dependabot-nuget 0.288.0 → 0.290.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/RequirementsUpdateStrategy.cs

@@ -0,0 +1,15 @@
+using System.Text.Json.Serialization;
+
+namespace NuGetUpdater.Core.Run.ApiModel;
+
+public enum RequirementsUpdateStrategy
+{
+    [JsonStringEnumMemberName("bump_versions")]
+    BumpVersions,
+    [JsonStringEnumMemberName("bump_versions_if_necessary")]
+    BumpVersionsIfNecessary,
+    [JsonStringEnumMemberName("lockfile_only")]
+    LockfileOnly,
+    [JsonStringEnumMemberName("widen_ranges")]
+    WidenRanges,
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -1,3 +1,4 @@
+using System.Collections.Immutable;
 using System.Net;
 using System.Text;
 using System.Text.Json;
@@ -21,7 +22,7 @@ public class RunWorker
     {
         PropertyNamingPolicy = JsonNamingPolicy.KebabCaseLower,
         WriteIndented = true,
-        Converters = { new JsonStringEnumConverter() },
+        Converters = { new JsonStringEnumConverter(), new RequirementConverter(), new VersionConverter() },
     };
 
     public RunWorker(IApiHandler apiHandler, IDiscoveryWorker discoverWorker, IAnalyzeWorker analyzeWorker, IUpdaterWorker updateWorker, ILogger logger)
@@ -113,8 +114,8 @@ public class RunWorker
     {
         var discoveryResult = await _discoveryWorker.RunAsync(repoContentsPath.FullName, repoDirectory);
 
-        _logger.Log("Discovery JSON content:");
-        _logger.Log(JsonSerializer.Serialize(discoveryResult, DiscoveryWorker.SerializerOptions));
+        _logger.Info("Discovery JSON content:");
+        _logger.Info(JsonSerializer.Serialize(discoveryResult, DiscoveryWorker.SerializerOptions));
 
         // report dependencies
         var discoveredUpdatedDependencies = GetUpdatedDependencyListFromDiscovery(discoveryResult, repoContentsPath.FullName);
@@ -123,9 +124,8 @@ public class RunWorker
         // TODO: pull out relevant dependencies, then check each for updates and track the changes
         // TODO: for each top-level dependency, _or_ specific dependency (if security, use transitive)
         var originalDependencyFileContents = new Dictionary<string, string>();
-        var allowedUpdates = job.AllowedUpdates ?? [];
         var actualUpdatedDependencies = new List<ReportedDependency>();
-        if (allowedUpdates.Any(a => a.UpdateType == "all"))
+        if (job.AllowedUpdates.Any(a => a.UpdateType == UpdateType.All))
         {
             await _apiHandler.IncrementMetric(new()
             {
@@ -134,35 +134,28 @@ public class RunWorker
             });
 
             // track original contents for later handling
-            async Task TrackOriginalContentsAsync(string directory, string fileName, string? replacementFileName = null)
+            async Task TrackOriginalContentsAsync(string directory, string fileName)
             {
-                var repoFullPath = Path.Join(directory, fileName);
-                if (replacementFileName is not null)
-                {
-                    repoFullPath = Path.Join(Path.GetDirectoryName(repoFullPath)!, replacementFileName);
-                }
-
-                repoFullPath = repoFullPath.FullyNormalizedRootedPath();
+                var repoFullPath = Path.Join(directory, fileName).FullyNormalizedRootedPath();
                 var localFullPath = Path.Join(repoContentsPath.FullName, repoFullPath);
-
-                if (!File.Exists(localFullPath))
-                {
-                    return;
-                }
-
                 var content = await File.ReadAllTextAsync(localFullPath);
                 originalDependencyFileContents[repoFullPath] = content;
             }
 
             foreach (var project in discoveryResult.Projects)
             {
+                var projectDirectory = Path.GetDirectoryName(project.FilePath);
                 await TrackOriginalContentsAsync(discoveryResult.Path, project.FilePath);
-                await TrackOriginalContentsAsync(discoveryResult.Path, project.FilePath, replacementFileName: "packages.config");
+                foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
+                {
+                    var extraFilePath = Path.Join(projectDirectory, extraFile);
+                    await TrackOriginalContentsAsync(discoveryResult.Path, extraFilePath);
+                }
                 // TODO: include global.json, etc.
             }
 
             // do update
-            _logger.Log($"Running update in directory {repoDirectory}");
+            _logger.Info($"Running update in directory {repoDirectory}");
             foreach (var project in discoveryResult.Projects)
             {
                 foreach (var dependency in project.Dependencies.Where(d => !d.IsTransitive))
@@ -180,25 +173,20 @@ public class RunWorker
                         continue;
                     }
 
+                    var ignoredVersions = GetIgnoredRequirementsForDependency(job, dependency.Name);
                     var dependencyInfo = new DependencyInfo()
                     {
                         Name = dependency.Name,
                         Version = dependency.Version!,
                         IsVulnerable = false,
-                        IgnoredVersions = [],
+                        IgnoredVersions = ignoredVersions,
                         Vulnerabilities = [],
                     };
                     var analysisResult = await _analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
                     // TODO: log analysisResult
                     if (analysisResult.CanUpdate)
                     {
-                        var dependencyLocation = Path.Join(discoveryResult.Path, project.FilePath);
-                        if (dependency.Type == DependencyType.PackagesConfig)
-                        {
-                            dependencyLocation = Path.Join(Path.GetDirectoryName(dependencyLocation)!, "packages.config");
-                        }
-
-                        dependencyLocation = dependencyLocation.FullyNormalizedRootedPath();
+                        var dependencyLocation = Path.Join(discoveryResult.Path, project.FilePath).FullyNormalizedRootedPath();
 
                         // TODO: this is inefficient, but not likely causing a bottleneck
                         var previousDependency = discoveredUpdatedDependencies.Dependencies
@@ -241,48 +229,46 @@ public class RunWorker
             }
 
             // create PR - we need to manually check file contents; we can't easily use `git status` in tests
-            var updatedDependencyFiles = new List<DependencyFile>();
-            async Task AddUpdatedFileIfDifferentAsync(string directory, string fileName, string? replacementFileName = null)
+            var updatedDependencyFiles = new Dictionary<string, DependencyFile>();
+            async Task AddUpdatedFileIfDifferentAsync(string directory, string fileName)
             {
-                var repoFullPath = Path.Join(directory, fileName);
-                if (replacementFileName is not null)
-                {
-                    repoFullPath = Path.Join(Path.GetDirectoryName(repoFullPath)!, replacementFileName);
-                }
-
-                repoFullPath = repoFullPath.FullyNormalizedRootedPath();
-                var localFullPath = Path.Join(repoContentsPath.FullName, repoFullPath);
-
-                if (!File.Exists(localFullPath))
-                {
-                    return;
-                }
-
+                var repoFullPath = Path.Join(directory, fileName).FullyNormalizedRootedPath();
+                var localFullPath = Path.GetFullPath(Path.Join(repoContentsPath.FullName, repoFullPath));
                 var originalContent = originalDependencyFileContents[repoFullPath];
                 var updatedContent = await File.ReadAllTextAsync(localFullPath);
                 if (updatedContent != originalContent)
                 {
-                    updatedDependencyFiles.Add(new DependencyFile()
+                    updatedDependencyFiles[localFullPath] = new DependencyFile()
                     {
                         Name = Path.GetFileName(repoFullPath),
                         Directory = Path.GetDirectoryName(repoFullPath)!.NormalizePathToUnix(),
                         Content = updatedContent,
-                    });
+                    };
                 }
             }
 
             foreach (var project in discoveryResult.Projects)
             {
                 await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, project.FilePath);
-                await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, project.FilePath, replacementFileName: "packages.config");
+                var projectDirectory = Path.GetDirectoryName(project.FilePath);
+                foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
+                {
+                    var extraFilePath = Path.Join(projectDirectory, extraFile);
+                    await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, extraFilePath);
+                }
+                // TODO: handle global.json, etc.
             }
 
             if (updatedDependencyFiles.Count > 0)
             {
+                var updatedDependencyFileList = updatedDependencyFiles
+                    .OrderBy(kvp => kvp.Key)
+                    .Select(kvp => kvp.Value)
+                    .ToArray();
                 var createPullRequest = new CreatePullRequest()
                 {
                     Dependencies = actualUpdatedDependencies.ToArray(),
-                    UpdatedDependencyFiles = updatedDependencyFiles.ToArray(),
+                    UpdatedDependencyFiles = updatedDependencyFileList,
                     BaseCommitSha = baseCommitSha,
                     CommitMessage = "TODO: message",
                     PrTitle = "TODO: title",
@@ -303,7 +289,7 @@ public class RunWorker
 
         var result = new RunResult()
         {
-            Base64DependencyFiles = originalDependencyFileContents.Select(kvp =>
+            Base64DependencyFiles = originalDependencyFileContents.OrderBy(kvp => kvp.Key).Select(kvp =>
             {
                 var fullPath = kvp.Key.FullyNormalizedRootedPath();
                 return new DependencyFile()
@@ -318,6 +304,25 @@ public class RunWorker
         return result;
     }
 
+    internal static ImmutableArray<Requirement> GetIgnoredRequirementsForDependency(Job job, string dependencyName)
+    {
+        var ignoreConditions = job.IgnoreConditions
+            .Where(c => c.DependencyName.Equals(dependencyName, StringComparison.OrdinalIgnoreCase))
+            .ToArray();
+        if (ignoreConditions.Length == 1 && ignoreConditions[0].VersionRequirement is null)
+        {
+            // if only one match with no version requirement, ignore all versions
+            return [Requirement.Parse("> 0.0.0")];
+        }
+
+        var ignoredVersions = ignoreConditions
+            .Select(c => c.VersionRequirement)
+            .Where(r => r is not null)
+            .Cast<Requirement>()
+            .ToImmutableArray();
+        return ignoredVersions;
+    }
+
     internal static UpdatedDependencyList GetUpdatedDependencyListFromDiscovery(WorkspaceDiscoveryResult discoveryResult, string pathToContents)
     {
         string GetFullRepoPath(string path)
@@ -339,14 +344,20 @@ public class RunWorker
         foreach (var project in discoveryResult.Projects)
         {
             var projectDirectory = Path.GetDirectoryName(project.FilePath);
-            var pathToPackagesConfig = Path.Join(pathToContents, discoveryResult.Path, projectDirectory, "packages.config");
-
-            if (File.Exists(pathToPackagesConfig))
+            foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
             {
-                auxiliaryFiles.Add(GetFullRepoPath(Path.Join(projectDirectory, "packages.config")));
+                var extraFileFullPath = Path.Join(projectDirectory, extraFile);
+                var extraFileRepoPath = GetFullRepoPath(extraFileFullPath);
+                auxiliaryFiles.Add(extraFileRepoPath);
             }
         }
 
+        var dependencyFiles = discoveryResult.Projects
+            .Select(p => GetFullRepoPath(p.FilePath))
+            .Concat(auxiliaryFiles)
+            .Distinct()
+            .OrderBy(p => p)
+            .ToArray();
         var updatedDependencyList = new UpdatedDependencyList()
         {
             Dependencies = discoveryResult.Projects.SelectMany(p =>
@@ -357,9 +368,7 @@ public class RunWorker
                         Name = d.Name,
                         Requirements = d.IsTransitive ? [] : [new ReportedRequirement()
                         {
-                            File = d.Type == DependencyType.PackagesConfig
-                                ? Path.Join(Path.GetDirectoryName(GetFullRepoPath(p.FilePath))!, "packages.config").FullyNormalizedRootedPath()
-                                : GetFullRepoPath(p.FilePath),
+                            File = GetFullRepoPath(p.FilePath),
                             Requirement = d.Version!,
                             Groups = ["dependencies"],
                         }],
@@ -367,7 +376,7 @@ public class RunWorker
                     }
                 );
             }).ToArray(),
-            DependencyFiles = discoveryResult.Projects.Select(p => GetFullRepoPath(p.FilePath)).Concat(auxiliaryFiles).ToArray(),
+            DependencyFiles = dependencyFiles,
         };
         return updatedDependencyList;
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/VersionConverter.cs

@@ -0,0 +1,19 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+using NuGet.Versioning;
+
+namespace NuGetUpdater.Core.Analyze;
+
+public class VersionConverter : JsonConverter<NuGetVersion>
+{
+    public override NuGetVersion? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        return NuGetVersion.Parse(reader.GetString()!);
+    }
+
+    public override void Write(Utf8JsonWriter writer, NuGetVersion value, JsonSerializerOptions options)
+    {
+        writer.WriteStringValue(value.ToString());
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs

@@ -8,6 +8,8 @@ using Microsoft.Language.Xml;
 
 using NuGet.ProjectManagement;
 
+using NuGetUpdater.Core.Utilities;
+
 using Runtime_AssemblyBinding = CoreV2::NuGet.Runtime.AssemblyBinding;
 
 namespace NuGetUpdater.Core;
@@ -32,7 +34,7 @@ internal static class BindingRedirectManager
     /// <param name="updatedPackageVersion">The version of the package that was updated</param>
     public static async ValueTask UpdateBindingRedirectsAsync(ProjectBuildFile projectBuildFile, string updatedPackageName, string updatedPackageVersion)
     {
-        var configFile = await TryGetRuntimeConfigurationFile(projectBuildFile);
+        var configFile = await TryGetRuntimeConfigurationFile(projectBuildFile.Path);
         if (configFile is null)
         {
             // no runtime config file so no need to add binding redirects
@@ -58,7 +60,8 @@ internal static class BindingRedirectManager
         // finally we pull out the assembly `HintPath` values for _all_ references relative to the project file in a unix-style value
         //    e.g., ../packages/Some.Other.Package/4.5.6/lib/net45/Some.Other.Package.dll
         // all of that is passed to `AddBindingRedirects()` so we can ensure binding redirects for the relevant assemblies
-        var packagesDirectory = PackagesConfigUpdater.GetPathToPackagesDirectory(projectBuildFile, updatedPackageName, updatedPackageVersion, packagesConfigPath: null)!;
+        var packagesConfigPath = ProjectHelper.GetPackagesConfigPathFromProject(projectBuildFile.Path, ProjectHelper.PathFormat.Full);
+        var packagesDirectory = PackagesConfigUpdater.GetPathToPackagesDirectory(projectBuildFile, updatedPackageName, updatedPackageVersion, packagesConfigPath)!;
         var assemblyPathPrefix = Path.Combine(packagesDirectory, $"{updatedPackageName}.{updatedPackageVersion}").NormalizePathToUnix().EnsureSuffix("/");
         var assemblyPaths = references.Select(static x => x.HintPath).Select(x => Path.GetRelativePath(Path.GetDirectoryName(projectBuildFile.Path)!, x).NormalizePathToUnix()).ToList();
         var bindingsAndAssemblyPaths = bindings.Zip(assemblyPaths);
@@ -124,56 +127,24 @@ internal static class BindingRedirectManager
         }
     }
 
-    private static async ValueTask<ConfigurationFile?> TryGetRuntimeConfigurationFile(ProjectBuildFile projectBuildFile)
+    private static async ValueTask<ConfigurationFile?> TryGetRuntimeConfigurationFile(string fullProjectPath)
     {
-        var directoryPath = Path.GetDirectoryName(projectBuildFile.Path);
-        if (directoryPath is null)
-        {
-            return null;
-        }
-
-        var configFile = projectBuildFile.ItemNodes
-            .Where(IsConfigFile)
-            .FirstOrDefault();
+        var additionalFiles = ProjectHelper.GetAdditionalFilesFromProjectContent(fullProjectPath, ProjectHelper.PathFormat.Full);
+        var configFilePath = additionalFiles
+            .FirstOrDefault(p =>
+            {
+                var fileName = Path.GetFileName(p);
+                return fileName.Equals(ProjectHelper.AppConfigFileName, StringComparison.OrdinalIgnoreCase)
+                    || fileName.Equals(ProjectHelper.WebConfigFileName, StringComparison.OrdinalIgnoreCase);
+            });
 
-        if (configFile is null)
+        if (configFilePath is null)
         {
             return null;
         }
 
-        var configFilePath = Path.GetFullPath(Path.Combine(directoryPath, GetValue(configFile)));
         var configFileContents = await File.ReadAllTextAsync(configFilePath);
         return new ConfigurationFile(configFilePath, configFileContents, false);
-
-        static string GetValue(IXmlElementSyntax element)
-        {
-            var content = element.GetAttributeValue("Include");
-            if (!string.IsNullOrEmpty(content))
-            {
-                return content;
-            }
-
-            content = element.GetContentValue();
-            if (!string.IsNullOrEmpty(content))
-            {
-                return content;
-            }
-
-            return string.Empty;
-        }
-
-        static bool IsConfigFile(IXmlElementSyntax element)
-        {
-            var content = GetValue(element);
-            if (content is null)
-            {
-                return false;
-            }
-
-            var path = Path.GetFileName(content);
-            return (element.Name == "None" && string.Equals(path, "app.config", StringComparison.OrdinalIgnoreCase))
-                   || (element.Name == "Content" && string.Equals(path, "web.config", StringComparison.OrdinalIgnoreCase));
-        }
     }
 
     private static string AddBindingRedirects(ConfigurationFile configFile, IEnumerable<(Runtime_AssemblyBinding Binding, string AssemblyPath)> bindingRedirectsAndAssemblyPaths, string assemblyPathPrefix)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/DotNetToolsJsonUpdater.cs

@@ -12,18 +12,18 @@ internal static class DotNetToolsJsonUpdater
     {
         if (!MSBuildHelper.TryGetDotNetToolsJsonPath(repoRootPath, workspacePath, out var dotnetToolsJsonPath))
         {
-            logger.Log("  No dotnet-tools.json file found.");
+            logger.Info("  No dotnet-tools.json file found.");
             return;
         }
 
         var dotnetToolsJsonFile = DotNetToolsJsonBuildFile.Open(repoRootPath, dotnetToolsJsonPath, logger);
 
-        logger.Log($"  Updating [{dotnetToolsJsonFile.RelativePath}] file.");
+        logger.Info($"  Updating [{dotnetToolsJsonFile.RelativePath}] file.");
 
         var containsDependency = dotnetToolsJsonFile.GetDependencies().Any(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase));
         if (!containsDependency)
         {
-            logger.Log($"    Dependency [{dependencyName}] not found.");
+            logger.Info($"    Dependency [{dependencyName}] not found.");
             return;
         }
 
@@ -39,7 +39,7 @@ internal static class DotNetToolsJsonUpdater
 
             if (await dotnetToolsJsonFile.SaveAsync())
             {
-                logger.Log($"    Saved [{dotnetToolsJsonFile.RelativePath}].");
+                logger.Info($"    Saved [{dotnetToolsJsonFile.RelativePath}].");
             }
         }
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/GlobalJsonUpdater.cs

@@ -12,25 +12,25 @@ internal static class GlobalJsonUpdater
     {
         if (!MSBuildHelper.TryGetGlobalJsonPath(repoRootPath, workspacePath, out var globalJsonPath))
         {
-            logger.Log("  No global.json file found.");
+            logger.Info("  No global.json file found.");
             return;
         }
 
         var globalJsonFile = GlobalJsonBuildFile.Open(repoRootPath, globalJsonPath, logger);
 
-        logger.Log($"  Updating [{globalJsonFile.RelativePath}] file.");
+        logger.Info($"  Updating [{globalJsonFile.RelativePath}] file.");
 
         var containsDependency = globalJsonFile.GetDependencies().Any(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase));
         if (!containsDependency)
         {
-            logger.Log($"    Dependency [{dependencyName}] not found.");
+            logger.Info($"    Dependency [{dependencyName}] not found.");
             return;
         }
 
         if (globalJsonFile.MSBuildSdks?.TryGetPropertyValue(dependencyName, out var version) != true
             || version?.GetValue<string>() is not string versionString)
         {
-            logger.Log("    Unable to determine dependency version.");
+            logger.Info("    Unable to determine dependency version.");
             return;
         }
 
@@ -43,7 +43,7 @@ internal static class GlobalJsonUpdater
 
         if (await globalJsonFile.SaveAsync())
         {
-            logger.Log($"    Saved [{globalJsonFile.RelativePath}].");
+            logger.Info($"    Saved [{globalJsonFile.RelativePath}].");
         }
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/LockFileUpdater.cs

@@ -7,21 +7,13 @@ internal static class LockFileUpdater
         string projectPath,
         ILogger logger)
     {
-        var projectDirectory = Path.GetDirectoryName(projectPath);
-        var lockPath = Path.Combine(projectDirectory, "packages.lock.json");
-        logger.Log($"    Updating lock file");
-        if (!File.Exists(lockPath))
-        {
-            logger.Log($"      File [{Path.GetRelativePath(repoRootPath, lockPath)}] does not exist.");
-            return;
-        }
-
+        var projectDirectory = Path.GetDirectoryName(projectPath)!;
         await MSBuildHelper.SidelineGlobalJsonAsync(projectDirectory, repoRootPath, async () =>
         {
             var (exitCode, stdout, stderr) = await ProcessEx.RunAsync("dotnet", ["restore", "--force-evaluate", projectPath], workingDirectory: projectDirectory);
             if (exitCode != 0)
             {
-                logger.Log($"      Lock file update failed.\nSTDOUT:\n{stdout}\nSTDERR:\n{stderr}");
+                logger.Error($"      Lock file update failed.\nSTDOUT:\n{stdout}\nSTDERR:\n{stderr}");
             }
             return (exitCode, stdout, stderr);
         }, logger, retainMSBuildSdks: true);