dependabot-nuget 0.278.0 → 0.279.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdaterWorker.cs

@@ -25,57 +25,19 @@ public class UpdaterWorker
 
     public async Task RunAsync(string repoRootPath, string workspacePath, string dependencyName, string previousDependencyVersion, string newDependencyVersion, bool isTransitive, string? resultOutputPath = null)
     {
-        var result = await RunAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
-        if (resultOutputPath is { })
-        {
-            await WriteResultFile(result, resultOutputPath, _logger);
-        }
-    }
-
-    public async Task<UpdateOperationResult> RunAsync(string repoRootPath, string workspacePath, string dependencyName, string previousDependencyVersion, string newDependencyVersion, bool isTransitive)
-    {
-        MSBuildHelper.RegisterMSBuild(Environment.CurrentDirectory, repoRootPath);
-        UpdateOperationResult result;
-
-        if (!Path.IsPathRooted(workspacePath) || !File.Exists(workspacePath))
-        {
-            workspacePath = Path.GetFullPath(Path.Join(repoRootPath, workspacePath));
-        }
-
+        UpdateOperationResult result = new(); // assumed to be ok until proven otherwise
         try
         {
-            if (!isTransitive)
-            {
-                await DotNetToolsJsonUpdater.UpdateDependencyAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, _logger);
-                await GlobalJsonUpdater.UpdateDependencyAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, _logger);
-            }
-
-            var extension = Path.GetExtension(workspacePath).ToLowerInvariant();
-            switch (extension)
-            {
-                case ".sln":
-                    await RunForSolutionAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
-                    break;
-                case ".proj":
-                    await RunForProjFileAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
-                    break;
-                case ".csproj":
-                case ".fsproj":
-                case ".vbproj":
-                    await RunForProjectAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
-                    break;
-                default:
-                    _logger.Log($"File extension [{extension}] is not supported.");
-                    break;
-            }
-
-            result = new(); // all ok
-            _logger.Log("Update complete.");
+            result = await RunAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
         }
         catch (HttpRequestException ex)
         when (ex.StatusCode == HttpStatusCode.Unauthorized || ex.StatusCode == HttpStatusCode.Forbidden)
         {
-            // TODO: consolidate this error handling between AnalyzeWorker, DiscoveryWorker, and UpdateWorker
+            if (!Path.IsPathRooted(workspacePath) || !File.Exists(workspacePath))
+            {
+                workspacePath = Path.GetFullPath(Path.Join(repoRootPath, workspacePath));
+            }
+
             result = new()
             {
                 ErrorType = ErrorType.AuthenticationFailure,
@@ -91,8 +53,50 @@ public class UpdaterWorker
             };
         }
 
+        if (resultOutputPath is { })
+        {
+            await WriteResultFile(result, resultOutputPath, _logger);
+        }
+    }
+
+    public async Task<UpdateOperationResult> RunAsync(string repoRootPath, string workspacePath, string dependencyName, string previousDependencyVersion, string newDependencyVersion, bool isTransitive)
+    {
+        MSBuildHelper.RegisterMSBuild(Environment.CurrentDirectory, repoRootPath);
+
+        if (!Path.IsPathRooted(workspacePath) || !File.Exists(workspacePath))
+        {
+            workspacePath = Path.GetFullPath(Path.Join(repoRootPath, workspacePath));
+        }
+
+        if (!isTransitive)
+        {
+            await DotNetToolsJsonUpdater.UpdateDependencyAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, _logger);
+            await GlobalJsonUpdater.UpdateDependencyAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, _logger);
+        }
+
+        var extension = Path.GetExtension(workspacePath).ToLowerInvariant();
+        switch (extension)
+        {
+            case ".sln":
+                await RunForSolutionAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                break;
+            case ".proj":
+                await RunForProjFileAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                break;
+            case ".csproj":
+            case ".fsproj":
+            case ".vbproj":
+                await RunForProjectAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                break;
+            default:
+                _logger.Log($"File extension [{extension}] is not supported.");
+                break;
+        }
+
+        _logger.Log("Update complete.");
+
         _processedProjectPaths.Clear();
-        return result;
+        return new UpdateOperationResult();
     }
 
     internal static async Task WriteResultFile(UpdateOperationResult result, string resultOutputPath, Logger logger)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -322,7 +322,7 @@ internal static partial class MSBuildHelper
         try
         {
             var tempProjectPath = await CreateTempProjectAsync(tempDirectory, repoRoot, projectPath, targetFramework, packages);
-            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"restore \"{tempProjectPath}\"", workingDirectory: tempDirectory.FullName);
+            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", ["restore", tempProjectPath], workingDirectory: tempDirectory.FullName);
 
             // NU1608: Detected package version outside of dependency constraint
 
@@ -359,7 +359,7 @@ internal static partial class MSBuildHelper
         try
         {
             string tempProjectPath = await CreateTempProjectAsync(tempDirectory, repoRoot, projectPath, targetFramework, packages);
-            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"restore \"{tempProjectPath}\"", workingDirectory: tempDirectory.FullName);
+            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", ["restore", tempProjectPath], workingDirectory: tempDirectory.FullName);
 
             // Add Dependency[] packages to List<PackageToUpdate> existingPackages
             List<PackageToUpdate> existingPackages = packages
@@ -515,7 +515,7 @@ internal static partial class MSBuildHelper
         try
         {
             var tempProjectPath = await CreateTempProjectAsync(tempDirectory, repoRoot, projectPath, targetFramework, packages);
-            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"restore \"{tempProjectPath}\"", workingDirectory: tempDirectory.FullName);
+            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", ["restore", tempProjectPath], workingDirectory: tempDirectory.FullName);
             ThrowOnUnauthenticatedFeed(stdOut);
 
             // simple cases first
@@ -540,7 +540,7 @@ internal static partial class MSBuildHelper
             foreach ((string PackageName, NuGetVersion packageVersion) in badPackagesAndVersions)
             {
                 // this command dumps a JSON object with all versions of the specified package from all package sources
-                (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"package search {PackageName} --exact-match --format json", workingDirectory: tempDirectory.FullName);
+                (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", ["package", "search", PackageName, "--exact-match", "--format", "json"], workingDirectory: tempDirectory.FullName);
                 if (exitCode != 0)
                 {
                     continue;
@@ -770,7 +770,7 @@ internal static partial class MSBuildHelper
             var topLevelPackagesNames = packages.Select(p => p.Name).ToHashSet(StringComparer.OrdinalIgnoreCase);
             var tempProjectPath = await CreateTempProjectAsync(tempDirectory, repoRoot, projectPath, targetFramework, packages);
 
-            var (exitCode, stdout, stderr) = await ProcessEx.RunAsync("dotnet", $"build \"{tempProjectPath}\" /t:_ReportDependencies", workingDirectory: tempDirectory.FullName);
+            var (exitCode, stdout, stderr) = await ProcessEx.RunAsync("dotnet", ["build", tempProjectPath, "/t:_ReportDependencies"], workingDirectory: tempDirectory.FullName);
             ThrowOnUnauthenticatedFeed(stdout);
 
             if (exitCode == 0)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/NuGetHelper.cs

@@ -26,7 +26,7 @@ internal static class NuGetHelper
         try
         {
             var tempProjectPath = await MSBuildHelper.CreateTempProjectAsync(tempDirectory, repoRoot, projectPath, "netstandard2.0", packages, usePackageDownload: true);
-            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"restore \"{tempProjectPath}\"");
+            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", ["restore", tempProjectPath]);
 
             return exitCode == 0;
         }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/ProcessExtensions.cs

@@ -5,17 +5,15 @@ namespace NuGetUpdater.Core;
 
 public static class ProcessEx
 {
-    public static Task<(int ExitCode, string Output, string Error)> RunAsync(string fileName, string arguments = "", string? workingDirectory = null)
+    public static Task<(int ExitCode, string Output, string Error)> RunAsync(string fileName, IEnumerable<string>? arguments = null, string? workingDirectory = null)
     {
         var tcs = new TaskCompletionSource<(int, string, string)>();
 
         var redirectInitiated = new ManualResetEventSlim();
         var process = new Process
         {
-            StartInfo =
+            StartInfo = new ProcessStartInfo(fileName, arguments ?? [])
             {
-                FileName = fileName,
-                Arguments = arguments,
                 UseShellExecute = false, // required to redirect output
                 RedirectStandardOutput = true,
                 RedirectStandardError = true,

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/RequirementTests.cs

@@ -46,11 +46,14 @@ public class RequirementTests
     }
 
     [Theory]
+    [InlineData("> *", "> 0")] // standard wildcard, no digits
     [InlineData("> 1.*", "> 1.0")] // standard wildcard, single digit
     [InlineData("> 1.2.*", "> 1.2.0")] // standard wildcard, multiple digit
+    [InlineData("> a", "> 0")] // alternate wildcard, no digits
     [InlineData("> 1.a", "> 1.0")] // alternate wildcard, single digit
     [InlineData("> 1.2.a", "> 1.2.0")] // alternate wildcard, multiple digit
-    public void Parse_ConvertsWildcardInVersion(string givenRequirementString, string expectedRequirementString)
+    [InlineData(">= 1.40.0, ", ">= 1.40.0")] // empty string following comma
+    public void Parse_Requirement(string givenRequirementString, string expectedRequirementString)
     {
         var parsedRequirement = Requirement.Parse(givenRequirementString);
         var actualRequirementString = parsedRequirement.ToString();

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/MockNuGetPackage.cs

@@ -315,7 +315,7 @@ namespace NuGetUpdater.Core.Test
                     </Project>
                     """
                 );
-                var (exitCode, stdout, stderr) = ProcessEx.RunAsync("dotnet", $"msbuild {projectPath} /t:_ReportCurrentSdkVersion").Result;
+                var (exitCode, stdout, stderr) = ProcessEx.RunAsync("dotnet", ["msbuild", projectPath, "/t:_ReportCurrentSdkVersion"]).Result;
                 if (exitCode != 0)
                 {
                     throw new Exception($"Failed to report the current SDK version:\n{stdout}\n{stderr}");
@@ -391,6 +391,7 @@ namespace NuGetUpdater.Core.Test
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net6.0"),
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net7.0"),
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net8.0"),
+            WellKnownReferencePackage("Microsoft.AspNetCore.App", "net9.0"),
             WellKnownReferencePackage("Microsoft.NETCore.App", "net6.0",
             [
                 ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
@@ -412,9 +413,17 @@ namespace NuGetUpdater.Core.Test
                     </FileList>
                     """))
             ]),
+            WellKnownReferencePackage("Microsoft.NETCore.App", "net9.0",
+            [
+                ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
+                    <FileList TargetFrameworkIdentifier=".NETCoreApp" TargetFrameworkVersion="9.0" FrameworkName="Microsoft.NETCore.App" Name=".NET Runtime">
+                    </FileList>
+                    """))
+            ]),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net6.0"),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net7.0"),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net8.0"),
+            WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net9.0"),
         ];
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/RunWorkerTests.cs

@@ -169,6 +169,98 @@ public class RunWorkerTests
         );
     }
 
+    [Fact]
+    public async Task PrivateSourceAuthenticationFailureIsForwaredToApiHandler()
+    {
+        static (int, string) TestHttpHandler(string uriString)
+        {
+            var uri = new Uri(uriString, UriKind.Absolute);
+            var baseUrl = $"{uri.Scheme}://{uri.Host}:{uri.Port}";
+            return uri.PathAndQuery switch
+            {
+                // initial request is good
+                "/index.json" => (200, $$"""
+                    {
+                        "version": "3.0.0",
+                        "resources": [
+                            {
+                                "@id": "{{baseUrl}}/download",
+                                "@type": "PackageBaseAddress/3.0.0"
+                            },
+                            {
+                                "@id": "{{baseUrl}}/query",
+                                "@type": "SearchQueryService"
+                            },
+                            {
+                                "@id": "{{baseUrl}}/registrations",
+                                "@type": "RegistrationsBaseUrl"
+                            }
+                        ]
+                    }
+                    """),
+                // all other requests are unauthorized
+                _ => (401, "{}"),
+            };
+        }
+        using var http = TestHttpServer.CreateTestStringServer(TestHttpHandler);
+        await RunAsync(
+            packages:
+            [
+            ],
+            job: new Job()
+            {
+                PackageManager = "nuget",
+                Source = new()
+                {
+                    Provider = "github",
+                    Repo = "test/repo",
+                    Directory = "/",
+                },
+                AllowedUpdates =
+                [
+                    new() { UpdateType = "all" }
+                ]
+            },
+            files:
+            [
+                ("NuGet.Config", $"""
+                    <configuration>
+                      <packageSources>
+                        <clear />
+                        <add key="private_feed" value="{http.BaseUrl.TrimEnd('/')}/index.json" allowInsecureConnections="true" />
+                      </packageSources>
+                    </configuration>
+                    """),
+                ("project.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="1.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """)
+            ],
+            expectedResult: new RunResult()
+            {
+                Base64DependencyFiles = [],
+                BaseCommitSha = "TEST-COMMIT-SHA",
+            },
+            expectedApiMessages:
+            [
+                new PrivateSourceAuthenticationFailure()
+                {
+                    Details = $"({http.BaseUrl.TrimEnd('/')}/index.json)"
+                },
+                new MarkAsProcessed()
+                {
+                    BaseCommitSha = "TEST-COMMIT-SHA",
+                }
+            ]
+        );
+    }
+
     private static async Task RunAsync(Job job, TestFile[] files, RunResult expectedResult, object[] expectedApiMessages, MockNuGetPackage[]? packages = null)
     {
         // arrange

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/TestApiHandler.cs

@@ -9,27 +9,33 @@ internal class TestApiHandler : IApiHandler
 
     public IEnumerable<(Type Type, object Object)> ReceivedMessages => _receivedMessages;
 
+    public Task RecordUpdateJobError(JobErrorBase error)
+    {
+        _receivedMessages.Add((error.GetType(), error));
+        return Task.CompletedTask;
+    }
+
     public Task UpdateDependencyList(UpdatedDependencyList updatedDependencyList)
     {
-        _receivedMessages.Add((typeof(UpdatedDependencyList), updatedDependencyList));
+        _receivedMessages.Add((updatedDependencyList.GetType(), updatedDependencyList));
         return Task.CompletedTask;
     }
 
     public Task IncrementMetric(IncrementMetric incrementMetric)
     {
-        _receivedMessages.Add((typeof(IncrementMetric), incrementMetric));
+        _receivedMessages.Add((incrementMetric.GetType(), incrementMetric));
         return Task.CompletedTask;
     }
 
     public Task CreatePullRequest(CreatePullRequest createPullRequest)
     {
-        _receivedMessages.Add((typeof(CreatePullRequest), createPullRequest));
+        _receivedMessages.Add((createPullRequest.GetType(), createPullRequest));
         return Task.CompletedTask;
     }
 
     public Task MarkAsProcessed(MarkAsProcessed markAsProcessed)
     {
-        _receivedMessages.Add((typeof(MarkAsProcessed), markAsProcessed));
+        _receivedMessages.Add((markAsProcessed.GetType(), markAsProcessed));
         return Task.CompletedTask;
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTestBase.cs

@@ -257,14 +257,6 @@ public abstract class UpdateWorkerTestBase : TestBase
                 package.WriteToDirectory(localFeedPath);
             }
 
-            // override various nuget locations
-            foreach (var envName in new[] { "NUGET_PACKAGES", "NUGET_HTTP_CACHE_PATH", "NUGET_SCRATCH", "NUGET_PLUGINS_CACHE_PATH" })
-            {
-                string dir = Path.Join(temporaryDirectory, envName);
-                Directory.CreateDirectory(dir);
-                Environment.SetEnvironmentVariable(envName, dir);
-            }
-
             // ensure only the test feed is used
             string relativeLocalFeedPath = Path.GetRelativePath(temporaryDirectory, localFeedPath);
             await File.WriteAllTextAsync(Path.Join(temporaryDirectory, "NuGet.Config"), $"""
@@ -278,6 +270,14 @@ public abstract class UpdateWorkerTestBase : TestBase
                 """
             );
         }
+
+        // override various nuget locations
+        foreach (var envName in new[] { "NUGET_PACKAGES", "NUGET_HTTP_CACHE_PATH", "NUGET_SCRATCH", "NUGET_PLUGINS_CACHE_PATH" })
+        {
+            string dir = Path.Join(temporaryDirectory, envName);
+            Directory.CreateDirectory(dir);
+            Environment.SetEnvironmentVariable(envName, dir);
+        }
     }
 
     protected static async Task<TestFile[]> RunUpdate(TestFile[] files, Func<string, Task> action)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.Sdk.cs

@@ -16,6 +16,7 @@ public partial class UpdateWorkerTests
         [InlineData("net472")]
         [InlineData("net7.0")]
         [InlineData("net8.0")]
+        [InlineData("net9.0")]
         public async Task UpdateVersionAttribute_InProjectFile_ForPackageReferenceInclude(string tfm)
         {
             // update Some.Package from 9.0.1 to 13.0.1
@@ -186,6 +187,7 @@ public partial class UpdateWorkerTests
                 projectContents: $"""
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
                       <ItemGroup>
@@ -199,6 +201,7 @@ public partial class UpdateWorkerTests
                     (Path: "src/Project/Project.csproj", Content: """
                         <Project Sdk="Microsoft.NET.Sdk">
                           <PropertyGroup>
+                            <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                             <TargetFramework>net8.0</TargetFramework>
                           </PropertyGroup>
                           <ItemGroup>
@@ -211,6 +214,7 @@ public partial class UpdateWorkerTests
                 expectedProjectContents: $"""
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
                       <ItemGroup>
@@ -224,6 +228,7 @@ public partial class UpdateWorkerTests
                     (Path: "src/Project/Project.csproj", Content: """
                         <Project Sdk="Microsoft.NET.Sdk">
                           <PropertyGroup>
+                            <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                             <TargetFramework>net8.0</TargetFramework>
                           </PropertyGroup>
                           <ItemGroup>
@@ -244,7 +249,7 @@ public partial class UpdateWorkerTests
                     MockNuGetPackage.CreateSimplePackage("Some.Package", "9.0.1", "net8.0"),
                     MockNuGetPackage.CreateSimplePackage("Some.Package", "13.0.1", "net8.0"),
                     // necessary for the `net8.0-windows10.0.19041.0` TFM
-                    new("Microsoft.Windows.SDK.NET.Ref", "10.0.19041.31", Files:
+                    new("Microsoft.Windows.SDK.NET.Ref", "10.0.19041.34", Files:
                     [
                         ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
                             <FileList Name="Windows SDK .NET 6.0">
@@ -548,6 +553,7 @@ public partial class UpdateWorkerTests
                     <Project Sdk="Microsoft.NET.Sdk">
 
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
 
@@ -562,6 +568,7 @@ public partial class UpdateWorkerTests
                     <Project Sdk="Microsoft.NET.Sdk">
 
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
 
@@ -588,6 +595,7 @@ public partial class UpdateWorkerTests
                 projectContents: """
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
                       <ItemGroup>
@@ -608,6 +616,7 @@ public partial class UpdateWorkerTests
                 expectedProjectContents: """
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
                       <ItemGroup>

data/helpers/lib/NuGetUpdater/global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "8.0.300",
+    "version": "9.0.100-rc.1.24452.12",
     "rollForward": "latestMinor"
   }
 }

data/lib/dependabot/nuget/file_updater.rb

@@ -51,7 +51,7 @@ module Dependabot
       sig { override.returns(T::Array[Dependabot::DependencyFile]) }
       def updated_dependency_files
         base_dir = "/"
-        SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
+        all_updated_files = SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
           dependencies.each do |dependency|
             try_update_projects(dependency) || try_update_json(dependency)
           end
@@ -70,6 +70,10 @@ module Dependabot
           end
           updated_files
         end
+
+        raise UpdateNotPossible, dependencies.map(&:name) if all_updated_files.empty?
+
+        all_updated_files
       end
 
       private

data/lib/dependabot/nuget/native_helpers.rb

@@ -242,8 +242,11 @@ module Dependabot
         puts "running NuGet updater:\n" + command
 
         NuGetConfigCredentialHelpers.patch_nuget_config_for_action(credentials) do
+          # default to UseNewNugetPackageResolved _unless_ nuget_legacy_dependency_solver is enabled
           env = {}
-          env["UseNewNugetPackageResolver"] = "true" if Dependabot::Experiments.enabled?(:nuget_dependency_solver)
+          unless Dependabot::Experiments.enabled?(:nuget_legacy_dependency_solver)
+            env["UseNewNugetPackageResolver"] = "true"
+          end
           output = SharedHelpers.run_shell_command(command,
                                                    allow_unsafe_shell_command: true,
                                                    fingerprint: fingerprint,

data/lib/dependabot/nuget/requirement.rb

@@ -42,6 +42,8 @@ module Dependabot
           convert_dotnet_constraint_to_ruby_constraint(req_string)
         end
 
+        requirements = requirements.compact.reject(&:empty?)
+
         super(requirements)
       end
 

data/lib/dependabot/nuget/update_checker/repository_finder.rb

@@ -13,6 +13,7 @@ require "dependabot/nuget/http_response_helpers"
 
 module Dependabot
   module Nuget
+    # rubocop:disable Metrics/ClassLength
     class RepositoryFinder
       extend T::Sig
 
@@ -48,7 +49,15 @@ module Dependabot
         @known_repositories << { url: DEFAULT_REPOSITORY_URL, token: nil } if @known_repositories.empty?
 
         @known_repositories = @known_repositories.map do |repo|
-          { url: URI::DEFAULT_PARSER.escape(repo[:url]), token: repo[:token] }
+          url = repo[:url]
+          begin
+            url = URI::DEFAULT_PARSER.parse(url).to_s
+          rescue URI::InvalidURIError
+            # e.g., the url has spaces or unacceptable symbols
+            url = URI::DEFAULT_PARSER.escape(url)
+          end
+
+          { url: url, token: repo[:token] }
         end
         @known_repositories.uniq
       end
@@ -68,6 +77,20 @@ module Dependabot
         }
       end
 
+      sig { params(source_name: String).returns(String) }
+      def self.escape_source_name_to_element_name(source_name)
+        source_name.chars.map do |c|
+          case c
+          when /[A-Za-z0-9\-_.]/
+            # letters, digits, hyphens, underscores, and periods are all directly allowed
+            c
+          else
+            # otherwise it needs to be escaped as a 4 digit hex value
+            "_x#{c.ord.to_s(16).rjust(4, '0')}_"
+          end
+        end.join
+      end
+
       private
 
       sig { returns(Dependabot::Dependency) }
@@ -376,7 +399,7 @@ module Dependabot
           next source_details[:token] = nil unless key
           next source_details[:token] = nil if key.match?(/^\d/)
 
-          tag = key.gsub(" ", "_x0020_")
+          tag = RepositoryFinder.escape_source_name_to_element_name(key)
           creds_nodes = doc.css("configuration > packageSourceCredentials " \
                                 "> #{tag} > add")
 
@@ -438,5 +461,6 @@ module Dependabot
         end
       end
     end
+    # rubocop:enable Metrics/ClassLength
   end
 end