dependabot-nuget 0.267.0 → 0.270.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs

@@ -479,7 +479,11 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Some.Package", "1.2.0", DependencyType.PackageReference),
                 new Dependency("Some.Other.Package", "1.0.0", DependencyType.PackageReference),
             };
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, new Logger(true));
+            var update = new[]
+            {
+                new Dependency("Some.Other.Package", "1.2.0", DependencyType.PackageReference),
+            };
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(2, resolvedDependencies.Length);
             Assert.Equal("Some.Package", resolvedDependencies[0].Name);
@@ -493,6 +497,786 @@ public class MSBuildHelperTests : TestBase
         }
     }
 
+    #region
+    // Updating root package
+    // CS-Script Code to 2.0.0 requires its dependency Microsoft.CodeAnalysis.CSharp.Scripting to be 3.6.0 and its transitive dependency Microsoft.CodeAnalysis.Common to be 3.6.0
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewUpdatingTopLevelPackage()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewUpdatingTopLevelPackage)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="CS-Script.Core" Version="1.3.1" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="3.4.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.Scripting.Common" Version="3.4.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                // Add comment about root and dependencies
+                new Dependency("CS-Script.Core", "1.3.1", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.Common", "3.4.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.Scripting.Common", "3.4.0", DependencyType.PackageReference),
+            };
+            var update = new[]
+            {
+                new Dependency("CS-Script.Core", "2.0.0", DependencyType.PackageReference),
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(3, resolvedDependencies.Length);
+            Assert.Equal("CS-Script.Core", resolvedDependencies[0].Name);
+            Assert.Equal("2.0.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.Common", resolvedDependencies[1].Name);
+            Assert.Equal("3.6.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.Scripting.Common", resolvedDependencies[2].Name);
+            Assert.Equal("3.6.0", resolvedDependencies[2].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Updating a dependency (Microsoft.Bcl.AsyncInterfaces) of the root package (Azure.Core) will require the root package to also update, but since the dependency is not in the existing list, we do not include it
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewUpdatingNonExistingDependency()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewUpdatingNonExistingDependency)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Azure.Core" Version="1.21.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Azure.Core", "1.21.0", DependencyType.PackageReference)
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.Bcl.AsyncInterfaces", "1.1.1", DependencyType.Unknown)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Single(resolvedDependencies);
+            Assert.Equal("Azure.Core", resolvedDependencies[0].Name);
+            Assert.Equal("1.22.0", resolvedDependencies[0].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Adding a reference
+    // Newtonsoft.Json needs to update to 13.0.1. Although Newtonsoft.Json.Bson can use the original version of 12.0.1, for security vulnerabilities and
+    // because there is no later version of Newtonsoft.Json.Bson 1.0.2, Newtonsoft.Json would be added to the existing list to prevent resolution
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewUpdatingNonExistentDependencyAndKeepingReference()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewUpdatingNonExistentDependencyAndKeepingReference)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Newtonsoft.Json.Bson" Version="1.0.2" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Newtonsoft.Json.Bson", "1.0.2", DependencyType.PackageReference)
+            };
+            var update = new[]
+            {
+                new Dependency("Newtonsoft.Json", "13.0.1", DependencyType.Unknown)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(2, resolvedDependencies.Length);
+            Assert.Equal("Newtonsoft.Json.Bson", resolvedDependencies[0].Name);
+            Assert.Equal("1.0.2", resolvedDependencies[0].Version);
+            Assert.Equal("Newtonsoft.Json", resolvedDependencies[1].Name);
+            Assert.Equal("13.0.1", resolvedDependencies[1].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Updating unreferenced dependency
+    // Root package (Microsoft.CodeAnalysis.Compilers) and its dependencies (Microsoft.CodeAnalysis.CSharp), (Microsoft.CodeAnalysis.VisualBasic) are all 4.9.2
+    // These packages all require the transitive dependency of the root package (Microsoft.CodeAnalysis.Common) to be 4.9.2, but it's not in the existing list
+    // If Microsoft.CodeAnalysis.Common is updated to 4.10.0, everything else updates and Microsoft.CoseAnalysis.Common is not kept in the existing list
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewTransitiveDependencyNotExisting()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewTransitiveDependencyNotExisting)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Microsoft.CodeAnalysis.Compilers" Version="4.9.2" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.9.2" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.VisualBasic" Version="4.9.2" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.Compilers", "4.9.2", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp", "4.9.2", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.VisualBasic", "4.9.2", DependencyType.PackageReference)
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.10.0", DependencyType.PackageReference)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(3, resolvedDependencies.Length);
+            Assert.Equal("Microsoft.CodeAnalysis.Compilers", resolvedDependencies[0].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp", resolvedDependencies[1].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.VisualBasic", resolvedDependencies[2].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[2].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Updating referenced dependency
+    // The same as previous test, but the transitive dependency (Microsoft.CodeAnalysis.Common) is in the existing list
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewSingleTransitiveDependencyExisting()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewSingleTransitiveDependencyExisting)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Microsoft.CodeAnalysis.Compilers" Version="4.9.2" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="4.9.2" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.9.2" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.VisualBasic" Version="4.9.2" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.Compilers", "4.9.2", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.9.2", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp", "4.9.2", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.VisualBasic", "4.9.2", DependencyType.PackageReference)
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.10.0", DependencyType.PackageReference)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(4, resolvedDependencies.Length);
+            Assert.Equal("Microsoft.CodeAnalysis.Compilers", resolvedDependencies[0].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.Common", resolvedDependencies[1].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp", resolvedDependencies[2].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[2].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.VisualBasic", resolvedDependencies[3].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[3].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // A combination of the third and fourth test, to measure efficiency of updating separate families
+    // Keeping a dependency that was not included in the original list (Newtonsoft.Json)
+    // Not keeping a dependency that was not included in the original list (Microsoft.CodeAnalysis.Common)
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewSelectiveAdditionPackages()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewSelectiveAdditionPackages)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Microsoft.CodeAnalysis.Compilers" Version="4.9.2" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.9.2" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.VisualBasic" Version="4.9.2" />
+                    <PackageReference Include="Newtonsoft.Json.Bson" Version="1.0.2" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.Compilers", "4.9.2", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp", "4.9.2", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.VisualBasic", "4.9.2", DependencyType.PackageReference),
+                new Dependency("Newtonsoft.Json.Bson", "1.0.2", DependencyType.PackageReference)
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.10.0", DependencyType.PackageReference),
+                new Dependency("Newtonsoft.Json", "13.0.1", DependencyType.Unknown)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(5, resolvedDependencies.Length);
+            Assert.Equal("Microsoft.CodeAnalysis.Compilers", resolvedDependencies[0].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp", resolvedDependencies[1].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.VisualBasic", resolvedDependencies[2].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[2].Version);
+            Assert.Equal("Newtonsoft.Json.Bson", resolvedDependencies[3].Name);
+            Assert.Equal("1.0.2", resolvedDependencies[3].Version);
+            Assert.Equal("Newtonsoft.Json", resolvedDependencies[4].Name);
+            Assert.Equal("13.0.1", resolvedDependencies[4].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Two top level packages (Buildalyzer), (Microsoft.CodeAnalysis.CSharp.Scripting) that share a dependency (Microsoft.CodeAnalysis.Csharp)
+    // Updating ONE of the top level packages, which updates the dependencies and their other "parents"
+    // First family: Buildalyzer 7.0.1 requires Microsoft.CodeAnalysis.CSharp to be >= 4.0.0 and Microsoft.CodeAnalysis.Common to be 4.0.0 (@ 6.0.4, Microsoft.CodeAnalysis.Common isn't a dependency of buildalyzer)
+    // Second family: Microsoft.CodeAnalysis.CSharp.Scripting 4.0.0 requires Microsoft.CodeAnalysis.CSharp 4.0.0 and Microsoft.CodeAnalysis.Common to be 4.0.0 (Specific version)
+    // Updating Buildalyzer to 7.0.1 will update its transitive dependency (Microsoft.CodeAnalysis.Common) and then its transitive dependency's "family"
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewSharingDependency()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewSharingDependency)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Buildalyzer" Version="6.0.4" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.Csharp.Scripting" Version="3.10.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="3.10.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="3.10.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Buildalyzer", "6.0.4", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp.Scripting", "3.10.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp", "3.10.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.Common", "3.10.0", DependencyType.PackageReference),
+            };
+            var update = new[]
+            {
+                new Dependency("Buildalyzer", "7.0.1", DependencyType.PackageReference),
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(4, resolvedDependencies.Length);
+            Assert.Equal("Buildalyzer", resolvedDependencies[0].Name);
+            Assert.Equal("7.0.1", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp.Scripting", resolvedDependencies[1].Name);
+            Assert.Equal("4.0.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp", resolvedDependencies[2].Name);
+            Assert.Equal("4.0.0", resolvedDependencies[2].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.Common", resolvedDependencies[3].Name);
+            Assert.Equal("4.0.0", resolvedDependencies[3].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Updating two families at once to test efficiency
+    // First family: Direct dependency (Microsoft.CodeAnalysis.Common) needs to be updated, which will then need to update in the existing list its dependency (System.Collections.Immutable) and "parent" (Microsoft.CodeAnalysis.Csharp.Scripting)
+    // Second family: Updating the root package (Azure.Core) in the existing list will also need to update its dependency (Microsoft.Bcl.AsyncInterfaces)
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewUpdatingEntireFamily()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewUpdatingEntireFamily)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="System.Collections.Immutable" Version="7.0.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="4.8.0" />
+                    <PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Version="1.0.0" />
+                    <PackageReference Include="Azure.Core" Version="1.21.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("System.Collections.Immutable", "7.0.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp.Scripting", "4.8.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.Bcl.AsyncInterfaces", "1.0.0", DependencyType.Unknown),
+                new Dependency("Azure.Core", "1.21.0", DependencyType.PackageReference),
+
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.10.0", DependencyType.PackageReference),
+                new Dependency("Azure.Core", "1.22.0", DependencyType.PackageReference)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(4, resolvedDependencies.Length);
+            Assert.Equal("System.Collections.Immutable", resolvedDependencies[0].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp.Scripting", resolvedDependencies[1].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.Bcl.AsyncInterfaces", resolvedDependencies[2].Name);
+            Assert.Equal("1.1.1", resolvedDependencies[2].Version);
+            Assert.Equal("Azure.Core", resolvedDependencies[3].Name);
+            Assert.Equal("1.22.0", resolvedDependencies[3].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Similar to the last test, except Microsoft.CodeAnalysis.Common is in the existing list
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewUpdatingTopLevelAndDependency()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewUpdatingTopLevelAndDependency)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="System.Collections.Immutable" Version="7.0.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="4.8.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="4.8.0" />
+                    <PackageReference Include="Microsoft.Bcl.AsyncInterfaces" Version="1.0.0" />
+                    <PackageReference Include="Azure.Core" Version="1.21.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("System.Collections.Immutable", "7.0.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp.Scripting", "4.8.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.8.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.Bcl.AsyncInterfaces", "1.0.0", DependencyType.Unknown),
+                new Dependency("Azure.Core", "1.21.0", DependencyType.PackageReference),
+
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.10.0", DependencyType.PackageReference),
+                new Dependency("Azure.Core", "1.22.0", DependencyType.PackageReference)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(5, resolvedDependencies.Length);
+            Assert.Equal("System.Collections.Immutable", resolvedDependencies[0].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp.Scripting", resolvedDependencies[1].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.Common", resolvedDependencies[2].Name);
+            Assert.Equal("4.10.0", resolvedDependencies[2].Version);
+            Assert.Equal("Microsoft.Bcl.AsyncInterfaces", resolvedDependencies[3].Name);
+            Assert.Equal("1.1.1", resolvedDependencies[3].Version);
+            Assert.Equal("Azure.Core", resolvedDependencies[4].Name);
+            Assert.Equal("1.22.0", resolvedDependencies[4].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Out of scope test: AutoMapper.Extensions.Microsoft.DependencyInjection's versions are not yet compatible
+    // To update root package (AutoMapper.Collection) to 10.0.0, its dependency (AutoMapper) needs to update to 13.0.0. 
+    // However, there is no higher version of AutoMapper's other "parent" (AutoMapper.Extensions.Microsoft.DependencyInjection) that is compatible with the new version
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewOutOfScope()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewOutOfScope)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="AutoMapper.Extensions.Microsoft.DependencyInjection" Version="12.0.1" />
+                    <PackageReference Include="AutoMapper" Version="12.0.1" />
+                    <PackageReference Include="AutoMapper.Collection" Version="9.0.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("AutoMapper.Extensions.Microsoft.DependencyInjection", "12.0.1", DependencyType.PackageReference),
+                new Dependency("AutoMapper", "12.0.1", DependencyType.PackageReference),
+                new Dependency("AutoMapper.Collection", "9.0.0", DependencyType.PackageReference)
+            };
+            var update = new[]
+            {
+                new Dependency("AutoMapper.Collection", "10.0.0", DependencyType.PackageReference)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(3, resolvedDependencies.Length);
+            Assert.Equal("AutoMapper.Extensions.Microsoft.DependencyInjection", resolvedDependencies[0].Name);
+            Assert.Equal("12.0.1", resolvedDependencies[0].Version);
+            Assert.Equal("AutoMapper", resolvedDependencies[1].Name);
+            Assert.Equal("12.0.1", resolvedDependencies[1].Version);
+            Assert.Equal("AutoMapper.Collection", resolvedDependencies[2].Name);
+            Assert.Equal("9.0.0", resolvedDependencies[2].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Two dependencies (Microsoft.Extensions.Caching.Memory), (Microsoft.EntityFrameworkCore.Analyzers) used by the same parent (Microsoft.EntityFrameworkCore), updating one of the dependencies
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewTwoDependenciesShareSameParent()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewTwoDependenciesShareSameParent)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="7.0.11" />
+                    <PackageReference Include="Microsoft.EntityFrameworkCore.Analyzers" Version="7.0.11" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Microsoft.EntityFrameworkCore", "7.0.11", DependencyType.PackageReference),
+                new Dependency("Microsoft.EntityFrameworkCore.Analyzers", "7.0.11", DependencyType.PackageReference)
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.Extensions.Caching.Memory", "8.0.0", DependencyType.PackageReference)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(2, resolvedDependencies.Length);
+            Assert.Equal("Microsoft.EntityFrameworkCore", resolvedDependencies[0].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.EntityFrameworkCore.Analyzers", resolvedDependencies[1].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[1].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Updating referenced package
+    // 4 dependency chain to be updated. Since the package to be updated is in the existing list, do not update its parents since we want to change as little as possible
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewFamilyOfFourExisting()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewFamilyOfFourExisting)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="7.0.0" />
+                    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="7.0.0" />
+                    <PackageReference Include= "Microsoft.EntityFrameworkCore" Version="7.0.0" />
+                    <PackageReference Include="Microsoft.EntityFrameworkCore.Analyzers" Version="7.0.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Microsoft.EntityFrameworkCore.Design", "7.0.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.EntityFrameworkCore.Relational", "7.0.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.EntityFrameworkCore", "7.0.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.EntityFrameworkCore.Analyzers", "7.0.0", DependencyType.PackageReference)
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.EntityFrameworkCore.Analyzers", "8.0.0", DependencyType.PackageReference)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(4, resolvedDependencies.Length);
+            Assert.Equal("Microsoft.EntityFrameworkCore.Design", resolvedDependencies[0].Name);
+            Assert.Equal("7.0.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.EntityFrameworkCore.Relational", resolvedDependencies[1].Name);
+            Assert.Equal("7.0.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.EntityFrameworkCore", resolvedDependencies[2].Name);
+            Assert.Equal("7.0.0", resolvedDependencies[2].Version);
+            Assert.Equal("Microsoft.EntityFrameworkCore.Analyzers", resolvedDependencies[3].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[3].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Updating unreferenced package
+    // 4 dependency chain to be updated, dependency to be updated is not in the existing list, so its family will all be updated
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewFamilyOfFourNotInExisting()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewFamilyOfFourNotInExisting)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="7.0.0" />
+                    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="7.0.0" />
+                    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="7.0.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Microsoft.EntityFrameworkCore.Design", "7.0.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.EntityFrameworkCore.Relational", "7.0.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.EntityFrameworkCore", "7.0.0", DependencyType.PackageReference),
+            };
+            var update = new[]
+            {
+                new Dependency("Microsoft.EntityFrameworkCore.Analyzers", "8.0.0", DependencyType.PackageReference)
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(3, resolvedDependencies.Length);
+            Assert.Equal("Microsoft.EntityFrameworkCore.Design", resolvedDependencies[0].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.EntityFrameworkCore.Relational", resolvedDependencies[1].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.EntityFrameworkCore", resolvedDependencies[2].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[2].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Updating a referenced transitive dependency
+    // Updating a transtitive dependency (System.Collections.Immutable) to 8.0.0, which will update its "parent" (Microsoft.CodeAnalysis.CSharp) and its "grandparent" (Microsoft.CodeAnalysis.CSharp.Workspaces) to update
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewFamilyOfFourSpecificExisting()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewFamilyOfFourSpecificExisting)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="System.Collections.Immutable" Version="7.0.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="4.8.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("System.Collections.Immutable", "7.0.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp.Workspaces", "4.8.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp", "4.8.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.8.0", DependencyType.PackageReference),
+            };
+            var update = new[]
+            {
+                new Dependency("System.Collections.Immutable", "8.0.0", DependencyType.PackageReference),
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(4, resolvedDependencies.Length);
+            Assert.Equal("System.Collections.Immutable", resolvedDependencies[0].Name);
+            Assert.Equal("8.0.0", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp.Workspaces", resolvedDependencies[1].Name);
+            Assert.Equal("4.8.0", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp", resolvedDependencies[2].Name);
+            Assert.Equal("4.8.0", resolvedDependencies[2].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.Common", resolvedDependencies[3].Name);
+            Assert.Equal("4.8.0", resolvedDependencies[3].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+
+    // Similar to the last test, with the "grandchild" (System.Collections.Immutable) not in the existing list
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewFamilyOfFourSpecificNotInExisting()
+    {
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedNewFamilyOfFourSpecificNotInExisting)}_");
+
+        try
+        {
+            var projectPath = Path.Join(repoRoot.FullName, "project.csproj");
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net8.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
+                    <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="4.8.0" />
+                  </ItemGroup>
+                </Project>
+                """);
+
+            var dependencies = new[]
+            {
+                new Dependency("Microsoft.CodeAnalysis.CSharp.Workspaces", "4.8.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.CSharp", "4.8.0", DependencyType.PackageReference),
+                new Dependency("Microsoft.CodeAnalysis.Common", "4.8.0", DependencyType.PackageReference),
+
+            };
+            var update = new[]
+            {
+                new Dependency("System.Collections.Immutable", "8.0.0", DependencyType.PackageReference),
+            };
+
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new Logger(true));
+            Assert.NotNull(resolvedDependencies);
+            Assert.Equal(3, resolvedDependencies.Length);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp.Workspaces", resolvedDependencies[0].Name);
+            Assert.Equal("4.9.2", resolvedDependencies[0].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.CSharp", resolvedDependencies[1].Name);
+            Assert.Equal("4.9.2", resolvedDependencies[1].Version);
+            Assert.Equal("Microsoft.CodeAnalysis.Common", resolvedDependencies[2].Name);
+            Assert.Equal("4.9.2", resolvedDependencies[2].Version);
+        }
+        finally
+        {
+            repoRoot.Delete(recursive: true);
+        }
+    }
+    #endregion
+
     public static IEnumerable<object[]> GetTopLevelPackageDependencyInfosTestData()
     {
         // simple case