dependabot-nuget 0.281.0 → 0.283.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3afe0ac22f324c8dacf2c16437998a6b22ad23ae21092f3889d3973eb4a59ddb
-  data.tar.gz: e3aca7ae87df62bb56d264c5eb88e6f14fc9077e3c3c853cd769e34488d95cfa
+  metadata.gz: 6a3154a8f2ecd254dc3463bcca6f6e188e033bcf1d6aea863090f348035a9fe8
+  data.tar.gz: 480467b2e57d224ed646f81cd6614fbad2af03154ba07fc0dc4dde36d2ab3440
 SHA512:
-  metadata.gz: f25c4209f6aab5ae958a092b34c9ab9a5d1473e1322646dcd7f1a7d0e753e681b975516fe5b416ca62c7ba7be219590f17c4541f4635bbe3355b9213e3ff587d
-  data.tar.gz: e058837c6034711c21fd672774b3c37940f0f286af89fbd1e4cdefa9af415647f926bd626f13356bae3304f1e18b98cfcc67390f492ce0d8b06fa4bbf301356b
+  metadata.gz: 8b56eff2a40277413354577fe830f472bf0c46e72ba22cd948f207de01e2c3e0990ba84f60af648ba5e833fe209f8a7cc46b1172aa44987da2a3a6669cab9df5
+  data.tar.gz: 3f0bec73a56ac9e6eeed3e61eee12b0dcac72875325b6e543797b893a7dcbc4e2099f318c8822c115e9db810560df61179f0df68c6008d2474d9b0569a116fb7

data/helpers/lib/NuGetUpdater/Directory.Common.props

@@ -12,6 +12,6 @@
     <CommonTargetFramework>net9.0</CommonTargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <UseArtifactsOutput>true</UseArtifactsOutput>
-    <ArtifactsPath>$(MSBuildThisFileDirectory)artifacts</ArtifactsPath>
+    <ArtifactsPath>$(MSBuildThisFileDirectory)artifacts\$(OS)</ArtifactsPath>
   </PropertyGroup>
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs

@@ -18,6 +18,16 @@ internal static class BindingRedirectManager
     private static readonly XName DependentAssemblyName = AssemblyBinding.GetQualifiedName("dependentAssembly");
     private static readonly XName BindingRedirectName = AssemblyBinding.GetQualifiedName("bindingRedirect");
 
+    /// <summary>
+    /// Updates assembly binding redirects for a project build file.
+    /// </summary>
+    /// <remarks>
+    /// Assembly binding redirects are only applicable to projects targeting .NET Framework.
+    /// .NET Framework targets can appear in SDK-style OR non-SDK-style project files, using either packages.config OR `<PackageReference>` MSBuild items.
+    /// See: https://learn.microsoft.com/en-us/dotnet/framework/configure-apps/redirect-assembly-versions
+    ///      https://learn.microsoft.com/en-us/nuget/resources/check-project-format
+    /// </remarks>
+    /// <param name="projectBuildFile">The project build file (*.xproj) to be updated</param>
     public static async ValueTask UpdateBindingRedirectsAsync(ProjectBuildFile projectBuildFile)
     {
         var configFile = await TryGetRuntimeConfigurationFile(projectBuildFile);
@@ -33,7 +43,7 @@ internal static class BindingRedirectManager
         var bindings = BindingRedirectResolver.GetBindingRedirects(projectBuildFile.Path, references.Select(static x => x.Include));
         if (!bindings.Any())
         {
-            // no bindings to update
+            // no bindings found in the project file, nothing to update
             return;
         }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/{SdkPackageUpdater.cs → PackageReferenceUpdater.cs}

@@ -6,7 +6,18 @@ using NuGet.Versioning;
 
 namespace NuGetUpdater.Core;
 
-internal static class SdkPackageUpdater
+/// <summary>
+/// Handles package updates for projects containing `<PackageReference>` MSBuild items.
+/// </summary>
+/// <remarks>
+/// PackageReference items can appear in both SDK-style AND non-SDK-style project files.
+/// By default, PackageReference is used by [SDK-style] projects targeting .NET Core, .NET Standard, and UWP.
+/// By default, packages.config is used by [non-SDK-style] projects targeting .NET Framework; However, they can be migrated to PackageReference too.
+/// See: https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#project-type-support
+///      https://learn.microsoft.com/en-us/nuget/consume-packages/migrate-packages-config-to-package-reference
+///      https://learn.microsoft.com/en-us/nuget/resources/check-project-format
+/// </remarks>
+internal static class PackageReferenceUpdater
 {
     public static async Task UpdateDependencyAsync(
         string repoRootPath,
@@ -17,8 +28,8 @@ internal static class SdkPackageUpdater
         bool isTransitive,
         ILogger logger)
     {
-        // SDK-style project, modify the XML directly
-        logger.Log("  Running for SDK-style project");
+        // PackageReference project; modify the XML directly
+        logger.Log("  Running 'PackageReference' project direct XML update");
 
         (ImmutableArray<ProjectBuildFile> buildFiles, string[] tfms) = await MSBuildHelper.LoadBuildFilesAndTargetFrameworksAsync(repoRootPath, projectPath);
 
@@ -30,19 +41,26 @@ internal static class SdkPackageUpdater
             return;
         }
 
-        if (isTransitive)
+        var peerDependencies = await GetUpdatedPeerDependenciesAsync(repoRootPath, projectPath, tfms, dependencyName, newDependencyVersion, logger);
+        if (MSBuildHelper.UseNewDependencySolver())
         {
-            await UpdateTransitiveDependencyAsync(repoRootPath, projectPath, dependencyName, newDependencyVersion, buildFiles, logger);
+            await UpdateDependencyWithConflictResolution(repoRootPath, buildFiles, tfms, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive, peerDependencies, logger);
         }
         else
         {
-            var peerDependencies = await GetUpdatedPeerDependenciesAsync(repoRootPath, projectPath, tfms, dependencyName, newDependencyVersion, logger);
-            if (peerDependencies is null)
+            if (isTransitive)
             {
-                return;
+                await UpdateTransitiveDependencyAsync(repoRootPath, projectPath, dependencyName, newDependencyVersion, buildFiles, logger);
             }
+            else
+            {
+                if (peerDependencies is null)
+                {
+                    return;
+                }
 
-            await UpdateTopLevelDepdendency(repoRootPath, buildFiles, tfms, dependencyName, previousDependencyVersion, newDependencyVersion, peerDependencies, logger);
+                await UpdateTopLevelDepdendency(repoRootPath, buildFiles, tfms, dependencyName, previousDependencyVersion, newDependencyVersion, peerDependencies, logger);
+            }
         }
 
         if (!await AreDependenciesCoherentAsync(repoRootPath, projectPath, dependencyName, logger, buildFiles, tfms))
@@ -53,6 +71,61 @@ internal static class SdkPackageUpdater
         await SaveBuildFilesAsync(buildFiles, logger);
     }
 
+    public static async Task UpdateDependencyWithConflictResolution(
+        string repoRootPath,
+        ImmutableArray<ProjectBuildFile> buildFiles,
+        string[] targetFrameworks,
+        string projectPath,
+        string dependencyName,
+        string previousDependencyVersion,
+        string newDependencyVersion,
+        bool isTransitive,
+        IDictionary<string, string> peerDependencies,
+        ILogger logger)
+    {
+        var topLevelDependencies = MSBuildHelper.GetTopLevelPackageDependencyInfos(buildFiles).ToArray();
+        var isDependencyTopLevel = topLevelDependencies.Any(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase));
+        var dependenciesToUpdate = new[] { new Dependency(dependencyName, newDependencyVersion, DependencyType.PackageReference) };
+
+        // update the initial dependency...
+        TryUpdateDependencyVersion(buildFiles, dependencyName, previousDependencyVersion, newDependencyVersion, logger);
+
+        // ...and the peer dependencies...
+        foreach (var (packageName, packageVersion) in peerDependencies.Where(kvp => string.Compare(kvp.Key, dependencyName, StringComparison.OrdinalIgnoreCase) != 0))
+        {
+            TryUpdateDependencyVersion(buildFiles, packageName, previousDependencyVersion: null, newDependencyVersion: packageVersion, logger);
+        }
+
+        // ...and everything else
+        foreach (var projectFile in buildFiles)
+        {
+            foreach (var tfm in targetFrameworks)
+            {
+                var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRootPath, projectFile.Path, tfm, topLevelDependencies, dependenciesToUpdate, logger);
+                if (resolvedDependencies is null)
+                {
+                    logger.Log($"    Unable to resolve dependency conflicts for {projectFile.Path}.");
+                    continue;
+                }
+
+                var isDependencyInResolutionSet = resolvedDependencies.Any(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase));
+                if (isTransitive && !isDependencyTopLevel && isDependencyInResolutionSet)
+                {
+                    // a transitive dependency had to be pinned; add it here
+                    await UpdateTransitiveDependencyAsync(repoRootPath, projectPath, dependencyName, newDependencyVersion, buildFiles, logger);
+                }
+
+                // update all resolved dependencies that aren't the initial dependency
+                foreach (var resolvedDependency in resolvedDependencies
+                                                    .Where(d => !d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase))
+                                                    .Where(d => d.Version is not null))
+                {
+                    TryUpdateDependencyVersion(buildFiles, resolvedDependency.Name, previousDependencyVersion: null, newDependencyVersion: resolvedDependency.Version!, logger);
+                }
+            }
+        }
+    }
+
     /// <summary>
     /// Verifies that the package does not already satisfy the requested dependency version.
     /// </summary>
@@ -307,7 +380,7 @@ internal static class SdkPackageUpdater
         IDictionary<string, string> peerDependencies,
         ILogger logger)
     {
-
+        // update dependencies...
         var result = TryUpdateDependencyVersion(buildFiles, dependencyName, previousDependencyVersion, newDependencyVersion, logger);
         if (result == UpdateResult.NotFound)
         {
@@ -320,26 +393,13 @@ internal static class SdkPackageUpdater
             TryUpdateDependencyVersion(buildFiles, packageName, previousDependencyVersion: null, newDependencyVersion: packageVersion, logger);
         }
 
-        // now make all dependency requirements coherent
+        // ...and make them all coherent
         Dependency[] updatedTopLevelDependencies = MSBuildHelper.GetTopLevelPackageDependencyInfos(buildFiles).ToArray();
         foreach (ProjectBuildFile projectFile in buildFiles)
         {
             foreach (string tfm in targetFrameworks)
             {
-                if (MSBuildHelper.UseNewDependencySolver())
-                {
-                    // Find the index of the dependency we are updating and revert it to the previous version
-                    int dependencyIndex = Array.FindIndex(updatedTopLevelDependencies, d => string.Equals(d.Name, dependencyName, StringComparison.OrdinalIgnoreCase));
-                    if (dependencyIndex != -1)
-                    {
-                        var originalDependency = updatedTopLevelDependencies[dependencyIndex];
-                        updatedTopLevelDependencies[dependencyIndex] = originalDependency with { Version = previousDependencyVersion };
-                    }
-
-                }
-                Dependency[] update = [new Dependency(dependencyName, newDependencyVersion, DependencyType.PackageReference)];
-                Dependency[]? resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRootPath, projectFile.Path, tfm, updatedTopLevelDependencies, update, logger);
-
+                var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsWithBruteForce(repoRootPath, projectFile.Path, tfm, updatedTopLevelDependencies, logger);
                 if (resolvedDependencies is null)
                 {
                     logger.Log($"    Unable to resolve dependency conflicts for {projectFile.Path}.");
@@ -360,7 +420,7 @@ internal static class SdkPackageUpdater
                     continue;
                 }
 
-                // update all dependencies
+                // update all versions
                 foreach (Dependency resolvedDependency in resolvedDependencies
                                                           .Where(d => !d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase))
                                                           .Where(d => d.Version is not null))

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs

@@ -13,6 +13,14 @@ using Console = System.Console;
 
 namespace NuGetUpdater.Core;
 
+/// <summary>
+/// Handles package updates for projects that use packages.config.
+/// </summary>
+/// <remarks>
+/// packages.config can appear in non-SDK-style projects, but not in SDK-style projects.
+/// See: https://learn.microsoft.com/en-us/nuget/reference/packages-config
+///      https://learn.microsoft.com/en-us/nuget/resources/check-project-format
+/// <remarks>
 internal static class PackagesConfigUpdater
 {
     public static async Task UpdateDependencyAsync(
@@ -25,9 +33,8 @@ internal static class PackagesConfigUpdater
         ILogger logger
     )
     {
-        logger.Log($"  Found {NuGetHelper.PackagesConfigFileName}; running with NuGet.exe");
-
-        // use NuGet.exe to perform update
+        // packages.config project; use NuGet.exe to perform update
+        logger.Log($"  Found '{NuGetHelper.PackagesConfigFileName}' project; running NuGet.exe update");
 
         // ensure local packages directory exists
         var projectBuildFile = ProjectBuildFile.Open(repoRootPath, projectPath);
@@ -126,10 +133,10 @@ internal static class PackagesConfigUpdater
                 //    and doesn't appear in the cache.  The message in this case will be "Could not install package
                 //    '<name> <version>'...the package does not contain any assembly references or content files that
                 //    are compatible with that framework.".
+                // 3. Yet another possibility is that the project explicitly imports a targets file without a condition
+                //    of `Exists(...)`.
                 // The solution in all cases is to run `restore` then try the update again.
-                if (!retryingAfterRestore &&
-                    (fullOutput.Contains("Existing packages must be restored before performing an install or update.") ||
-                    fullOutput.Contains("the package does not contain any assembly references or content files that are compatible with that framework.")))
+                if (!retryingAfterRestore && OutputIndicatesRestoreIsRequired(fullOutput))
                 {
                     retryingAfterRestore = true;
                     logger.Log($"    Running NuGet.exe with args: {string.Join(" ", restoreArgs)}");
@@ -139,6 +146,8 @@ internal static class PackagesConfigUpdater
 
                     if (exitCodeAgain != 0)
                     {
+                        MSBuildHelper.ThrowOnMissingFile(fullOutput);
+                        MSBuildHelper.ThrowOnMissingFile(restoreOutput);
                         MSBuildHelper.ThrowOnMissingPackages(restoreOutput);
                         throw new Exception($"Unable to restore.\nOutput:\n${restoreOutput}\n");
                     }
@@ -174,6 +183,13 @@ internal static class PackagesConfigUpdater
         }
     }
 
+    private static bool OutputIndicatesRestoreIsRequired(string output)
+    {
+        return output.Contains("Existing packages must be restored before performing an install or update.")
+            || output.Contains("the package does not contain any assembly references or content files that are compatible with that framework.")
+            || MSBuildHelper.GetMissingFile(output) is not null;
+    }
+
     private static Process[] GetLikelyNuGetSpawnedProcesses()
     {
         var processes = Process.GetProcesses().Where(p => p.ProcessName.StartsWith("CredentialProvider", StringComparison.OrdinalIgnoreCase) == true).ToArray();
@@ -206,7 +222,7 @@ internal static class PackagesConfigUpdater
             {
                 // exact match was found, use it
                 var subpath = GetUpToIndexWithoutTrailingDirectorySeparator(hintPath, hintPathSubStringLocation);
-                return subpath;
+                return subpath.NormalizePathToUnix();
             }
 
             if (partialPathMatch is null)
@@ -244,7 +260,7 @@ internal static class PackagesConfigUpdater
             }
         }
 
-        return partialPathMatch;
+        return partialPathMatch?.NormalizePathToUnix();
     }
 
     private static bool IsHintPathNodeForDependency(this IXmlElementSyntax element, string dependencyName)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdaterWorker.cs

@@ -221,7 +221,7 @@ public class UpdaterWorker
         }
 
         // Some repos use a mix of packages.config and PackageReference
-        await SdkPackageUpdater.UpdateDependencyAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive, _logger);
+        await PackageReferenceUpdater.UpdateDependencyAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive, _logger);
 
         // Update lock file if exists
         if (File.Exists(Path.Combine(Path.GetDirectoryName(projectPath), "packages.lock.json")))

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -341,18 +341,6 @@ internal static partial class MSBuildHelper
     }
 
     internal static async Task<Dependency[]?> ResolveDependencyConflicts(string repoRoot, string projectPath, string targetFramework, Dependency[] packages, Dependency[] update, ILogger logger)
-    {
-        if (UseNewDependencySolver())
-        {
-            return await ResolveDependencyConflictsNew(repoRoot, projectPath, targetFramework, packages, update, logger);
-        }
-        else
-        {
-            return await ResolveDependencyConflictsOld(repoRoot, projectPath, targetFramework, packages, logger);
-        }
-    }
-
-    internal static async Task<Dependency[]?> ResolveDependencyConflictsNew(string repoRoot, string projectPath, string targetFramework, Dependency[] packages, Dependency[] update, ILogger logger)
     {
         var tempDirectory = Directory.CreateTempSubdirectory("package-dependency-coherence_");
         PackageManager packageManager = new PackageManager(repoRoot, projectPath);
@@ -510,7 +498,7 @@ internal static partial class MSBuildHelper
         }
     }
 
-    internal static async Task<Dependency[]?> ResolveDependencyConflictsOld(string repoRoot, string projectPath, string targetFramework, Dependency[] packages, ILogger logger)
+    internal static async Task<Dependency[]?> ResolveDependencyConflictsWithBruteForce(string repoRoot, string projectPath, string targetFramework, Dependency[] packages, ILogger logger)
     {
         var tempDirectory = Directory.CreateTempSubdirectory("package-dependency-coherence_");
         try
@@ -713,6 +701,8 @@ internal static partial class MSBuildHelper
                 <GenerateDependencyFile>true</GenerateDependencyFile>
                 <RunAnalyzers>false</RunAnalyzers>
                 <NuGetInteractive>false</NuGetInteractive>
+                <DesignTimeBuild>true</DesignTimeBuild>
+                <TargetPlatformVersion Condition=" $(TargetFramework.Contains('-')) ">1.0</TargetPlatformVersion>
               </PropertyGroup>
               <ItemGroup>
                 {packageReferences}
@@ -824,13 +814,24 @@ internal static partial class MSBuildHelper
         }
     }
 
-    internal static void ThrowOnMissingFile(string output)
+    internal static string? GetMissingFile(string output)
     {
         var missingFilePattern = new Regex(@"The imported project \""(?<FilePath>.*)\"" was not found");
         var match = missingFilePattern.Match(output);
         if (match.Success)
         {
-            throw new MissingFileException(match.Groups["FilePath"].Value);
+            return match.Groups["FilePath"].Value;
+        }
+
+        return null;
+    }
+
+    internal static void ThrowOnMissingFile(string output)
+    {
+        var missingFile = GetMissingFile(output);
+        if (missingFile is not null)
+        {
+            throw new MissingFileException(missingFile);
         }
     }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/DependencySolverEnvironment.cs

@@ -0,0 +1,12 @@
+namespace NuGetUpdater.Core.Test;
+
+/// <summary>
+/// Prepares the environment to use the new dependency solver.
+/// </summary>
+public class DependencySolverEnvironment : TemporaryEnvironment
+{
+    public DependencySolverEnvironment(bool useDependencySolver = true)
+        : base([("UseNewNugetPackageResolver", useDependencySolver ? "true" : "false")])
+    {
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/PackagesConfigUpdaterTests.cs

@@ -30,7 +30,7 @@ public class PackagesConfigUpdaterTests : TestBase
             """,
             "Newtonsoft.Json",
             "7.0.1",
-            @"..\packages"
+            "../packages"
         ];
 
         // project without namespace
@@ -48,7 +48,7 @@ public class PackagesConfigUpdaterTests : TestBase
             """,
             "Newtonsoft.Json",
             "7.0.1",
-            @"..\packages"
+            "../packages"
         ];
 
         // project with non-standard packages path
@@ -66,7 +66,7 @@ public class PackagesConfigUpdaterTests : TestBase
             """,
             "Newtonsoft.Json",
             "7.0.1",
-            @"..\not-a-path-you-would-expect"
+            "../not-a-path-you-would-expect"
         ];
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/{UpdateWorkerTests.Sdk.cs → UpdateWorkerTests.PackageReference.cs}

@@ -10,7 +10,7 @@ namespace NuGetUpdater.Core.Test.Update;
 
 public partial class UpdateWorkerTests
 {
-    public class Sdk : UpdateWorkerTestBase
+    public class PackageReference : UpdateWorkerTestBase
     {
         [Theory]
         [InlineData("net472")]
@@ -54,12 +54,12 @@ public partial class UpdateWorkerTests
         }
 
         [Theory]
-        [InlineData("true")]
-        [InlineData(null)]
-        public async Task UpdateVersionChildElement_InProjectFile_ForPackageReferenceIncludeTheory(string variableValue)
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task UpdateVersionChildElement_InProjectFile_ForPackageReferenceIncludeTheory(bool useDependencySolver)
         {
             // update Some.Package from 9.0.1 to 13.0.1
-            using var env = new TemporaryEnvironment([("UseNewNugetPackageResolver", variableValue)]);
+            using var _ = new DependencySolverEnvironment(useDependencySolver);
             await TestUpdateForProject("Some.Package", "9.0.1", "13.0.1",
                 packages:
                 [
@@ -95,11 +95,72 @@ public partial class UpdateWorkerTests
               );
         }
 
+        [Theory]
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task PeerDependenciesAreUpdatedEvenWhenNotExplicit(bool useDependencySolver)
+        {
+            using var _ = new DependencySolverEnvironment(useDependencySolver);
+            await TestUpdateForProject("Some.Package", "1.0.0", "2.0.0",
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0", [(null, [("Transitive.Package", "[1.0.0]")])]),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", "net8.0", [(null, [("Transitive.Package", "[2.0.0]")])]),
+                    MockNuGetPackage.CreateSimplePackage("Transitive.Package", "1.0.0", "net8.0"),
+                    MockNuGetPackage.CreateSimplePackage("Transitive.Package", "2.0.0", "net8.0"),
+                ],
+                projectFile: ("a/a.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                        <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                additionalFiles:
+                [
+                    ("Directory.Packages.props", """
+                        <Project>
+                          <ItemGroup>
+                            <PackageVersion Include="Some.Package" Version="1.0.0" />
+                            <PackageVersion Include="Transitive.Package" Version="1.0.0" />
+                          </ItemGroup>
+                        </Project>
+                        """)
+                ],
+                expectedProjectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                        <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                additionalFilesExpected:
+                [
+                    ("Directory.Packages.props", """
+                        <Project>
+                          <ItemGroup>
+                            <PackageVersion Include="Some.Package" Version="2.0.0" />
+                            <PackageVersion Include="Transitive.Package" Version="2.0.0" />
+                          </ItemGroup>
+                        </Project>
+                        """)
+                ]
+            );
+        }
+
         [Fact]
         public async Task CallingResolveDependencyConflictsNew()
         {
             // update Microsoft.CodeAnalysis.Common from 4.9.2 to 4.10.0
-            using var env = new TemporaryEnvironment([("UseNewNugetPackageResolver", "true")]);
+            using var _ = new DependencySolverEnvironment();
             await TestUpdateForProject("Microsoft.CodeAnalysis.Common", "4.9.2", "4.10.0",
                 // initial
                 projectContents: $"""
@@ -535,11 +596,11 @@ public partial class UpdateWorkerTests
         }
 
         [Theory]
-        [InlineData(null)]
-        [InlineData("true")]
-        public async Task AddPackageReference_InProjectFile_ForTransientDependency(string variableValue)
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task AddPackageReference_InProjectFile_ForTransientDependency(bool useDependencySolver)
         {
-            using var env = new TemporaryEnvironment([("UseNewNugetPackageResolver", variableValue)]);
+            using var _ = new DependencySolverEnvironment(useDependencySolver);
             // add transient package Some.Transient.Dependency from 5.0.1 to 5.0.2
             await TestUpdateForProject("Some.Transient.Dependency", "5.0.1", "5.0.2", isTransitive: true,
                 packages:
@@ -2914,12 +2975,51 @@ public partial class UpdateWorkerTests
             );
         }
 
+        [Fact]
+        public async Task UpdatingTransitiveDependencyWithNewSolverCanUpdateJustTheTopLevelPackage()
+        {
+            // we've been asked to explicitly update a transitive dependency, but we can solve it by updating the top-level package instead
+            using var _ = new DependencySolverEnvironment();
+            await TestUpdateForProject("Transitive.Package", "1.0.0", "2.0.0",
+                isTransitive: true,
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0", [("net8.0", [("Transitive.Package", "[1.0.0]")])]),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", "net8.0", [("net8.0", [("Transitive.Package", "[2.0.0]")])]),
+                    MockNuGetPackage.CreateSimplePackage("Transitive.Package", "1.0.0", "net8.0"),
+                    MockNuGetPackage.CreateSimplePackage("Transitive.Package", "2.0.0", "net8.0"),
+                ],
+                projectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="1.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                expectedProjectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="2.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """
+            );
+        }
+
         [Theory]
-        [InlineData("true")]
-        [InlineData(null)]
-        public async Task NoChange_IfThereAreIncoherentVersions(string variableValue)
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task NoChange_IfThereAreIncoherentVersions(bool useDependencySolver)
         {
-            using var env = new TemporaryEnvironment([("UseNewNugetPackageResolver", variableValue)]);
+            using var _ = new DependencySolverEnvironment(useDependencySolver);
 
             // trying to update `Transitive.Dependency` to 1.1.0 would normally pull `Some.Package` from 1.0.0 to 1.1.0,
             // but the TFM doesn't allow it
@@ -2968,6 +3068,42 @@ public partial class UpdateWorkerTests
             );
         }
 
+        [Fact]
+        public async Task ProcessingProjectWithWorkloadReferencesDoesNotFail()
+        {
+            // enumerating the build files will fail if the Aspire workload is not installed; this test ensures we can
+            // still process the update
+            await TestUpdateForProject("Some.Package", "7.0.1", "13.0.1",
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "7.0.1", "net8.0"),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "13.0.1", "net8.0"),
+                ],
+                projectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFrameworks>net8.0-ios;net8.0-android;net8.0-macos;net8.0-maccatalyst;</TargetFrameworks>
+                        <IsAspireHost>true</IsAspireHost>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="7.0.1" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                expectedProjectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFrameworks>net8.0-ios;net8.0-android;net8.0-macos;net8.0-maccatalyst;</TargetFrameworks>
+                        <IsAspireHost>true</IsAspireHost>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="13.0.1" />
+                      </ItemGroup>
+                    </Project>
+                    """
+            );
+        }
+
         [Fact]
         public async Task ProcessingProjectWithAspireDoesNotFailEvenThoughWorkloadIsNotInstalled()
         {
@@ -3005,11 +3141,11 @@ public partial class UpdateWorkerTests
         }
 
         [Theory]
-        [InlineData("true")]
-        [InlineData(null)]
-        public async Task UnresolvablePropertyDoesNotStopOtherUpdates(string variableValue)
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task UnresolvablePropertyDoesNotStopOtherUpdates(bool useDependencySolver)
         {
-            using var env = new TemporaryEnvironment([("UseNewNugetPackageResolver", variableValue)]);
+            using var _ = new DependencySolverEnvironment(useDependencySolver);
 
             // the property `$(SomeUnresolvableProperty)` cannot be resolved
             await TestUpdateForProject("Some.Package", "7.0.1", "13.0.1",
@@ -3044,12 +3180,53 @@ public partial class UpdateWorkerTests
             );
         }
 
+
+        [Theory]
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task ProjectWithWorkloadsShouldNotFail(bool useDependencySolver)
+        {
+            using var _ = new DependencySolverEnvironment(useDependencySolver);
+
+            // the property `$(SomeUnresolvableProperty)` cannot be resolved
+            await TestUpdateForProject("Some.Package", "7.0.1", "13.0.1",
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "7.0.1", "net8.0"),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "13.0.1", "net8.0"),
+                    MockNuGetPackage.CreateSimplePackage("Some.Other.Package", "1.0.0", "net8.0"),
+                ],
+                projectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFrameworks>net8.0;net8.0-ios;net8.0-android;net8.0-macos;net8.0-maccatalyst</TargetFrameworks>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Other.Package" Version="$(SomeUnresolvableProperty)" />
+                        <PackageReference Include="Some.Package" Version="7.0.1" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                expectedProjectContents: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFrameworks>net8.0;net8.0-ios;net8.0-android;net8.0-macos;net8.0-maccatalyst</TargetFrameworks>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Other.Package" Version="$(SomeUnresolvableProperty)" />
+                        <PackageReference Include="Some.Package" Version="13.0.1" />
+                      </ItemGroup>
+                    </Project>
+                    """
+            );
+        }
+
         [Theory]
-        [InlineData("true")]
-        [InlineData(null)]
-        public async Task UpdatingPackageAlsoUpdatesAnythingWithADependencyOnTheUpdatedPackage(string variableValue)
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task UpdatingPackageAlsoUpdatesAnythingWithADependencyOnTheUpdatedPackage(bool useDependencySolver)
         {
-            using var env = new TemporaryEnvironment([("UseNewNugetPackageResolver", variableValue)]);
+            using var _ = new DependencySolverEnvironment(useDependencySolver);
 
             // updating Some.Package from 3.3.30 requires that Some.Package.Extensions also be updated
             await TestUpdateForProject("Some.Package", "3.3.30", "3.4.3",

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.PackagesConfig.cs

@@ -308,6 +308,83 @@ public partial class UpdateWorkerTests
             );
         }
 
+        [Fact]
+        public async Task UpdatePackageWithTargetsFileWhereProjectUsesBackslashes()
+        {
+            // The bug that caused this test to be written did not repro on Windows.  The reason is that the packages
+            // directory is determined to be `..\packages`, but the backslash was retained.  Later when packages were
+            // restored to that location, a directory with a name like `..?packages` would be created which didn't
+            // match the <Import> element's path of "..\packages\..." that had no `Condition="Exists(path)"` attribute.
+            await TestUpdateForProject("Some.Package", "1.0.0", "2.0.0",
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net45"),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", "net45"),
+                    new MockNuGetPackage("Package.With.Targets", "1.0.0", Files: [("build/SomeFile.targets", Encoding.UTF8.GetBytes("<Project />"))]),
+                ],
+                // existing
+                projectFile: ("src/project.csproj", """
+                    <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                      <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                      <PropertyGroup>
+                        <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <None Include="packages.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <Reference Include="Some.Package">
+                          <HintPath>..\packages\Some.Package.1.0.0\lib\net45\Some.Package.dll</HintPath>
+                          <Private>True</Private>
+                        </Reference>
+                      </ItemGroup>
+                      <Import Project="..\packages\Package.With.Targets.1.0.0\build\SomeFile.targets" />
+                      <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                    </Project>
+                    """),
+                additionalFiles:
+                [
+                    ("src/packages.config", """
+                        <?xml version="1.0" encoding="utf-8"?>
+                        <packages>
+                          <package id="Package.With.Targets" version="1.0.0" targetFramework="net45" />
+                          <package id="Some.Package" version="1.0.0" targetFramework="net45" />
+                        </packages>
+                        """)
+                ],
+                // expected
+                expectedProjectContents: """
+                    <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                      <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                      <PropertyGroup>
+                        <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <None Include="packages.config" />
+                      </ItemGroup>
+                      <ItemGroup>
+                        <Reference Include="Some.Package">
+                          <HintPath>..\packages\Some.Package.2.0.0\lib\net45\Some.Package.dll</HintPath>
+                          <Private>True</Private>
+                        </Reference>
+                      </ItemGroup>
+                      <Import Project="..\packages\Package.With.Targets.1.0.0\build\SomeFile.targets" />
+                      <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                    </Project>
+                    """,
+                additionalFilesExpected:
+                [
+                    ("src/packages.config", """
+                        <?xml version="1.0" encoding="utf-8"?>
+                        <packages>
+                          <package id="Package.With.Targets" version="1.0.0" targetFramework="net45" />
+                          <package id="Some.Package" version="2.0.0" targetFramework="net45" />
+                        </packages>
+                        """)
+                ]
+            );
+        }
+
         [Fact]
         public async Task UpdateSingleDependencyInPackagesConfigButNotToLatest()
         {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs

@@ -442,9 +442,9 @@ public class MSBuildHelperTests : TestBase
     }
 
     [Fact]
-    public async Task DependencyConflictsCanBeResolved()
+    public async Task DependencyConflictsCanBeResolvedWithBruteForce()
     {
-        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolved)}_");
+        var repoRoot = Directory.CreateTempSubdirectory($"test_{nameof(DependencyConflictsCanBeResolvedWithBruteForce)}_");
         MockNuGetPackage[] testPackages =
         [
             // some base packages
@@ -483,7 +483,7 @@ public class MSBuildHelperTests : TestBase
             {
                 new Dependency("Some.Other.Package", "1.2.0", DependencyType.PackageReference),
             };
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsWithBruteForce(repoRoot.FullName, projectPath, "net8.0", dependencies, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(2, resolvedDependencies.Length);
             Assert.Equal("Some.Package", resolvedDependencies[0].Name);
@@ -497,6 +497,44 @@ public class MSBuildHelperTests : TestBase
         }
     }
 
+    [Fact]
+    public void UpdateWithWorkloadsTargetFrameworks()
+    {
+        // Arrange
+        var projectContents = """
+            <Project>
+                <PropertyGroup>
+                    <TargetFrameworks>net8.0-ios;net8.0-android;net8.0-macos;net8.0-maccatalyst;</TargetFrameworks>
+                </PropertyGroup>
+                <ItemGroup>
+                    <PackageReference Include="Some.Package" Version="$(PackageVersion1)" />
+                </ItemGroup>
+            </Project>
+            """;
+        var propertyInfo = new Dictionary<string, Property>
+        {
+            { "PackageVersion1", new("PackageVersion1", "1.1.1", "Packages.props") },
+        };
+
+        // Act
+        var (resultType, _, evaluatedValue, _, _) = MSBuildHelper.GetEvaluatedValue(projectContents, propertyInfo);
+
+        Assert.Equal(EvaluationResultType.Success, resultType);
+
+        // Assert
+        Assert.Equal("""
+            <Project>
+                <PropertyGroup>
+                    <TargetFrameworks>net8.0-ios;net8.0-android;net8.0-macos;net8.0-maccatalyst;</TargetFrameworks>
+                </PropertyGroup>
+                <ItemGroup>
+                    <PackageReference Include="Some.Package" Version="1.1.1" />
+                </ItemGroup>
+            </Project>
+            """, evaluatedValue);
+    }
+
+
     #region
     // Updating root package
     // CS-Script Code to 2.0.0 requires its dependency Microsoft.CodeAnalysis.CSharp.Scripting to be 3.6.0 and its transitive dependency Microsoft.CodeAnalysis.Common to be 3.6.0
@@ -533,7 +571,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("CS-Script.Core", "2.0.0", DependencyType.PackageReference),
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(3, resolvedDependencies.Length);
             Assert.Equal("CS-Script.Core", resolvedDependencies[0].Name);
@@ -578,7 +616,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Microsoft.Bcl.AsyncInterfaces", "1.1.1", DependencyType.Unknown)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Single(resolvedDependencies);
             Assert.Equal("Azure.Core", resolvedDependencies[0].Name);
@@ -621,7 +659,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Newtonsoft.Json", "13.0.1", DependencyType.Unknown)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(2, resolvedDependencies.Length);
             Assert.Equal("Newtonsoft.Json.Bson", resolvedDependencies[0].Name);
@@ -671,7 +709,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Microsoft.CodeAnalysis.Common", "4.10.0", DependencyType.PackageReference)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(3, resolvedDependencies.Length);
             Assert.Equal("Microsoft.CodeAnalysis.Compilers", resolvedDependencies[0].Name);
@@ -723,7 +761,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Microsoft.CodeAnalysis.Common", "4.10.0", DependencyType.PackageReference)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(4, resolvedDependencies.Length);
             Assert.Equal("Microsoft.CodeAnalysis.Compilers", resolvedDependencies[0].Name);
@@ -779,7 +817,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Newtonsoft.Json", "13.0.1", DependencyType.Unknown)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(5, resolvedDependencies.Length);
             Assert.Equal("Microsoft.CodeAnalysis.Compilers", resolvedDependencies[0].Name);
@@ -838,7 +876,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Buildalyzer", "7.0.1", DependencyType.PackageReference),
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(4, resolvedDependencies.Length);
             Assert.Equal("Buildalyzer", resolvedDependencies[0].Name);
@@ -895,7 +933,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Azure.Core", "1.22.0", DependencyType.PackageReference)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(4, resolvedDependencies.Length);
             Assert.Equal("System.Collections.Immutable", resolvedDependencies[0].Name);
@@ -952,7 +990,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Azure.Core", "1.22.0", DependencyType.PackageReference)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(5, resolvedDependencies.Length);
             Assert.Equal("System.Collections.Immutable", resolvedDependencies[0].Name);
@@ -1007,7 +1045,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("AutoMapper.Collection", "10.0.0", DependencyType.PackageReference)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(3, resolvedDependencies.Length);
             Assert.Equal("AutoMapper.Extensions.Microsoft.DependencyInjection", resolvedDependencies[0].Name);
@@ -1054,7 +1092,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Microsoft.Extensions.Caching.Memory", "8.0.0", DependencyType.PackageReference)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(2, resolvedDependencies.Length);
             Assert.Equal("Microsoft.EntityFrameworkCore", resolvedDependencies[0].Name);
@@ -1104,7 +1142,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Microsoft.EntityFrameworkCore.Analyzers", "8.0.0", DependencyType.PackageReference)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(4, resolvedDependencies.Length);
             Assert.Equal("Microsoft.EntityFrameworkCore.Design", resolvedDependencies[0].Name);
@@ -1156,7 +1194,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("Microsoft.EntityFrameworkCore.Analyzers", "8.0.0", DependencyType.PackageReference)
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(3, resolvedDependencies.Length);
             Assert.Equal("Microsoft.EntityFrameworkCore.Design", resolvedDependencies[0].Name);
@@ -1208,7 +1246,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("System.Collections.Immutable", "8.0.0", DependencyType.PackageReference),
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(4, resolvedDependencies.Length);
             Assert.Equal("System.Collections.Immutable", resolvedDependencies[0].Name);
@@ -1260,7 +1298,7 @@ public class MSBuildHelperTests : TestBase
                 new Dependency("System.Collections.Immutable", "8.0.0", DependencyType.PackageReference),
             };
 
-            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflictsNew(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
+            var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(repoRoot.FullName, projectPath, "net8.0", dependencies, update, new TestLogger());
             Assert.NotNull(resolvedDependencies);
             Assert.Equal(3, resolvedDependencies.Length);
             Assert.Equal("Microsoft.CodeAnalysis.CSharp.Workspaces", resolvedDependencies[0].Name);

data/lib/dependabot/nuget/file_fetcher.rb

@@ -121,15 +121,11 @@ module Dependabot
       def packages_config_files
         return @packages_config_files if @packages_config_files
 
-        candidate_paths =
-          [*project_files.map { |f| File.dirname(f.name) }, "."].uniq
+        imported_project_files = imported_property_files.filter { |f| f.name.match?(/\.(cs|vb|fs)proj$/) }
 
-        @packages_config_files =
-          candidate_paths.filter_map do |dir|
-            file = repo_contents(dir: dir)
-                   .find { |f| f.name.casecmp("packages.config").zero? }
-            fetch_file_from_host(File.join(dir, file.name)) if file
-          end
+        @packages_config_files = [*project_files, *imported_project_files].filter_map do |f|
+          named_file_next_to_project_file(f, "packages.config")
+        end
       end
 
       sig { returns(T::Array[Dependabot::DependencyFile]) }
@@ -312,6 +308,32 @@ module Dependabot
         found_expected_file
       end
 
+      sig do
+        params(
+          project_file: Dependabot::DependencyFile,
+          expected_file_name: String
+        )
+          .returns(T.nilable(Dependabot::DependencyFile))
+      end
+      def named_file_next_to_project_file(project_file, expected_file_name)
+        found_expected_file = T.let(nil, T.nilable(Dependabot::DependencyFile))
+        directory_path = Pathname.new(directory)
+        full_project_dir = Pathname.new(project_file.directory).join(project_file.name).dirname
+
+        candidate_file_path = Pathname.new(full_project_dir).join(expected_file_name).cleanpath.to_path
+        candidate_directory = Pathname.new(File.dirname(candidate_file_path))
+        relative_candidate_directory = candidate_directory.relative_path_from(directory_path)
+        candidate_file = repo_contents(dir: relative_candidate_directory).find do |f|
+          f.name.casecmp?(expected_file_name)
+        end
+        if candidate_file
+          found_expected_file = fetch_file_from_host(File.join(relative_candidate_directory,
+                                                               candidate_file.name))
+        end
+
+        found_expected_file
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def global_json
         @global_json ||= T.let(fetch_file_if_present("global.json"), T.nilable(Dependabot::DependencyFile))
@@ -355,6 +377,7 @@ module Dependabot
       end
       def fetch_imported_property_files(file:, previously_fetched_files:)
         file_id = file.directory + "/" + file.name
+
         if @fetched_files[file_id]
           T.must(@fetched_files[file_id])
         else
@@ -363,23 +386,37 @@ module Dependabot
             ImportPathsFinder.new(project_file: file).project_reference_paths +
             ImportPathsFinder.new(project_file: file).project_file_paths
 
-          paths.filter_map do |path|
+          # Initialize a set to hold fetched files temporarily to avoid duplicates
+          fetched_files_set = Set.new([file])
+
+          paths.each do |path|
             next if previously_fetched_files.map(&:name).include?(path)
             next if file.name == path
             next if path.include?("$(")
 
-            fetched_file = fetch_file_from_host(path)
-            grandchild_property_files = fetch_imported_property_files(
-              file: fetched_file,
-              previously_fetched_files: previously_fetched_files + [file]
-            )
-            @fetched_files[file_id] = [fetched_file, *grandchild_property_files]
-            @fetched_files[file_id]
-          rescue Dependabot::DependencyFileNotFound
-            # Don't worry about missing files too much for now (at least
-            # until we start resolving properties)
-            nil
-          end.flatten
+            begin
+              fetched_file = fetch_file_from_host(path)
+              grandchild_property_files = fetch_imported_property_files(
+                file: fetched_file,
+                previously_fetched_files: previously_fetched_files + [file]
+              )
+
+              # Add fetched file and grandchild property files to the set
+              fetched_files_set << fetched_file
+              fetched_files_set.merge(grandchild_property_files)
+            rescue Dependabot::DependencyFileNotFound
+              # Don't worry about missing files, just skip them for now
+              Dependabot.logger.info("unable to find expected file #{file.name}")
+              nil
+            end
+          end
+
+          # Convert the set to an array and cache the fetched files
+          fetched_files = fetched_files_set.to_a
+          @fetched_files[file_id] = fetched_files
+
+          # Return the fetched files
+          fetched_files
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.281.0
+  version: 0.283.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-10-17 00:00:00.000000000 Z
+date: 2024-10-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.281.0
+        version: 0.283.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.281.0
+        version: 0.283.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -134,28 +134,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.65.0
+        version: 1.67.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.65.0
+        version: 1.67.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.21.0
+        version: 1.22.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.21.0
+        version: 1.22.1
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
@@ -310,6 +310,7 @@ files:
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/RequirementTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/SecurityVulnerabilityExtensionsTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/VersionFinderTests.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/DependencySolverEnvironment.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTestBase.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.DotNetToolsJson.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.GlobalJson.cs
@@ -344,8 +345,8 @@ files:
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.DotNetTools.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.GlobalJson.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.Mixed.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.PackageReference.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.PackagesConfig.cs
-- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.Sdk.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/AssertEx.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/DiffUtil.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/JsonHelperTests.cs
@@ -425,8 +426,8 @@ files:
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/DotNetToolsJsonUpdater.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/GlobalJsonUpdater.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/LockFileUpdater.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackageReferenceUpdater.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs
-- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/SdkPackageUpdater.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdateOperationResult.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdateResult.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdaterWorker.cs
@@ -496,7 +497,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.281.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.283.0
 post_install_message: 
 rdoc_options: []
 require_paths: