                 .Elements(DependentAssemblyName);
@@ -291,7 +272,12 @@ internal static class BindingRedirectManager
             });
 
             // Return a mapping from binding to element
-            return assemblyElementPairs.ToDictionary(p => (p.Binding.Name, p.Binding.PublicKeyToken), p => p.Element);
+            // It is possible that multiple elements exist for the same assembly identity, so use a lookup (1:*) instead of a dictionary (1:1) 
+            return assemblyElementPairs.ToLookup(
+                p => new AssemblyIdentity(p.Binding.Name, p.Binding.PublicKeyToken),
+                p => p.Element,
+                new AssemblyIdentityIgnoreCaseComparer()
+            );
         }
 
         static XElement GetAssemblyBindingElement(XElement runtime)
@@ -309,4 +295,21 @@ internal static class BindingRedirectManager
             return assemblyBinding;
         }
     }
+
+    internal sealed record AssemblyIdentity(string Name, string PublicKeyToken);
+
+    // Case-insensitive comparer. This helps avoid creating duplicate binding redirects when there is a case form mismatch between assembly identities.
+    // Especially important for PublicKeyToken which is typically lowercase (using NuGet.exe), but can also be uppercase when using other tools (e.g. Visual Studio auto-resolve assembly conflicts feature).
+    internal sealed class AssemblyIdentityIgnoreCaseComparer : IEqualityComparer<AssemblyIdentity>
+    {
+        public bool Equals(AssemblyIdentity? x, AssemblyIdentity? y) =>
+            string.Equals(x?.Name, y?.Name, StringComparison.OrdinalIgnoreCase) &&
+            string.Equals(x?.PublicKeyToken, y?.PublicKeyToken, StringComparison.OrdinalIgnoreCase);
+
+        public int GetHashCode(AssemblyIdentity obj) =>
+            HashCode.Combine(
+                obj.Name?.ToLowerInvariant(),
+                obj.PublicKeyToken?.ToLowerInvariant()
+            );
+    }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs

@@ -146,6 +146,7 @@ internal static class PackagesConfigUpdater
                 }
 
                 MSBuildHelper.ThrowOnUnauthenticatedFeed(fullOutput);
+                MSBuildHelper.ThrowOnMissingFile(fullOutput);
                 throw new Exception(fullOutput);
             }
         }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdaterWorker.cs

@@ -73,6 +73,14 @@ public class UpdaterWorker
                 ErrorDetails = "(" + string.Join("|", NuGetContext.GetPackageSourceUrls(workspacePath)) + ")",
             };
         }
+        catch (MissingFileException ex)
+        {
+            result = new()
+            {
+                ErrorType = ErrorType.MissingFile,
+                ErrorDetails = ex.FilePath,
+            };
+        }
 
         _processedProjectPaths.Clear();
         if (resultOutputPath is { })

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -620,6 +620,16 @@ internal static partial class MSBuildHelper
         }
     }
 
+    internal static void ThrowOnMissingFile(string output)
+    {
+        var missingFilePattern = new Regex(@"The imported project \""(?<FilePath>.*)\"" was not found");
+        var match = missingFilePattern.Match(output);
+        if (match.Success)
+        {
+            throw new MissingFileException(match.Groups["FilePath"].Value);
+        }
+    }
+
     internal static bool TryGetGlobalJsonPath(string repoRootPath, string workspacePath, [NotNullWhen(returnValue: true)] out string? globalJsonPath)
     {
         globalJsonPath = PathHelper.GetFileInDirectoryOrParent(workspacePath, repoRootPath, "global.json", caseSensitive: false);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs

@@ -390,6 +390,8 @@ public partial class AnalyzeWorkerTests : AnalyzeWorkerTestBase
                             </m:properties>
                         </entry>
                         """));
+                case "/api/v2/package/Some.Package/1.0.0":
+                    return (200, MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0").GetZipStream().ReadAllBytes());
                 case "/api/v2/package/Some.Package/1.2.3":
                     return (200, MockNuGetPackage.CreateSimplePackage("Some.Package", "1.2.3", "net8.0").GetZipStream().ReadAllBytes());
                 case "/api/v2/FindPackagesById()?id='Microsoft.WindowsDesktop.App.Ref'&semVerLevel=2.0.0":

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/RequirementTests.cs

@@ -32,6 +32,7 @@ public class RequirementTests
     [InlineData("2.0", "~> 1.0", false)]
     [InlineData("1", "~> 1", true)]
     [InlineData("2", "~> 1", false)]
+    [InlineData("5.3.8", "< 6, > 5.2.4", true)]
     public void IsSatisfiedBy(string versionString, string requirementString, bool expected)
     {
         var version = NuGetVersion.Parse(versionString);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/MockNuGetPackage.cs

@@ -1,3 +1,4 @@
+using System.Collections.Immutable;
 using System.IO.Compression;
 using System.Security.Cryptography;
 using System.Text;
@@ -95,7 +96,7 @@ namespace NuGetUpdater.Core.Test
         /// Creates a mock NuGet package with a single assembly in the appropriate `lib/` directory.  The assembly will
         /// contain the appropriate `AssemblyVersion` attribute and nothing else.
         /// </summary>
-        public static MockNuGetPackage CreatePackageWithAssembly(string id, string version, string targetFramework, string assemblyVersion, (string? TargetFramework, (string Id, string Version)[] Packages)[]? dependencyGroups = null)
+        public static MockNuGetPackage CreatePackageWithAssembly(string id, string version, string targetFramework, string assemblyVersion, ImmutableArray<byte>? assemblyPublicKey = null, (string? TargetFramework, (string Id, string Version)[] Packages)[]? dependencyGroups = null)
         {
             return new(
                 id,
@@ -104,7 +105,7 @@ namespace NuGetUpdater.Core.Test
                 DependencyGroups: dependencyGroups,
                 Files:
                 [
-                    ($"lib/{targetFramework}/{id}.dll", CreateAssembly(id, assemblyVersion))
+                    ($"lib/{targetFramework}/{id}.dll", CreateAssembly(id, assemblyVersion, assemblyPublicKey))
                 ]
             );
         }
@@ -130,19 +131,14 @@ namespace NuGetUpdater.Core.Test
             );
         }
 
-        public static MockNuGetPackage CreateDotNetToolPackage(string id, string version, string targetFramework)
+        public static MockNuGetPackage CreateDotNetToolPackage(string id, string version, string targetFramework, XElement[]? additionalMetadata = null)
         {
+            var packageMetadata = new XElement("packageTypes", new XElement("packageType", new XAttribute("name", "DotnetTool")));
+            var allMetadata = new[] { packageMetadata }.Concat(additionalMetadata ?? []).ToArray();
             return new(
                 id,
                 version,
-                AdditionalMetadata:
-                [
-                    new XElement("packageTypes",
-                        new XElement("packageType",
-                            new XAttribute("name", "DotnetTool")
-                        )
-                    )
-                ],
+                AdditionalMetadata: allMetadata,
                 Files:
                 [
                     ($"tools/{targetFramework}/any/DotnetToolSettings.xml", Encoding.UTF8.GetBytes($"""
@@ -157,8 +153,10 @@ namespace NuGetUpdater.Core.Test
             );
         }
 
-        public static MockNuGetPackage CreateMSBuildSdkPackage(string id, string version, string? sdkPropsContent = null, string? sdkTargetsContent = null)
+        public static MockNuGetPackage CreateMSBuildSdkPackage(string id, string version, string? sdkPropsContent = null, string? sdkTargetsContent = null, XElement[]? additionalMetadata = null)
         {
+            var packageMetadata = new XElement("packageTypes", new XElement("packageType", new XAttribute("name", "MSBuildSdk")));
+            var allMetadata = new[] { packageMetadata }.Concat(additionalMetadata ?? []).ToArray();
             sdkPropsContent ??= """
                 <Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
                 </Project>
@@ -170,14 +168,7 @@ namespace NuGetUpdater.Core.Test
             return new(
                 id,
                 version,
-                AdditionalMetadata:
-                [
-                    new XElement("packageTypes",
-                        new XElement("packageType",
-                            new XAttribute("name", "MSBuildSdk")
-                        )
-                    )
-                ],
+                AdditionalMetadata: additionalMetadata,
                 Files:
                 [
                     ("Sdk/Sdk.props", Encoding.UTF8.GetBytes(sdkPropsContent)),
@@ -271,9 +262,13 @@ namespace NuGetUpdater.Core.Test
             return _stream;
         }
 
-        private static byte[] CreateAssembly(string assemblyName, string assemblyVersion)
+        private static byte[] CreateAssembly(string assemblyName, string assemblyVersion, ImmutableArray<byte>? assemblyPublicKey = null)
         {
             CSharpCompilationOptions compilationOptions = new(OutputKind.DynamicallyLinkedLibrary);
+            if (assemblyPublicKey is not null)
+            {
+                compilationOptions = compilationOptions.WithCryptoPublicKey(assemblyPublicKey.Value);
+            }
             CSharpCompilation compilation = CSharpCompilation.Create(assemblyName, options: compilationOptions)
                 .AddReferences(MetadataReference.CreateFromFile(typeof(object).Assembly.Location))
                 .AddSyntaxTrees(CSharpSyntaxTree.ParseText($"[assembly: System.Reflection.AssemblyVersionAttribute(\"{assemblyVersion}\")]"));

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.PackagesConfig.cs

@@ -1,3 +1,6 @@
+using System.Collections.Immutable;
+using System.Text.Json;
+
 using NuGetUpdater.Core.Updater;
 
 using Xunit;
@@ -1013,6 +1016,307 @@ public partial class UpdateWorkerTests
             );
         }
 
+        [Fact]
+        public async Task UpdateBindingRedirect_DuplicateRedirectsForTheSameAssemblyAreRemoved()
+        {
+            await TestUpdateForProject("Some.Package", "7.0.1", "13.0.1",
+                packages:
+                [
+                    MockNuGetPackage.CreatePackageWithAssembly("Some.Package", "7.0.1", "net45", "7.0.0.0"),
+                    MockNuGetPackage.CreatePackageWithAssembly("Some.Package", "13.0.1", "net45", "13.0.0.0"),
+                ],
+                projectContents: """
+                    <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                      <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                      <PropertyGroup>
+                        <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <None Include="packages.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <None Include="app.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <Reference Include="Some.Package, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null">
+                          <HintPath>packages\Some.Package.7.0.1\lib\net45\Some.Package.dll</HintPath>
+                          <Private>True</Private>
+                        </Reference>
+                      </ItemGroup>
+                      <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                    </Project>
+                    """,
+                packagesConfigContents: """
+                    <packages>
+                      <package id="Some.Package" version="7.0.1" targetFramework="net45" />
+                    </packages>
+                    """,
+                additionalFiles:
+                [
+                    ("app.config", """
+                        <configuration>
+                          <runtime>
+                            <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+                              <dependentAssembly>
+                                <assemblyIdentity name="Some.Package" publicKeyToken="null" culture="neutral" />
+                                <bindingRedirect oldVersion="0.0.0.0-7.0.0.0" newVersion="7.0.0.0" />
+                              </dependentAssembly>
+                              <dependentAssembly>
+                                <assemblyIdentity name="Some.Package" publicKeyToken="null" culture="neutral" />
+                                <bindingRedirect oldVersion="0.0.0.0-7.0.0.0" newVersion="7.0.0.0" />
+                              </dependentAssembly>
+                            </assemblyBinding>
+                          </runtime>
+                        </configuration>
+                        """)
+                ],
+                expectedProjectContents: """
+                    <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                      <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                      <PropertyGroup>
+                        <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <None Include="packages.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <None Include="app.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <Reference Include="Some.Package, Version=13.0.0.0, Culture=neutral, PublicKeyToken=null">
+                          <HintPath>packages\Some.Package.13.0.1\lib\net45\Some.Package.dll</HintPath>
+                          <Private>True</Private>
+                        </Reference>
+                      </ItemGroup>
+                      <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                    </Project>
+                    """,
+                expectedPackagesConfigContents: """
+                    <?xml version="1.0" encoding="utf-8"?>
+                    <packages>
+                      <package id="Some.Package" version="13.0.1" targetFramework="net45" />
+                    </packages>
+                    """,
+                additionalFilesExpected:
+                [
+                    ("app.config", """
+                        <configuration>
+                          <runtime>
+                            <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+                              <dependentAssembly>
+                                <assemblyIdentity name="Some.Package" publicKeyToken="null" culture="neutral" />
+                                <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
+                              </dependentAssembly>
+                            </assemblyBinding>
+                          </runtime>
+                        </configuration>
+                        """)
+                ]
+            );
+        }
+
+        [Fact]
+        public async Task UpdateBindingRedirect_ExistingRedirectForAssemblyPublicKeyTokenDiffersByCase()
+        {
+            // Generated using "sn -k keypair.snk && sn -p keypair.snk public.snk" then converting public.snk to base64
+            // https://learn.microsoft.com/en-us/dotnet/standard/assembly/create-public-private-key-pair
+            var assemblyStrongNamePublicKey = Convert.FromBase64String(
+              "ACQAAASAAACUAAAABgIAAAAkAABSU0ExAAQAAAEAAQAJJW4hmKpxa9pU0JPDvJ9KqjvfQuMUovGtFjkZ9b0i1KQ/7kqEOjW3Va0eGpU7Kz0qHp14iYQ3SsMzBZU3mZ2Ezeqg+dCVuDk7o2lp++4m1FstHsebtXBetyOzWkneo+3iKSzOQ7bOXj2s5M9umqRPk+yj0ZBILf+HvfAd07iIuQ=="
+            ).ToImmutableArray();
+
+            await TestUpdateForProject("Some.Package", "7.0.1", "13.0.1",
+                packages:
+                [
+                    MockNuGetPackage.CreatePackageWithAssembly("Some.Package", "7.0.1", "net45", "7.0.0.0", assemblyPublicKey: assemblyStrongNamePublicKey),
+                    MockNuGetPackage.CreatePackageWithAssembly("Some.Package", "13.0.1", "net45", "13.0.0.0", assemblyPublicKey: assemblyStrongNamePublicKey),
+                ],
+                projectContents: """
+                    <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                      <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                      <PropertyGroup>
+                        <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <None Include="packages.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <None Include="app.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <Reference Include="Some.Package, Version=7.0.0.0, Culture=neutral, PublicKeyToken=13523fc3be375af1">
+                          <HintPath>packages\Some.Package.7.0.1\lib\net45\Some.Package.dll</HintPath>
+                          <Private>True</Private>
+                        </Reference>
+                      </ItemGroup>
+                      <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                    </Project>
+                    """,
+                packagesConfigContents: """
+                    <packages>
+                      <package id="Some.Package" version="7.0.1" targetFramework="net45" />
+                    </packages>
+                    """,
+                additionalFiles:
+                [
+                    ("app.config", """
+                        <configuration>
+                          <runtime>
+                            <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+                              <dependentAssembly>
+                                <assemblyIdentity name="Some.Package" publicKeyToken="13523FC3BE375AF1" culture="neutral" />
+                                <bindingRedirect oldVersion="0.0.0.0-7.0.0.0" newVersion="7.0.0.0" />
+                              </dependentAssembly>
+                            </assemblyBinding>
+                          </runtime>
+                        </configuration>
+                        """)
+                ],
+                expectedProjectContents: """
+                    <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                      <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                      <PropertyGroup>
+                        <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <None Include="packages.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <None Include="app.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <Reference Include="Some.Package, Version=13.0.0.0, Culture=neutral, PublicKeyToken=13523fc3be375af1">
+                          <HintPath>packages\Some.Package.13.0.1\lib\net45\Some.Package.dll</HintPath>
+                          <Private>True</Private>
+                        </Reference>
+                      </ItemGroup>
+                      <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                    </Project>
+                    """,
+                expectedPackagesConfigContents: """
+                    <?xml version="1.0" encoding="utf-8"?>
+                    <packages>
+                      <package id="Some.Package" version="13.0.1" targetFramework="net45" />
+                    </packages>
+                    """,
+                additionalFilesExpected:
+                [
+                    ("app.config", """
+                        <configuration>
+                          <runtime>
+                            <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+                              <dependentAssembly>
+                                <assemblyIdentity name="Some.Package" publicKeyToken="13523FC3BE375AF1" culture="neutral" />
+                                <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
+                              </dependentAssembly>
+                            </assemblyBinding>
+                          </runtime>
+                        </configuration>
+                        """)
+                ]
+            );
+        }
+
+        [Fact]
+        public async Task UpdateBindingRedirect_ConfigXmlDeclarationNodeIsPreserved()
+        {
+            await TestUpdateForProject("Some.Package", "7.0.1", "13.0.1",
+                packages:
+                [
+                    MockNuGetPackage.CreatePackageWithAssembly("Some.Package", "7.0.1", "net45", "7.0.0.0"),
+                    MockNuGetPackage.CreatePackageWithAssembly("Some.Package", "13.0.1", "net45", "13.0.0.0"),
+                ],
+                projectContents: """
+                    <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                      <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                      <PropertyGroup>
+                        <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <None Include="packages.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <None Include="app.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <Reference Include="Some.Package, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null">
+                          <HintPath>packages\Some.Package.7.0.1\lib\net45\Some.Package.dll</HintPath>
+                          <Private>True</Private>
+                        </Reference>
+                      </ItemGroup>
+                      <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                    </Project>
+                    """,
+                packagesConfigContents: """
+                    <packages>
+                      <package id="Some.Package" version="7.0.1" targetFramework="net45" />
+                    </packages>
+                    """,
+                additionalFiles:
+                [
+                    ("app.config", """
+                        <?xml version="1.0" encoding="utf-8"?>
+                        <configuration>
+                          <runtime>
+                            <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+                              <dependentAssembly>
+                                <assemblyIdentity name="Some.Package" publicKeyToken="null" culture="neutral" />
+                                <bindingRedirect oldVersion="0.0.0.0-7.0.0.0" newVersion="7.0.0.0" />
+                              </dependentAssembly>
+                              <dependentAssembly>
+                                <assemblyIdentity name="Some.Package" publicKeyToken="null" culture="neutral" />
+                                <bindingRedirect oldVersion="0.0.0.0-7.0.0.0" newVersion="7.0.0.0" />
+                              </dependentAssembly>
+                            </assemblyBinding>
+                          </runtime>
+                        </configuration>
+                        """)
+                ],
+                expectedProjectContents: """
+                    <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                      <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                      <PropertyGroup>
+                        <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <None Include="packages.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <None Include="app.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <Reference Include="Some.Package, Version=13.0.0.0, Culture=neutral, PublicKeyToken=null">
+                          <HintPath>packages\Some.Package.13.0.1\lib\net45\Some.Package.dll</HintPath>
+                          <Private>True</Private>
+                        </Reference>
+                      </ItemGroup>
+                      <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                    </Project>
+                    """,
+                expectedPackagesConfigContents: """
+                    <?xml version="1.0" encoding="utf-8"?>
+                    <packages>
+                      <package id="Some.Package" version="13.0.1" targetFramework="net45" />
+                    </packages>
+                    """,
+                additionalFilesExpected:
+                [
+                    ("app.config", """
+                        <?xml version="1.0" encoding="utf-8"?>
+                        <configuration>
+                          <runtime>
+                            <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+                              <dependentAssembly>
+                                <assemblyIdentity name="Some.Package" publicKeyToken="null" culture="neutral" />
+                                <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />
+                              </dependentAssembly>
+                            </assemblyBinding>
+                          </runtime>
+                        </configuration>
+                        """)
+                ]
+            );
+        }
+
         [Fact]
         public async Task PackagesConfigUpdateCanHappenEvenWithMismatchedVersionNumbers()
         {
@@ -1422,6 +1726,62 @@ public partial class UpdateWorkerTests
                 """);
         }
 
+        [Fact]
+        public async Task MissingTargetsAreReported()
+        {
+            using var temporaryDirectory = await TemporaryDirectory.CreateWithContentsAsync(
+                [
+                    ("project.csproj", """
+                        <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                          <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                          <Import Project="this.file.does.not.exist.targets" />
+                          <PropertyGroup>
+                            <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                          </PropertyGroup>
+                          <ItemGroup>
+                            <None Include="packages.config" />
+                          </ItemGroup>
+                          <ItemGroup>
+                            <Reference Include="Some.Package, Version=1.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed">
+                              <HintPath>packages\Some.Package.1.0.0\lib\net45\Some.Package.dll</HintPath>
+                              <Private>True</Private>
+                            </Reference>
+                          </ItemGroup>
+                          <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                        </Project>
+                        """),
+                    ("packages.config", """
+                        <packages>
+                          <package id="Some.Package" version="1.0.0" targetFramework="net45" />
+                        </packages>
+                        """),
+                    ("NuGet.Config", """
+                        <configuration>
+                          <packageSources>
+                            <clear />
+                            <add key="private_feed" value="packages" />
+                          </packageSources>
+                        </configuration>
+                        """)
+                ]
+            );
+            MockNuGetPackage[] packages =
+            [
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net45"),
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "1.1.0", "net45"),
+            ];
+            await MockNuGetPackagesInDirectory(packages, Path.Combine(temporaryDirectory.DirectoryPath, "packages"));
+            var resultOutputPath = Path.Combine(temporaryDirectory.DirectoryPath, "result.json");
+
+            var worker = new UpdaterWorker(new Logger(verbose: true));
+            await worker.RunAsync(temporaryDirectory.DirectoryPath, "project.csproj", "Some.Package", "1.0.0", "1.1.0", isTransitive: false, resultOutputPath: resultOutputPath);
+
+            var resultContents = await File.ReadAllTextAsync(resultOutputPath);
+            var result = JsonSerializer.Deserialize<UpdateOperationResult>(resultContents, UpdaterWorker.SerializerOptions)!;
+            Assert.Equal(ErrorType.MissingFile, result.ErrorType);
+            Assert.Equal(Path.Combine(temporaryDirectory.DirectoryPath, "this.file.does.not.exist.targets"), result.ErrorDetails);
+        }
+
         [Fact]
         public async Task ReportsPrivateSourceAuthenticationFailure()
         {

data/lib/dependabot/nuget/file_fetcher.rb

@@ -51,20 +51,22 @@ module Dependabot
         @fetched_files = T.let({}, T::Hash[String, T::Array[Dependabot::DependencyFile]])
         @nuget_config_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
         @packages_config_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
+        @assembly_binding_redirect_config_files = T.let(nil, T.nilable(T::Array[Dependabot::DependencyFile]))
       end
 
       sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
-        fetched_files = []
-        fetched_files += project_files
-        fetched_files += directory_build_files
-        fetched_files += imported_property_files
-
-        fetched_files += packages_config_files
-        fetched_files += nuget_config_files
-        fetched_files << global_json if global_json
-        fetched_files << dotnet_tools_json if dotnet_tools_json
-        fetched_files << packages_props if packages_props
+        fetched_files = [
+          *project_files,
+          *directory_build_files,
+          *imported_property_files,
+          *packages_config_files,
+          *assembly_binding_redirect_config_files,
+          *nuget_config_files,
+          global_json,
+          dotnet_tools_json,
+          packages_props
+        ].compact
 
         # dedup files based on their absolute path
         fetched_files = fetched_files.uniq do |fetched_file|
@@ -128,6 +130,23 @@ module Dependabot
           end
       end
 
+      sig { returns(T::Array[Dependabot::DependencyFile]) }
+      def assembly_binding_redirect_config_files
+        return @assembly_binding_redirect_config_files if @assembly_binding_redirect_config_files
+
+        candidate_paths =
+          [*project_files.map { |f| File.dirname(f.name) }, "."].uniq
+
+        # Assembly binding redirects can appear in any app/web.config file for a .NET Framework project
+        # https://learn.microsoft.com/en-us/dotnet/framework/configure-apps/redirect-assembly-versions#specify-assembly-binding-in-configuration-files
+        @assembly_binding_redirect_config_files =
+          candidate_paths.filter_map do |dir|
+            file = repo_contents(dir: dir)
+                   .find { |f| f.name.match?(/^(app|web)\.config$/i) }
+            fetch_file_from_host(File.join(dir, file.name)) if file
+          end
+      end
+
       # rubocop:disable Metrics/PerceivedComplexity
       sig { returns(T.nilable(T::Array[T.untyped])) }
       def sln_file_names

data/lib/dependabot/nuget/file_updater.rb

@@ -21,6 +21,8 @@ module Dependabot
         [
           %r{^[^/]*\.([a-z]{2})?proj$},
           /^packages\.config$/i,
+          /^app\.config$/i,
+          /^web\.config$/i,
           /^global\.json$/i,
           /^dotnet-tools\.json$/i,
           /^Directory\.Build\.props$/i,

data/lib/dependabot/nuget/native_helpers.rb

@@ -261,6 +261,8 @@ module Dependabot
           # no issue
         when "AuthenticationFailure"
           raise PrivateSourceAuthenticationFailure, error_details
+        when "MissingFile"
+          raise DependencyFileNotFound, error_details
         else
           raise "Unexpected error type from native tool: #{error_type}: #{error_details}"
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.266.0
+  version: 0.267.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-07-18 00:00:00.000000000 Z
+date: 2024-07-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.266.0
+        version: 0.267.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.266.0
+        version: 0.267.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -383,6 +383,7 @@ files:
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/FrameworkChecker/CompatabilityChecker.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/FrameworkChecker/FrameworkCompatibilityService.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/FrameworkChecker/SupportedFrameworks.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/MissingFileException.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/NativeResult.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/NuGetUpdater.Core.csproj
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Property.cs
@@ -460,7 +461,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.266.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.267.0
 post_install_message: 
 rdoc_options: []
 require_paths: