dependabot-nuget 0.266.0 → 0.268.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4669e522f1ce196d5657096bdf738e6ab353c5a697ea1b0acb1f0c87f9815a44
-  data.tar.gz: 33657445578fcd52b0370490b3c1f4b2fe165ad9f00e22d831d6a216b89458f5
+  metadata.gz: 3dbd572d869f156e22c4020848387b9b54611ad236c08be6b3ca4cce3e5e7ebc
+  data.tar.gz: f9578fc6352ff07629255fdd1bb2032cda9b0109090507fc39eed9e1b369a68d
 SHA512:
-  metadata.gz: 0ca40a2a42e55b376edc0694253f81a54eb30d75748c3a5572e3a754b64aab96fe86b34f753d0f4566bdf66816da3318aed0eba31fc195581cb2072f89c0d8cb
-  data.tar.gz: 115640e60d1b2a59edb5b6956c9e8d3c35105dafa6ce00d60aa5de52561da96670606af7862d1a24ab1f24bc4fd91651b4856eeb4b7fc545ca230cc72a529493
+  metadata.gz: 8c91cd7ef8d66d4aa48de704d70d41087ad8b6f867946f1cf59038a22f22d06febb5227e637d339fe93ec8fa5c086f8d410e16d00c3f70a4c8c348993de01c28
+  data.tar.gz: 161deea8269b8c3fe00013ef83da37e96ddedf9518e9463bdf952034a03ef00be0fac713495b4706ccbcb3d08d072aec700b7921dcbf01506e8e4d432c4fc634

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Analyze.cs

@@ -134,6 +134,179 @@ public partial class EntryPointTests
             );
         }
 
+        [Fact]
+        public async Task DotNetToolsJsonCanBeAnalyzed()
+        {
+            var repoMetadata = XElement.Parse("""<repository type="git" url="https://nuget.example.com/some-global-tool" />""");
+            await RunAsync(path =>
+                [
+                    "analyze",
+                    "--repo-root",
+                    path,
+                    "--discovery-file-path",
+                    Path.Join(path, "discovery.json"),
+                    "--dependency-file-path",
+                    Path.Join(path, "some-global-tool.json"),
+                    "--analysis-folder-path",
+                    Path.Join(path, AnalyzeWorker.AnalysisDirectoryName),
+                    "--verbose",
+                ],
+                packages:
+                [
+                    MockNuGetPackage.CreateDotNetToolPackage("some-global-tool", "1.0.0", "net8.0", additionalMetadata: [repoMetadata]),
+                    MockNuGetPackage.CreateDotNetToolPackage("some-global-tool", "1.1.0", "net8.0", additionalMetadata: [repoMetadata]),
+                ],
+                dependencyName: "some-global-tool",
+                initialFiles:
+                [
+                    (".config/dotnet-tools.json", """
+                        {
+                          "version": 1,
+                          "isRoot": true,
+                          "tools": {
+                            "some-global-tool": {
+                              "version": "1.0.0",
+                              "commands": [
+                                "some-global-tool"
+                              ]
+                            }
+                          }
+                        }
+                        """),
+                    ("discovery.json", """
+                        {
+                          "Path": "",
+                          "IsSuccess": true,
+                          "Projects": [],
+                          "DotNetToolsJson": {
+                            "FilePath": ".config/dotnet-tools.json",
+                            "IsSuccess": true,
+                            "Dependencies": [
+                              {
+                                "Name": "some-global-tool",
+                                "Version": "1.0.0",
+                                "Type": "DotNetTool",
+                                "EvaluationResult": null,
+                                "TargetFrameworks": null,
+                                "IsDevDependency": false,
+                                "IsDirect": false,
+                                "IsTransitive": false,
+                                "IsOverride": false,
+                                "IsUpdate": false,
+                                "InfoUrl": null
+                              }
+                            ]
+                          }
+                        }
+                        """),
+                    ("some-global-tool.json", """
+                        {
+                          "Name": "some-global-tool",
+                          "Version": "1.0.0",
+                          "IsVulnerable": false,
+                          "IgnoredVersions": [],
+                          "Vulnerabilities": []
+                        }
+                        """),
+                ],
+                expectedResult: new()
+                {
+                    UpdatedVersion = "1.1.0",
+                    CanUpdate = true,
+                    VersionComesFromMultiDependencyProperty = false,
+                    UpdatedDependencies =
+                    [
+                        new Dependency("some-global-tool", "1.1.0", DependencyType.DotNetTool, TargetFrameworks: null, IsDirect: true, InfoUrl: "https://nuget.example.com/some-global-tool")
+                    ],
+                }
+            );
+        }
+
+        [Fact]
+        public async Task GlobalJsonCanBeAnalyzed()
+        {
+            var repoMetadata = XElement.Parse("""<repository type="git" url="https://nuget.example.com/some.msbuild.sdk" />""");
+            await RunAsync(path =>
+                [
+                    "analyze",
+                    "--repo-root",
+                    path,
+                    "--discovery-file-path",
+                    Path.Join(path, "discovery.json"),
+                    "--dependency-file-path",
+                    Path.Join(path, "Some.MSBuild.Sdk.json"),
+                    "--analysis-folder-path",
+                    Path.Join(path, AnalyzeWorker.AnalysisDirectoryName),
+                    "--verbose",
+                ],
+                packages:
+                [
+                    MockNuGetPackage.CreateMSBuildSdkPackage("Some.MSBuild.Sdk", "1.0.0", "net8.0", additionalMetadata: [repoMetadata]),
+                    MockNuGetPackage.CreateMSBuildSdkPackage("Some.MSBuild.Sdk", "1.1.0", "net8.0", additionalMetadata: [repoMetadata]),
+                ],
+                dependencyName: "Some.MSBuild.Sdk",
+                initialFiles:
+                [
+                    ("global.json", """
+                        {
+                          "sdk": {
+                            "version": "8.0.300",
+                            "rollForward": "latestPatch"
+                          },
+                          "msbuild-sdks": {
+                            "Some.MSBuild.Sdk": "1.0.0"
+                          }
+                        }
+                        """),
+                    ("discovery.json", """
+                        {
+                          "Path": "",
+                          "IsSuccess": true,
+                          "Projects": [],
+                          "GlobalJson": {
+                            "FilePath": "global.json",
+                            "IsSuccess": true,
+                            "Dependencies": [
+                              {
+                                "Name": "Some.MSBuild.Sdk",
+                                "Version": "1.0.0",
+                                "Type": "MSBuildSdk",
+                                "EvaluationResult": null,
+                                "TargetFrameworks": null,
+                                "IsDevDependency": false,
+                                "IsDirect": false,
+                                "IsTransitive": false,
+                                "IsOverride": false,
+                                "IsUpdate": false,
+                                "InfoUrl": null
+                              }
+                            ]
+                          }
+                        }
+                        """),
+                    ("Some.MSBuild.Sdk.json", """
+                        {
+                          "Name": "Some.MSBuild.Sdk",
+                          "Version": "1.0.0",
+                          "IsVulnerable": false,
+                          "IgnoredVersions": [],
+                          "Vulnerabilities": []
+                        }
+                        """),
+                ],
+                expectedResult: new()
+                {
+                    UpdatedVersion = "1.1.0",
+                    CanUpdate = true,
+                    VersionComesFromMultiDependencyProperty = false,
+                    UpdatedDependencies =
+                    [
+                        new Dependency("Some.MSBuild.Sdk", "1.1.0", DependencyType.MSBuildSdk, TargetFrameworks: null, IsDirect: true, InfoUrl: "https://nuget.example.com/some.msbuild.sdk")
+                    ],
+                }
+            );
+        }
+
         private static async Task RunAsync(Func<string, string[]> getArgs, string dependencyName, TestFile[] initialFiles, ExpectedAnalysisResult expectedResult, MockNuGetPackage[]? packages = null)
         {
             var actualResult = await RunAnalyzerAsync(dependencyName, initialFiles, async path =>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/AnalyzeWorker.cs

@@ -51,23 +51,21 @@ public partial class AnalyzeWorker
             => p.Dependencies.Where(d => !d.IsTransitive &&
                 d.EvaluationResult?.RootPropertyName is not null)
             ).ToImmutableArray();
+        var dotnetToolsHasDependency = discovery.DotNetToolsJson?.Dependencies.Any(d => d.Name.Equals(dependencyInfo.Name, StringComparison.OrdinalIgnoreCase)) == true;
+        var globalJsonHasDependency = discovery.GlobalJson?.Dependencies.Any(d => d.Name.Equals(dependencyInfo.Name, StringComparison.OrdinalIgnoreCase)) == true;
 
         bool usesMultiDependencyProperty = false;
         NuGetVersion? updatedVersion = null;
         ImmutableArray<Dependency> updatedDependencies = [];
 
-        bool isUpdateNecessary = IsUpdateNecessary(dependencyInfo, projectsWithDependency);
+        bool isProjectUpdateNecessary = IsUpdateNecessary(dependencyInfo, projectsWithDependency);
+        var isUpdateNecessary = isProjectUpdateNecessary || dotnetToolsHasDependency || globalJsonHasDependency;
         using var nugetContext = new NuGetContext(startingDirectory);
         AnalysisResult result;
         try
         {
             if (isUpdateNecessary)
             {
-                if (!Directory.Exists(nugetContext.TempPackageDirectory))
-                {
-                    Directory.CreateDirectory(nugetContext.TempPackageDirectory);
-                }
-
                 _logger.Log($"  Determining multi-dependency property.");
                 var multiDependencies = DetermineMultiDependencyDetails(
                     discovery,
@@ -99,16 +97,35 @@ public partial class AnalyzeWorker
                     CancellationToken.None);
 
                 _logger.Log($"  Finding updated peer dependencies.");
-                updatedDependencies = updatedVersion is not null
-                    ? await FindUpdatedDependenciesAsync(
+                if (updatedVersion is null)
+                {
+                    updatedDependencies = [];
+                }
+                else if (isProjectUpdateNecessary)
+                {
+                    updatedDependencies = await FindUpdatedDependenciesAsync(
                         repoRoot,
                         discovery,
                         dependenciesToUpdate,
                         updatedVersion,
                         nugetContext,
                         _logger,
-                        CancellationToken.None)
-                    : [];
+                        CancellationToken.None);
+                }
+                else if (dotnetToolsHasDependency)
+                {
+                    var infoUrl = await nugetContext.GetPackageInfoUrlAsync(dependencyInfo.Name, updatedVersion.ToNormalizedString(), CancellationToken.None);
+                    updatedDependencies = [new Dependency(dependencyInfo.Name, updatedVersion.ToNormalizedString(), DependencyType.DotNetTool, IsDirect: true, InfoUrl: infoUrl)];
+                }
+                else if (globalJsonHasDependency)
+                {
+                    var infoUrl = await nugetContext.GetPackageInfoUrlAsync(dependencyInfo.Name, updatedVersion.ToNormalizedString(), CancellationToken.None);
+                    updatedDependencies = [new Dependency(dependencyInfo.Name, updatedVersion.ToNormalizedString(), DependencyType.MSBuildSdk, IsDirect: true, InfoUrl: infoUrl)];
+                }
+                else
+                {
+                    throw new InvalidOperationException("Unreachable.");
+                }
 
                 //TODO: At this point we should add the peer dependencies to a queue where
                 // we will analyze them one by one to see if they themselves are part of a

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/NuGetContext.cs

@@ -37,12 +37,23 @@ internal record NuGetContext : IDisposable
             .Where(p => p.IsEnabled)
             .ToImmutableArray();
         Logger = logger ?? NullLogger.Instance;
-        TempPackageDirectory = Path.Combine(Path.GetTempPath(), ".dependabot", "packages");
+        TempPackageDirectory = Path.Combine(Path.GetTempPath(), $"dependabot-packages_{Guid.NewGuid():d}");
+        Directory.CreateDirectory(TempPackageDirectory);
     }
 
     public void Dispose()
     {
         SourceCacheContext.Dispose();
+        if (Directory.Exists(TempPackageDirectory))
+        {
+            try
+            {
+                Directory.Delete(TempPackageDirectory, recursive: true);
+            }
+            catch
+            {
+            }
+        }
     }
 
     private readonly Dictionary<PackageIdentity, string?> _packageInfoUrlCache = new();

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/Requirement.cs

@@ -12,7 +12,59 @@ namespace NuGetUpdater.Core.Analyze;
 /// See Gem::Version for a description on how versions and requirements work
 /// together in RubyGems.
 /// </remarks>
-public class Requirement
+public abstract class Requirement
+{
+    public abstract bool IsSatisfiedBy(NuGetVersion version);
+
+    private static readonly Dictionary<string, Version> BumpMap = [];
+    /// <summary>
+    /// Return a new version object where the next to the last revision
+    /// number is one greater (e.g., 5.3.1 => 5.4).
+    /// </summary>
+    /// <remarks>
+    /// This logic intended to be similar to RubyGems Gem::Version#bump
+    /// </remarks>
+    public static Version Bump(NuGetVersion version)
+    {
+        if (BumpMap.TryGetValue(version.OriginalVersion!, out var bumpedVersion))
+        {
+            return bumpedVersion;
+        }
+
+        var versionParts = version.OriginalVersion! // Get the original string this version was created from
+            .Split('-')[0] // Get the version part without pre-release
+            .Split('.') // Split into Major.Minor.Patch.Revision if present
+            .Select(int.Parse)
+            .ToArray();
+
+        if (versionParts.Length > 1)
+        {
+            versionParts = versionParts[..^1]; // Remove the last part
+        }
+
+        versionParts[^1]++; // Increment the new last part
+
+        bumpedVersion = NuGetVersion.Parse(string.Join('.', versionParts)).Version;
+        BumpMap[version.OriginalVersion!] = bumpedVersion;
+
+        return bumpedVersion;
+    }
+
+    public static Requirement Parse(string requirement)
+    {
+        var specificParts = requirement.Split(',');
+        if (specificParts.Length == 1)
+        {
+            return IndividualRequirement.ParseIndividual(requirement);
+        }
+
+        var specificRequirements = specificParts.Select(IndividualRequirement.ParseIndividual).ToArray();
+        return new MultiPartRequirement(specificRequirements);
+    }
+}
+
+
+public class IndividualRequirement : Requirement
 {
     private static readonly ImmutableDictionary<string, Func<NuGetVersion, NuGetVersion, bool>> Operators = new Dictionary<string, Func<NuGetVersion, NuGetVersion, bool>>()
     {
@@ -25,30 +77,10 @@ public class Requirement
         ["~>"] = (v, r) => v >= r && v.Version < Bump(r),
     }.ToImmutableDictionary();
 
-    public static Requirement Parse(string requirement)
-    {
-        var splitIndex = requirement.LastIndexOfAny(['=', '>', '<']);
-
-        // Throw if the requirement is all operator and no version.
-        if (splitIndex == requirement.Length - 1)
-        {
-            throw new ArgumentException($"`{requirement}` is a invalid requirement string", nameof(requirement));
-        }
-
-        string[] parts = splitIndex == -1
-            ? [requirement.Trim()]
-            : [requirement[..(splitIndex + 1)].Trim(), requirement[(splitIndex + 1)..].Trim()];
-
-        var op = parts.Length == 1 ? "=" : parts[0];
-        var version = NuGetVersion.Parse(parts[^1]);
-
-        return new Requirement(op, version);
-    }
-
     public string Operator { get; }
     public NuGetVersion Version { get; }
 
-    public Requirement(string op, NuGetVersion version)
+    public IndividualRequirement(string op, NuGetVersion version)
     {
         if (!Operators.ContainsKey(op))
         {
@@ -64,42 +96,53 @@ public class Requirement
         return $"{Operator} {Version}";
     }
 
-    public bool IsSatisfiedBy(NuGetVersion version)
+    public override bool IsSatisfiedBy(NuGetVersion version)
     {
         return Operators[Operator](version, Version);
     }
 
-    private static readonly Dictionary<string, Version> BumpMap = [];
-    /// <summary>
-    /// Return a new version object where the next to the last revision
-    /// number is one greater (e.g., 5.3.1 => 5.4).
-    /// </summary>
-    /// <remarks>
-    /// This logic intended to be similar to RubyGems Gem::Version#bump
-    /// </remarks>
-    public static Version Bump(NuGetVersion version)
+    public static IndividualRequirement ParseIndividual(string requirement)
     {
-        if (BumpMap.TryGetValue(version.OriginalVersion!, out var bumpedVersion))
+        var splitIndex = requirement.LastIndexOfAny(['=', '>', '<']);
+
+        // Throw if the requirement is all operator and no version.
+        if (splitIndex == requirement.Length - 1)
         {
-            return bumpedVersion;
+            throw new ArgumentException($"`{requirement}` is a invalid requirement string", nameof(requirement));
         }
 
-        var versionParts = version.OriginalVersion! // Get the original string this version was created from
-            .Split('-')[0] // Get the version part without pre-release
-            .Split('.') // Split into Major.Minor.Patch.Revision if present
-            .Select(int.Parse)
-            .ToArray();
+        string[] parts = splitIndex == -1
+            ? [requirement.Trim()]
+            : [requirement[..(splitIndex + 1)].Trim(), requirement[(splitIndex + 1)..].Trim()];
 
-        if (versionParts.Length > 1)
+        var op = parts.Length == 1 ? "=" : parts[0];
+        var version = NuGetVersion.Parse(parts[^1]);
+
+        return new IndividualRequirement(op, version);
+    }
+}
+
+public class MultiPartRequirement : Requirement
+{
+    public ImmutableArray<IndividualRequirement> Parts { get; }
+
+    public MultiPartRequirement(IndividualRequirement[] parts)
+    {
+        if (parts.Length <= 1)
         {
-            versionParts = versionParts[..^1]; // Remove the last part
+            throw new ArgumentException("At least two parts are required", nameof(parts));
         }
 
-        versionParts[^1]++; // Increment the new last part
+        Parts = parts.ToImmutableArray();
+    }
 
-        bumpedVersion = NuGetVersion.Parse(string.Join('.', versionParts)).Version;
-        BumpMap[version.OriginalVersion!] = bumpedVersion;
+    public override string ToString()
+    {
+        return string.Join(", ", Parts);
+    }
 
-        return bumpedVersion;
+    public override bool IsSatisfiedBy(NuGetVersion version)
+    {
+        return Parts.All(part => part.IsSatisfiedBy(version));
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/ErrorType.cs

@@ -5,4 +5,5 @@ public enum ErrorType
     // TODO: add `Unknown` option to track all other failure types
     None,
     AuthenticationFailure,
+    MissingFile,
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/MissingFileException.cs

@@ -0,0 +1,11 @@
+namespace NuGetUpdater.Core;
+
+internal class MissingFileException : Exception
+{
+    public string FilePath { get; }
+
+    public MissingFileException(string filePath)
+    {
+        FilePath = filePath;
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs

@@ -149,42 +149,6 @@ internal static class BindingRedirectManager
             return (element.Name == "None" && string.Equals(path, "app.config", StringComparison.OrdinalIgnoreCase))
                    || (element.Name == "Content" && string.Equals(path, "web.config", StringComparison.OrdinalIgnoreCase));
         }
-
-        static string GetConfigFileName(XmlDocumentSyntax document)
-        {
-            var guidValue = document.Descendants()
-                .Where(static x => x.Name == "PropertyGroup")
-                .SelectMany(static x => x.Elements.Where(static x => x.Name == "ProjectGuid"))
-                .FirstOrDefault()
-                ?.GetContentValue();
-            return guidValue switch
-            {
-                "{E24C65DC-7377-472B-9ABA-BC803B73C61A}" or "{349C5851-65DF-11DA-9384-00065B846F21}" => "Web.config",
-                _ => "App.config"
-            };
-        }
-
-        static string GenerateDefaultAppConfig(XmlDocumentSyntax document)
-        {
-            var frameworkVersion = GetFrameworkVersion(document);
-            return $"""
-                <?xml version="1.0" encoding="utf-8" ?>
-                <configuration>
-                    <startup>
-                        <supportedRuntime version="v4.0" sku=".NETFramework,Version={frameworkVersion}" />
-                    </startup>
-                </configuration>
-                """;
-        }
-
-        static string? GetFrameworkVersion(XmlDocumentSyntax document)
-        {
-            return document.Descendants()
-                .Where(static x => x.Name == "PropertyGroup")
-                .SelectMany(static x => x.Elements.Where(static x => x.Name == "TargetFrameworkVersion"))
-                .FirstOrDefault()
-                ?.GetContentValue();
-        }
     }
 
     private static string AddBindingRedirects(ConfigurationFile configFile, IEnumerable<Runtime_AssemblyBinding> bindingRedirects)
@@ -213,10 +177,24 @@ internal static class BindingRedirectManager
 
         foreach (var bindingRedirect in bindingRedirects)
         {
-            // Look to see if we already have this in the list of bindings already in config.
-            if (currentBindings.TryGetValue((bindingRedirect.Name, bindingRedirect.PublicKeyToken), out var existingBinding))
+            // If the binding redirect already exists in config, update it. Otherwise, add it.
+            var bindingAssemblyIdentity = new AssemblyIdentity(bindingRedirect.Name, bindingRedirect.PublicKeyToken);
+            if (currentBindings.Contains(bindingAssemblyIdentity))
             {
-                UpdateBindingRedirectElement(existingBinding, bindingRedirect);
+                // Check if there are multiple bindings in config for this assembly and remove all but the first one.
+                // Normally there should only be one binding per assembly identity unless the config is malformed, which we'll fix here like NuGet.exe would.
+                var existingBindings = currentBindings[bindingAssemblyIdentity];
+                if (existingBindings.Any())
+                {
+                    // Remove all but the first element
+                    foreach (var bindingElement in existingBindings.Skip(1))
+                    {
+                        RemoveElement(bindingElement);
+                    }
+
+                    // Update the first one with the new binding
+                    UpdateBindingRedirectElement(existingBindings.First(), bindingRedirect);
+                }
             }
             else
             {
@@ -228,7 +206,10 @@ internal static class BindingRedirectManager
             }
         }
 
-        return document.ToString();
+        return string.Concat(
+            document.Declaration?.ToString() ?? String.Empty, // Ensure the <?xml> declaration node is preserved, if present
+            document.ToString()
+        );
 
         static XDocument GetConfiguration(string configFileContent)
         {
@@ -278,7 +259,7 @@ internal static class BindingRedirectManager
             }
         }
 
-        static Dictionary<(string Name, string PublicKeyToken), XElement> GetAssemblyBindings(XElement runtime)
+        static ILookup<AssemblyIdentity, XElement> GetAssemblyBindings(XElement runtime)
         {
             var dependencyAssemblyElements = runtime.Elements(AssemblyBindingName)
                 .Elements(DependentAssemblyName);
@@ -291,7 +272,12 @@ internal static class BindingRedirectManager
             });
 
             // Return a mapping from binding to element
-            return assemblyElementPairs.ToDictionary(p => (p.Binding.Name, p.Binding.PublicKeyToken), p => p.Element);
+            // It is possible that multiple elements exist for the same assembly identity, so use a lookup (1:*) instead of a dictionary (1:1) 
+            return assemblyElementPairs.ToLookup(
+                p => new AssemblyIdentity(p.Binding.Name, p.Binding.PublicKeyToken),
+                p => p.Element,
+                new AssemblyIdentityIgnoreCaseComparer()
+            );
         }
 
         static XElement GetAssemblyBindingElement(XElement runtime)
@@ -309,4 +295,21 @@ internal static class BindingRedirectManager
             return assemblyBinding;
         }
     }
+
+    internal sealed record AssemblyIdentity(string Name, string PublicKeyToken);
+
+    // Case-insensitive comparer. This helps avoid creating duplicate binding redirects when there is a case form mismatch between assembly identities.
+    // Especially important for PublicKeyToken which is typically lowercase (using NuGet.exe), but can also be uppercase when using other tools (e.g. Visual Studio auto-resolve assembly conflicts feature).
+    internal sealed class AssemblyIdentityIgnoreCaseComparer : IEqualityComparer<AssemblyIdentity>
+    {
+        public bool Equals(AssemblyIdentity? x, AssemblyIdentity? y) =>
+            string.Equals(x?.Name, y?.Name, StringComparison.OrdinalIgnoreCase) &&
+            string.Equals(x?.PublicKeyToken, y?.PublicKeyToken, StringComparison.OrdinalIgnoreCase);
+
+        public int GetHashCode(AssemblyIdentity obj) =>
+            HashCode.Combine(
+                obj.Name?.ToLowerInvariant(),
+                obj.PublicKeyToken?.ToLowerInvariant()
+            );
+    }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs

@@ -146,6 +146,7 @@ internal static class PackagesConfigUpdater
                 }
 
                 MSBuildHelper.ThrowOnUnauthenticatedFeed(fullOutput);
+                MSBuildHelper.ThrowOnMissingFile(fullOutput);
                 throw new Exception(fullOutput);
             }
         }