dependabot-nuget 0.267.0 → 0.270.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -13,9 +13,12 @@ using Microsoft.Build.Exceptions;
 using Microsoft.Build.Locator;
 using Microsoft.Extensions.FileSystemGlobbing;
 
+using NuGet;
 using NuGet.Configuration;
+using NuGet.Frameworks;
 using NuGet.Versioning;
 
+using NuGetUpdater.Core.Analyze;
 using NuGetUpdater.Core.Utilities;
 
 namespace NuGetUpdater.Core;
@@ -31,29 +34,54 @@ internal static partial class MSBuildHelper
         // Ensure MSBuild types are registered before calling a method that loads the types
         if (!IsMSBuildRegistered)
         {
-            var candidateDirectories = PathHelper.GetAllDirectoriesToRoot(currentDirectory, rootDirectory);
-            var globalJsonPaths = candidateDirectories.Select(d => Path.Combine(d, "global.json")).Where(File.Exists).Select(p => (p, p + Guid.NewGuid().ToString())).ToArray();
-            foreach (var (globalJsonPath, tempGlobalJsonPath) in globalJsonPaths)
-            {
-                Console.WriteLine($"Temporarily removing `global.json` from `{Path.GetDirectoryName(globalJsonPath)}` for MSBuild detection.");
-                File.Move(globalJsonPath, tempGlobalJsonPath);
-            }
-
-            try
+            SidelineGlobalJsonAsync(currentDirectory, rootDirectory, () =>
             {
                 var defaultInstance = MSBuildLocator.QueryVisualStudioInstances().First();
                 MSBuildPath = defaultInstance.MSBuildPath;
                 MSBuildLocator.RegisterInstance(defaultInstance);
-            }
-            finally
+                return Task.CompletedTask;
+            }).Wait();
+        }
+    }
+
+    public static async Task SidelineGlobalJsonAsync(string currentDirectory, string rootDirectory, Func<Task> action, bool retainMSBuildSdks = false)
+    {
+        var candidateDirectories = PathHelper.GetAllDirectoriesToRoot(currentDirectory, rootDirectory);
+        var globalJsonPaths = candidateDirectories.Select(d => Path.Combine(d, "global.json")).Where(File.Exists).Select(p => (p, p + Guid.NewGuid().ToString())).ToArray();
+        foreach (var (globalJsonPath, tempGlobalJsonPath) in globalJsonPaths)
+        {
+            Console.WriteLine($"Temporarily removing `global.json` from `{Path.GetDirectoryName(globalJsonPath)}`{(retainMSBuildSdks ? " and retaining MSBuild SDK declarations" : string.Empty)}.");
+            File.Move(globalJsonPath, tempGlobalJsonPath);
+            if (retainMSBuildSdks)
             {
-                foreach (var (globalJsonpath, tempGlobalJsonPath) in globalJsonPaths)
+                // custom SDKs might need to be retained for other operations; rebuild `global.json` with only the relevant key
+                var originalContent = await File.ReadAllTextAsync(tempGlobalJsonPath);
+                var jsonNode = JsonHelper.ParseNode(originalContent);
+                if (jsonNode is JsonObject obj &&
+                    obj.TryGetPropertyValue("msbuild-sdks", out var sdks) &&
+                    sdks is not null)
                 {
-                    Console.WriteLine($"Restoring `global.json` to `{Path.GetDirectoryName(globalJsonpath)}` after MSBuild discovery.");
-                    File.Move(tempGlobalJsonPath, globalJsonpath);
+                    var newObj = new JsonObject()
+                    {
+                        ["msbuild-sdks"] = sdks.DeepClone(),
+                    };
+                    await File.WriteAllTextAsync(globalJsonPath, newObj.ToJsonString());
                 }
             }
         }
+
+        try
+        {
+            await action();
+        }
+        finally
+        {
+            foreach (var (globalJsonpath, tempGlobalJsonPath) in globalJsonPaths)
+            {
+                Console.WriteLine($"Restoring `global.json` to `{Path.GetDirectoryName(globalJsonpath)}`.");
+                File.Move(tempGlobalJsonPath, globalJsonpath, overwrite: retainMSBuildSdks);
+            }
+        }
     }
 
     public static IEnumerable<string> GetProjectPathsFromSolution(string solutionPath)
@@ -306,7 +334,182 @@ internal static partial class MSBuildHelper
         }
     }
 
-    internal static async Task<Dependency[]?> ResolveDependencyConflicts(string repoRoot, string projectPath, string targetFramework, Dependency[] packages, Logger logger)
+    internal static bool UseNewDependencySolver()
+    {
+        return Environment.GetEnvironmentVariable("UseNewNugetPackageResolver") == "true";
+    }
+
+    internal static async Task<Dependency[]?> ResolveDependencyConflicts(string repoRoot, string projectPath, string targetFramework, Dependency[] packages, Dependency[] update, Logger logger)
+    {
+        if (UseNewDependencySolver())
+        {
+            return await ResolveDependencyConflictsNew(repoRoot, projectPath, targetFramework, packages, update, logger);
+        }
+        else
+        {
+            return await ResolveDependencyConflictsOld(repoRoot, projectPath, targetFramework, packages, logger);
+        }
+    }
+
+    internal static async Task<Dependency[]?> ResolveDependencyConflictsNew(string repoRoot, string projectPath, string targetFramework, Dependency[] packages, Dependency[] update, Logger logger)
+    {
+        var tempDirectory = Directory.CreateTempSubdirectory("package-dependency-coherence_");
+        PackageManager packageManager = new PackageManager(repoRoot, projectPath);
+
+        try
+        {
+            string tempProjectPath = await CreateTempProjectAsync(tempDirectory, repoRoot, projectPath, targetFramework, packages);
+            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"restore \"{tempProjectPath}\"", workingDirectory: tempDirectory.FullName);
+
+            // Add Dependency[] packages to List<PackageToUpdate> existingPackages
+            List<PackageToUpdate> existingPackages = packages
+            .Select(existingPackage => new PackageToUpdate
+            {
+                PackageName = existingPackage.Name,
+                CurrentVersion = existingPackage.Version
+            })
+            .ToList();
+
+            // Add Dependency[] update to List<PackageToUpdate> packagesToUpdate
+            List<PackageToUpdate> packagesToUpdate = update
+            .Where(package => package.Version != null)
+            .Select(package => new PackageToUpdate
+            {
+                PackageName = package.Name,
+                NewVersion = package.Version.ToString()
+            })
+            .ToList();
+
+            foreach (PackageToUpdate existing in existingPackages)
+            {
+                var foundPackage = packagesToUpdate.Where(p => string.Equals(p.PackageName, existing.PackageName, StringComparison.OrdinalIgnoreCase));
+                if (!foundPackage.Any())
+                {
+                    existing.NewVersion = existing.CurrentVersion;
+                }
+            }
+
+            // Create a duplicate set of existingPackages for flexible package reference addition and removal 
+            List<PackageToUpdate> existingDuplicate = new List<PackageToUpdate>(existingPackages);
+
+            // Bool to keep track of if anything was added to the existingDuplicate list
+            bool added = false;
+
+            // If package 'isnt there, add it to the existingDuplicate list
+            foreach (PackageToUpdate package in packagesToUpdate)
+            {
+                if (!existingDuplicate.Any(p => string.Equals(p.PackageName, package.PackageName, StringComparison.OrdinalIgnoreCase)))
+                {
+                    existingDuplicate.Add(package);
+                    added = true;
+                }
+            }
+
+            // If you have to use the existingDuplicate list
+            if (added == true)
+            {
+                // Add existing versions to existing list
+                packageManager.UpdateExistingPackagesWithNewVersions(existingDuplicate, packagesToUpdate);
+
+                // Make relationships
+                await packageManager.PopulatePackageDependenciesAsync(existingDuplicate, targetFramework, Path.GetDirectoryName(projectPath));
+
+                // Update all to new versions
+                foreach (var package in existingDuplicate)
+                {
+                    string updateResult = await packageManager.UpdateVersion(existingDuplicate, package, targetFramework, Path.GetDirectoryName(projectPath));
+                }
+            }
+
+            // Editing existing list because nothing was added to existingDuplicate
+            else
+            {
+                // Add existing versions to existing list
+                packageManager.UpdateExistingPackagesWithNewVersions(existingPackages, packagesToUpdate);
+
+                // Make relationships
+                await packageManager.PopulatePackageDependenciesAsync(existingPackages, targetFramework, Path.GetDirectoryName(projectPath));
+
+                // Update all to new versions
+                foreach (var package in existingPackages)
+                {
+                    string updateResult = await packageManager.UpdateVersion(existingPackages, package, targetFramework, Path.GetDirectoryName(projectPath));
+                }
+            }
+
+            // Make new list to remove and differentiate between existingDuplicate and existingPackages lists
+            List<PackageToUpdate> packagesToRemove = existingDuplicate
+            .Where(existingPackageDupe => !existingPackages.Contains(existingPackageDupe) && existingPackageDupe.IsSpecific == true)
+            .ToList();
+
+            foreach (PackageToUpdate package in packagesToRemove)
+            {
+                existingDuplicate.Remove(package);
+            }
+
+            if (existingDuplicate != null)
+            {
+                existingPackages = existingDuplicate;
+            }
+
+            // Convert back to Dependency [], use NewVersion if available, otherwise use CurrentVersion
+            List<Dependency> candidatePackages = existingPackages
+            .Select(package => new Dependency(
+                package.PackageName,
+                package.NewVersion ?? package.CurrentVersion,
+                DependencyType.Unknown,
+                null,
+                null,
+                false,
+                false,
+                false,
+                false,
+                false
+            ))
+            .ToList();
+
+            // Return as array
+            Dependency[] candidatePackagesArray = candidatePackages.ToArray();
+
+            var targetFrameworks = new NuGetFramework[] { NuGetFramework.Parse(targetFramework) };
+
+            var resolveProjectPath = projectPath;
+
+            if (!Path.IsPathRooted(resolveProjectPath) || !File.Exists(resolveProjectPath))
+            {
+                resolveProjectPath = Path.GetFullPath(Path.Join(repoRoot, resolveProjectPath));
+            }
+
+            NuGetContext nugetContext = new NuGetContext(Path.GetDirectoryName(resolveProjectPath));
+
+            // Target framework compatibility check
+            foreach (var package in candidatePackages)
+            {
+                if (!NuGetVersion.TryParse(package.Version, out var nuGetVersion))
+                {
+                    // If version is not valid, return original packages and revert
+                    return packages;
+                }
+
+                var packageIdentity = new NuGet.Packaging.Core.PackageIdentity(package.Name, nuGetVersion);
+
+                bool isNewPackageCompatible = await CompatibilityChecker.CheckAsync(packageIdentity, targetFrameworks.ToImmutableArray(), nugetContext, logger, CancellationToken.None);
+                if (!isNewPackageCompatible)
+                {
+                    // If the package target framework is not compatible, return original packages and revert
+                    return packages;
+                }
+            }
+
+            return candidatePackagesArray;
+        }
+        finally
+        {
+            tempDirectory.Delete(recursive: true);
+        }
+    }
+
+    internal static async Task<Dependency[]?> ResolveDependencyConflictsOld(string repoRoot, string projectPath, string targetFramework, Dependency[] packages, Logger logger)
     {
         var tempDirectory = Directory.CreateTempSubdirectory("package-dependency-coherence_");
         try
@@ -334,22 +537,22 @@ internal static partial class MSBuildHelper
             Dictionary<string, HashSet<NuGetVersion>> badPackagesAndCandidateVersionsDictionary = new(StringComparer.OrdinalIgnoreCase);
 
             // and for each of those packages, find all versions greater than the one that's currently installed
-            foreach ((string packageName, NuGetVersion packageVersion) in badPackagesAndVersions)
+            foreach ((string PackageName, NuGetVersion packageVersion) in badPackagesAndVersions)
             {
                 // this command dumps a JSON object with all versions of the specified package from all package sources
-                (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"package search {packageName} --exact-match --format json", workingDirectory: tempDirectory.FullName);
+                (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"package search {PackageName} --exact-match --format json", workingDirectory: tempDirectory.FullName);
                 if (exitCode != 0)
                 {
                     continue;
                 }
 
                 // ensure collection exists
-                if (!badPackagesAndCandidateVersionsDictionary.ContainsKey(packageName))
+                if (!badPackagesAndCandidateVersionsDictionary.ContainsKey(PackageName))
                 {
-                    badPackagesAndCandidateVersionsDictionary.Add(packageName, new HashSet<NuGetVersion>());
+                    badPackagesAndCandidateVersionsDictionary.Add(PackageName, new HashSet<NuGetVersion>());
                 }
 
-                HashSet<NuGetVersion> foundVersions = badPackagesAndCandidateVersionsDictionary[packageName];
+                HashSet<NuGetVersion> foundVersions = badPackagesAndCandidateVersionsDictionary[PackageName];
 
                 var json = JsonHelper.ParseNode(stdOut);
                 if (json?["searchResult"] is JsonArray searchResults)
@@ -580,9 +783,9 @@ internal static partial class MSBuildHelper
                     .Where(match => match.Success)
                     .Select(match =>
                     {
-                        var packageName = match.Groups["PackageName"].Value;
-                        var isTransitive = !topLevelPackagesNames.Contains(packageName);
-                        return new Dependency(packageName, match.Groups["PackageVersion"].Value, DependencyType.Unknown, TargetFrameworks: tfms, IsTransitive: isTransitive);
+                        var PackageName = match.Groups["PackageName"].Value;
+                        var isTransitive = !topLevelPackagesNames.Contains(PackageName);
+                        return new Dependency(PackageName, match.Groups["PackageVersion"].Value, DependencyType.Unknown, TargetFrameworks: tfms, IsTransitive: isTransitive);
                     })
                     .ToArray();
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs

@@ -264,6 +264,46 @@ public partial class AnalyzeWorkerTests : AnalyzeWorkerTestBase
 
     [Fact]
     public async Task ReturnsUpToDate_ForMissingDependency()
+    {
+        await TestAnalyzeAsync(
+            packages:
+            [
+                // no packages listed
+            ],
+            discovery: new()
+            {
+                Path = "/",
+                Projects = [
+                    new()
+                    {
+                        FilePath = "./project.csproj",
+                        TargetFrameworks = ["net8.0"],
+                        Dependencies = [
+                            new("Some.Package", "1.0.0", DependencyType.PackageReference), // this was found in the source, but doesn't exist in any feed
+                        ],
+                    },
+                ],
+            },
+            dependencyInfo: new()
+            {
+                Name = "Some.Package",
+                Version = "1.0.0",
+                IgnoredVersions = [],
+                IsVulnerable = false,
+                Vulnerabilities = [],
+            },
+            expectedResult: new()
+            {
+                UpdatedVersion = "1.0.0",
+                CanUpdate = false,
+                VersionComesFromMultiDependencyProperty = false,
+                UpdatedDependencies = [],
+            }
+        );
+    }
+
+    [Fact]
+    public async Task ReturnsUpToDate_ForIgnoredRequirements()
     {
         await TestAnalyzeAsync(
             packages:
@@ -307,6 +347,50 @@ public partial class AnalyzeWorkerTests : AnalyzeWorkerTestBase
         );
     }
 
+    [Fact]
+    public async Task IgnoredVersionsCanHandleWildcardSpecification()
+    {
+        await TestAnalyzeAsync(
+            packages:
+            [
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0"), // initially this
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "1.1.0", "net8.0"), // should update to this
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "1.2.0", "net8.0"), // `IgnoredVersions` should prevent this from being selected
+            ],
+            discovery: new()
+            {
+                Path = "/",
+                Projects = [
+                    new()
+                    {
+                        FilePath = "./project.csproj",
+                        TargetFrameworks = ["net8.0"],
+                        Dependencies = [
+                            new("Some.Package", "1.0.0", DependencyType.PackageReference),
+                        ],
+                    },
+                ],
+            },
+            dependencyInfo: new()
+            {
+                Name = "Some.Package",
+                Version = "1.0.0",
+                IgnoredVersions = [Requirement.Parse("> 1.1.*")],
+                IsVulnerable = false,
+                Vulnerabilities = [],
+            },
+            expectedResult: new()
+            {
+                UpdatedVersion = "1.1.0",
+                CanUpdate = true,
+                VersionComesFromMultiDependencyProperty = false,
+                UpdatedDependencies = [
+                    new("Some.Package", "1.1.0", DependencyType.Unknown, TargetFrameworks: ["net8.0"]),
+                ],
+            }
+        );
+    }
+
     [Fact]
     public async Task VersionFinderCanHandle404FromPackageSource_V2()
     {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/RequirementTests.cs

@@ -33,6 +33,8 @@ public class RequirementTests
     [InlineData("1", "~> 1", true)]
     [InlineData("2", "~> 1", false)]
     [InlineData("5.3.8", "< 6, > 5.2.4", true)]
+    [InlineData("1.0-preview", ">= 1.x", false)] // wildcards
+    [InlineData("1.1-preview", ">= 1.x", true)]
     public void IsSatisfiedBy(string versionString, string requirementString, bool expected)
     {
         var version = NuGetVersion.Parse(versionString);
@@ -43,6 +45,18 @@ public class RequirementTests
         Assert.Equal(expected, actual);
     }
 
+    [Theory]
+    [InlineData("> 1.*", "> 1.0")] // standard wildcard, single digit
+    [InlineData("> 1.2.*", "> 1.2.0")] // standard wildcard, multiple digit
+    [InlineData("> 1.a", "> 1.0")] // alternate wildcard, single digit
+    [InlineData("> 1.2.a", "> 1.2.0")] // alternate wildcard, multiple digit
+    public void Parse_ConvertsWildcardInVersion(string givenRequirementString, string expectedRequirementString)
+    {
+        var parsedRequirement = Requirement.Parse(givenRequirementString);
+        var actualRequirementString = parsedRequirement.ToString();
+        Assert.Equal(expectedRequirementString, actualRequirementString);
+    }
+
     [Theory]
     [InlineData("> = 1.0.0")] // Invalid format
     [InlineData("<>= 1.0.0")] // Invalid Operator

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/TemporaryEnvironment.cs

@@ -0,0 +1,23 @@
+namespace NuGetUpdater.Core.Test;
+
+public class TemporaryEnvironment : IDisposable
+{
+    private readonly List<(string Name, string? Value)> _originalVariables = new();
+
+    public TemporaryEnvironment((string Name, string Value)[] variables)
+    {
+        foreach (var (name, value) in variables)
+        {
+            _originalVariables.Add((name, Environment.GetEnvironmentVariable(name)));
+            Environment.SetEnvironmentVariable(name, value);
+        }
+    }
+
+    public void Dispose()
+    {
+        foreach (var (name, value) in _originalVariables)
+        {
+            Environment.SetEnvironmentVariable(name, value);
+        }
+    }
+}