dependabot-nuget 0.291.0 → 0.293.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.PackageReference.cs

@@ -2,6 +2,7 @@ using System.Linq;
 using System.Text;
 using System.Text.Json;
 
+using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Updater;
 
 using Xunit;
@@ -495,7 +496,7 @@ public partial class UpdateWorkerTests
                     MockNuGetPackage.CreateSimplePackage("Some.Package", "13.0.1", "net8.0"),
                 ],
                 projectContents: $"""
-                    <Project Sdk="Microsoft.NET.Sdk">">
+                    <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
                         <TargetFramework>net8.0</TargetFramework>
                         <SomePackageVersion>9.0.1</SomePackageVersion>
@@ -571,7 +572,7 @@ public partial class UpdateWorkerTests
             //
             // do the update
             //
-            UpdaterWorker worker = new(new ExperimentsManager(), new TestLogger());
+            UpdaterWorker worker = new("TEST-JOB-ID", new ExperimentsManager(), new TestLogger());
             await worker.RunAsync(tempDirectory.DirectoryPath, projectPath, "Some.Package", "1.0.0", "1.1.0", isTransitive: false);
 
             //
@@ -3075,14 +3076,14 @@ public partial class UpdateWorkerTests
         public async Task UpdatingTransitiveDependencyWithNewSolverCanUpdateJustTheTopLevelPackage()
         {
             // we've been asked to explicitly update a transitive dependency, but we can solve it by updating the top-level package instead
-            await TestUpdateForProject("Transitive.Package", "1.0.0", "2.0.0",
+            await TestUpdateForProject("Transitive.Package", "7.0.0", "8.0.0",
                 isTransitive: true,
                 packages:
                 [
-                    MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0", [("net8.0", [("Transitive.Package", "[1.0.0]")])]),
-                    MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", "net8.0", [("net8.0", [("Transitive.Package", "[2.0.0]")])]),
-                    MockNuGetPackage.CreateSimplePackage("Transitive.Package", "1.0.0", "net8.0"),
-                    MockNuGetPackage.CreateSimplePackage("Transitive.Package", "2.0.0", "net8.0"),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0", [("net8.0", [("Transitive.Package", "[7.0.0]")])]),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", "net8.0", [("net8.0", [("Transitive.Package", "[8.0.0]")])]),
+                    MockNuGetPackage.CreateSimplePackage("Transitive.Package", "7.0.0", "net8.0"),
+                    MockNuGetPackage.CreateSimplePackage("Transitive.Package", "8.0.0", "net8.0"),
                 ],
                 projectContents: """
                     <Project Sdk="Microsoft.NET.Sdk">
@@ -3482,10 +3483,154 @@ public partial class UpdateWorkerTests
                     """,
                 expectedResult: new()
                 {
-                    ErrorType = ErrorType.AuthenticationFailure,
-                    ErrorDetails = $"({http.BaseUrl.TrimEnd('/')}/index.json)",
+                    Error = new PrivateSourceAuthenticationFailure([$"{http.BaseUrl.TrimEnd('/')}/index.json"]),
                 }
             );
         }
+
+        [Fact]
+        public async Task UpdateSdkManagedPackage_DirectDependency()
+        {
+            // To avoid a unit test that's tightly coupled to the installed SDK, several values are simulated,
+            // including the runtime major version, the current Microsoft.NETCore.App.Ref package, and the package
+            // correlation file.  Doing this requires a temporary file and environment variable override.
+            var runtimeMajorVersion = Environment.Version.Major;
+            var netCoreAppRefPackage = MockNuGetPackage.GetMicrosoftNETCoreAppRefPackage(runtimeMajorVersion);
+            using var tempDirectory = new TemporaryDirectory();
+            var packageCorrelationFile = Path.Combine(tempDirectory.DirectoryPath, "dotnet-package-correlation.json");
+            await File.WriteAllTextAsync(packageCorrelationFile, $$"""
+                {
+                    "Runtimes": {
+                        "{{runtimeMajorVersion}}.0.0": {
+                            "Packages": {
+                                "{{netCoreAppRefPackage.Id}}": "{{netCoreAppRefPackage.Version}}",
+                                "System.Text.Json": "{{runtimeMajorVersion}}.0.98"
+                            }
+                        }
+                    }
+                }
+                """);
+            using var tempEnvironment = new TemporaryEnvironment([("DOTNET_PACKAGE_CORRELATION_FILE_PATH", packageCorrelationFile)]);
+
+            // In the `packages` section below, we fake a `System.Text.Json` package with a low assembly version that
+            // will always trigger the replacement so that can be detected and then the equivalent version is pulled
+            // from the correlation file specified above.  In the original project contents, package version `x.0.98`
+            // is reported which makes the update to `x.0.99` always possible.
+            await TestUpdateForProject("System.Text.Json", $"{runtimeMajorVersion}.0.98", $"{runtimeMajorVersion}.0.99",
+                experimentsManager: new ExperimentsManager() { UseDirectDiscovery = true, InstallDotnetSdks = true },
+                packages:
+                [
+                    // this assembly version is lower than what the SDK will have
+                    MockNuGetPackage.CreatePackageWithAssembly("System.Text.Json", $"{runtimeMajorVersion}.0.0", $"net{runtimeMajorVersion}.0", assemblyVersion: $"{runtimeMajorVersion}.0.0.0"),
+                    // this assembly version is greater than what the SDK will have
+                    MockNuGetPackage.CreatePackageWithAssembly("System.Text.Json", $"{runtimeMajorVersion}.0.99", $"net{runtimeMajorVersion}.0", assemblyVersion: $"{runtimeMajorVersion}.99.99.99"),
+                ],
+                projectContents: $"""
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net{runtimeMajorVersion}.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="System.Text.Json" Version="{runtimeMajorVersion}.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                additionalFiles: [
+                    ("global.json", $$"""
+                        {
+                            "sdk": {
+                                "version": "{{runtimeMajorVersion}}.0.100",
+                                "allowPrerelease": true,
+                                "rollForward": "latestMinor"
+                            }
+                        }
+                        """)
+                ],
+                expectedProjectContents: $"""
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net{runtimeMajorVersion}.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="System.Text.Json" Version="{runtimeMajorVersion}.0.99" />
+                      </ItemGroup>
+                    </Project>
+                    """
+            );
+        }
+
+        [Fact]
+        public async Task UpdateSdkManagedPackage_TransitiveDependency()
+        {
+            // To avoid a unit test that's tightly coupled to the installed SDK, several values are simulated,
+            // including the runtime major version, the current Microsoft.NETCore.App.Ref package, and the package
+            // correlation file.  Doing this requires a temporary file and environment variable override.
+            var runtimeMajorVersion = Environment.Version.Major;
+            var netCoreAppRefPackage = MockNuGetPackage.GetMicrosoftNETCoreAppRefPackage(runtimeMajorVersion);
+            using var tempDirectory = new TemporaryDirectory();
+            var packageCorrelationFile = Path.Combine(tempDirectory.DirectoryPath, "dotnet-package-correlation.json");
+            await File.WriteAllTextAsync(packageCorrelationFile, $$"""
+                {
+                    "Runtimes": {
+                        "{{runtimeMajorVersion}}.0.0": {
+                            "Packages": {
+                                "{{netCoreAppRefPackage.Id}}": "{{netCoreAppRefPackage.Version}}",
+                                "System.Text.Json": "{{runtimeMajorVersion}}.0.98"
+                            }
+                        }
+                    }
+                }
+                """);
+            using var tempEnvironment = new TemporaryEnvironment([("DOTNET_PACKAGE_CORRELATION_FILE_PATH", packageCorrelationFile)]);
+
+            // In the `packages` section below, we fake a `System.Text.Json` package with a low assembly version that
+            // will always trigger the replacement so that can be detected and then the equivalent version is pulled
+            // from the correlation file specified above.  In the original project contents, package version `x.0.98`
+            // is reported which makes the update to `x.0.99` always possible.
+            await TestUpdateForProject("System.Text.Json", $"{runtimeMajorVersion}.0.98", $"{runtimeMajorVersion}.0.99",
+                isTransitive: true,
+                experimentsManager: new ExperimentsManager() { UseDirectDiscovery = true, InstallDotnetSdks = true },
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", $"net{runtimeMajorVersion}.0", [(null, [("System.Text.Json", $"[{runtimeMajorVersion}.0.0]")])]),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", $"net{runtimeMajorVersion}.0", [(null, [("System.Text.Json", $"[{runtimeMajorVersion}.0.99]")])]),
+                    // this assembly version is lower than what the SDK will have
+                    MockNuGetPackage.CreatePackageWithAssembly("System.Text.Json", $"{runtimeMajorVersion}.0.0", $"net{runtimeMajorVersion}.0", assemblyVersion: $"{runtimeMajorVersion}.0.0.0"),
+                    // this assembly version is greater than what the SDK will have
+                    MockNuGetPackage.CreatePackageWithAssembly("System.Text.Json", $"{runtimeMajorVersion}.0.99", $"net{runtimeMajorVersion}.0", assemblyVersion: $"{runtimeMajorVersion}.99.99.99"),
+                ],
+                projectContents: $"""
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net{runtimeMajorVersion}.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="1.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                additionalFiles: [
+                    ("global.json", $$"""
+                        {
+                            "sdk": {
+                                "version": "{{runtimeMajorVersion}}.0.100",
+                                "allowPrerelease": true,
+                                "rollForward": "latestMinor"
+                            }
+                        }
+                        """)
+                ],
+                expectedProjectContents: $"""
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net{runtimeMajorVersion}.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="2.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """
+            );
+        }
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.PackagesConfig.cs

@@ -4,6 +4,7 @@ using System.Text.Json;
 
 using NuGet;
 
+using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Test.Updater;
 using NuGetUpdater.Core.Updater;
 
@@ -1969,7 +1970,7 @@ public partial class UpdateWorkerTests
                         <VSToolsPath Condition="'$(VSToolsPath)' == ''">C:\some\path\that\does\not\exist</VSToolsPath>
                       </PropertyGroup>
                       <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
-                      <Import Project="$(VSToolsPath)\WebApplications\Microsoft.WebApplication.targets" Condition="'$(VSToolsPath)' != ''" />
+                      <Import Project="$(VSToolsPath)\SomeSubPath\Microsoft.WebApplication.targets" Condition="'$(VSToolsPath)' != ''" />
                       <!-- To modify your build process, add your task inside one of the targets below and uncomment it.
                             Other similar extension points exist, see Microsoft.Common.targets.
                       <Target Name="BeforeBuild">
@@ -2050,7 +2051,7 @@ public partial class UpdateWorkerTests
                         <VSToolsPath Condition="'$(VSToolsPath)' == ''">C:\some\path\that\does\not\exist</VSToolsPath>
                       </PropertyGroup>
                       <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
-                      <Import Project="$(VSToolsPath)\WebApplications\Microsoft.WebApplication.targets" Condition="'$(VSToolsPath)' != ''" />
+                      <Import Project="$(VSToolsPath)\SomeSubPath\Microsoft.WebApplication.targets" Condition="'$(VSToolsPath)' != ''" />
                       <!-- To modify your build process, add your task inside one of the targets below and uncomment it.
                             Other similar extension points exist, see Microsoft.Common.targets.
                       <Target Name="BeforeBuild">
@@ -2282,25 +2283,83 @@ public partial class UpdateWorkerTests
             await MockNuGetPackagesInDirectory(packages, Path.Combine(temporaryDirectory.DirectoryPath, "packages"));
             var resultOutputPath = Path.Combine(temporaryDirectory.DirectoryPath, "result.json");
 
-            var worker = new UpdaterWorker(new ExperimentsManager(), new TestLogger());
+            var worker = new UpdaterWorker("TEST-JOB-ID", new ExperimentsManager(), new TestLogger());
             await worker.RunAsync(temporaryDirectory.DirectoryPath, "project.csproj", "Some.Package", "1.0.0", "1.1.0", isTransitive: false, resultOutputPath: resultOutputPath);
 
             var resultContents = await File.ReadAllTextAsync(resultOutputPath);
-            var result = JsonSerializer.Deserialize<UpdateOperationResult>(resultContents, UpdaterWorker.SerializerOptions)!;
-            Assert.Equal(ErrorType.MissingFile, result.ErrorType);
-            Assert.Equal(Path.Combine(temporaryDirectory.DirectoryPath, "this.file.does.not.exist.targets"), result.ErrorDetails!.ToString());
+            var rawResult = JsonDocument.Parse(resultContents);
+            Assert.Equal("dependency_file_not_found", rawResult.RootElement.GetProperty("Error").GetProperty("error-type").GetString());
+            Assert.Equal(Path.Combine(temporaryDirectory.DirectoryPath, "this.file.does.not.exist.targets").NormalizePathToUnix(), rawResult.RootElement.GetProperty("Error").GetProperty("error-details").GetProperty("file-path").GetString());
         }
 
         [Fact]
-        public async Task ReportsPrivateSourceAuthenticationFailure()
+        public async Task MissingVisualStudioComponentTargetsAreReportedAsMissingFiles()
         {
-            static (int, string) TestHttpHandler(string uriString)
+            using var temporaryDirectory = await TemporaryDirectory.CreateWithContentsAsync(
+                [
+                    ("project.csproj", """
+                        <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                          <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                          <Import Project="$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)\Some.Visual.Studio.Component.props" />
+                          <PropertyGroup>
+                            <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+                          </PropertyGroup>
+                          <ItemGroup>
+                            <None Include="packages.config" />
+                          </ItemGroup>
+                          <ItemGroup>
+                            <Reference Include="Some.Package, Version=1.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed">
+                              <HintPath>packages\Some.Package.1.0.0\lib\net45\Some.Package.dll</HintPath>
+                              <Private>True</Private>
+                            </Reference>
+                          </ItemGroup>
+                          <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                        </Project>
+                        """),
+                    ("packages.config", """
+                        <packages>
+                          <package id="Some.Package" version="1.0.0" targetFramework="net45" />
+                        </packages>
+                        """),
+                    ("NuGet.Config", """
+                        <configuration>
+                          <packageSources>
+                            <clear />
+                            <add key="private_feed" value="packages" />
+                          </packageSources>
+                        </configuration>
+                        """)
+                ]
+            );
+            MockNuGetPackage[] packages =
+            [
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net45"),
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "1.1.0", "net45"),
+            ];
+            await MockNuGetPackagesInDirectory(packages, Path.Combine(temporaryDirectory.DirectoryPath, "packages"));
+            var resultOutputPath = Path.Combine(temporaryDirectory.DirectoryPath, "result.json");
+
+            var worker = new UpdaterWorker("TEST-JOB-ID", new ExperimentsManager(), new TestLogger());
+            await worker.RunAsync(temporaryDirectory.DirectoryPath, "project.csproj", "Some.Package", "1.0.0", "1.1.0", isTransitive: false, resultOutputPath: resultOutputPath);
+
+            var resultContents = await File.ReadAllTextAsync(resultOutputPath);
+            var rawResult = JsonDocument.Parse(resultContents);
+            Assert.Equal("dependency_file_not_found", rawResult.RootElement.GetProperty("Error").GetProperty("error-type").GetString());
+            Assert.Equal("$(MSBuildExtensionsPath32)/Microsoft/VisualStudio/v$(VisualStudioVersion)/Some.Visual.Studio.Component.props", rawResult.RootElement.GetProperty("Error").GetProperty("error-details").GetProperty("file-path").GetString());
+        }
+
+        [Theory]
+        [InlineData(401)]
+        [InlineData(403)]
+        public async Task ReportsPrivateSourceAuthenticationFailure(int httpStatusCode)
+        {
+            (int, string) TestHttpHandler(string uriString)
             {
                 var uri = new Uri(uriString, UriKind.Absolute);
                 var baseUrl = $"{uri.Scheme}://{uri.Host}:{uri.Port}";
                 return uri.PathAndQuery switch
                 {
-                    _ => (401, "{}"), // everything is unauthorized
+                    _ => (httpStatusCode, "{}"), // everything is unauthorized
                 };
             }
             using var http = TestHttpServer.CreateTestStringServer(TestHttpHandler);
@@ -2366,8 +2425,7 @@ public partial class UpdateWorkerTests
                     """,
                 expectedResult: new()
                 {
-                    ErrorType = ErrorType.AuthenticationFailure,
-                    ErrorDetails = $"({http.BaseUrl.TrimEnd('/')}/index.json)",
+                    Error = new PrivateSourceAuthenticationFailure([$"{http.BaseUrl.TrimEnd('/')}/index.json"]),
                 }
             );
         }
@@ -2497,8 +2555,7 @@ public partial class UpdateWorkerTests
                     """,
                 expectedResult: new()
                 {
-                    ErrorType = ErrorType.Unknown,
-                    ErrorDetailsRegex = "Response status code does not indicate success",
+                    ErrorRegex = "Response status code does not indicate success",
                 }
             );
         }
@@ -2575,8 +2632,7 @@ public partial class UpdateWorkerTests
                     """,
                 expectedResult: new()
                 {
-                    ErrorType = ErrorType.UpdateNotPossible,
-                    ErrorDetails = new[] { "Unrelated.Package.1.0.0" },
+                    Error = new UpdateNotPossible(["Unrelated.Package.1.0.0"]),
                 }
             );
         }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs

@@ -854,30 +854,45 @@ public class MSBuildHelperTests : TestBase
 
     // Two top level packages (Buildalyzer), (Microsoft.CodeAnalysis.CSharp.Scripting) that share a dependency (Microsoft.CodeAnalysis.Csharp)
     // Updating ONE of the top level packages, which updates the dependencies and their other "parents"
-    // First family: Buildalyzer 7.0.1 requires Microsoft.CodeAnalysis.CSharp to be >= 4.0.0 and Microsoft.CodeAnalysis.Common to be 4.0.0 (@ 6.0.4, Microsoft.CodeAnalysis.Common isn't a dependency of buildalyzer)
-    // Second family: Microsoft.CodeAnalysis.CSharp.Scripting 4.0.0 requires Microsoft.CodeAnalysis.CSharp 4.0.0 and Microsoft.CodeAnalysis.Common to be 4.0.0 (Specific version)
+    // First family: Buildalyzer 7.0.1 requires Microsoft.CodeAnalysis.CSharp to be = 4.0.1 and Microsoft.CodeAnalysis.Common to be 4.0.1 (@ 6.0.4, Microsoft.CodeAnalysis.Common isn't a dependency of buildalyzer)
+    // Second family: Microsoft.CodeAnalysis.CSharp.Scripting 4.0.1 requires Microsoft.CodeAnalysis.CSharp 4.0.1 and Microsoft.CodeAnalysis.Common to be 4.0.1 (Specific version)
     // Updating Buildalyzer to 7.0.1 will update its transitive dependency (Microsoft.CodeAnalysis.Common) and then its transitive dependency's "family"
-    [Theory]
-    [InlineData(true)]
-    [InlineData(false)]
-    public async Task DependencyConflictsCanBeResolvedNewSharingDependency(bool useExistingSdks)
+    [Fact]
+    public async Task DependencyConflictsCanBeResolvedNewSharingDependency()
     {
+        // arrange
         using var tempDirectory = new TemporaryDirectory();
         var projectPath = Path.Join(tempDirectory.DirectoryPath, "project.csproj");
         await File.WriteAllTextAsync(projectPath, """
             <Project Sdk="Microsoft.NET.Sdk">
-                <PropertyGroup>
+              <PropertyGroup>
                 <TargetFramework>net8.0</TargetFramework>
-                </PropertyGroup>
-                <ItemGroup>
+              </PropertyGroup>
+              <ItemGroup>
                 <PackageReference Include="Buildalyzer" Version="6.0.4" />
                 <PackageReference Include="Microsoft.CodeAnalysis.Csharp.Scripting" Version="3.10.0" />
                 <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="3.10.0" />
                 <PackageReference Include="Microsoft.CodeAnalysis.Common" Version="3.10.0" />
-                </ItemGroup>
+              </ItemGroup>
             </Project>
             """);
 
+        var testPackages = new MockNuGetPackage[]
+        {
+            MockNuGetPackage.CreateSimplePackage("Buildalyzer", "6.0.4", "net8.0", [(null, [("Microsoft.CodeAnalysis.CSharp", "[3.10.0]")])]),
+            MockNuGetPackage.CreateSimplePackage("Buildalyzer", "7.0.1", "net8.0", [(null, [("Microsoft.CodeAnalysis.CSharp", "[4.0.1]")])]),
+
+            MockNuGetPackage.CreateSimplePackage("Microsoft.CodeAnalysis.CSharp.Scripting", "3.10.0", "net8.0", [(null, [("Microsoft.CodeAnalysis.CSharp", "[3.10.0]")])]),
+            MockNuGetPackage.CreateSimplePackage("Microsoft.CodeAnalysis.CSharp.Scripting", "4.0.1", "net8.0", [(null, [("Microsoft.CodeAnalysis.CSharp", "[4.0.1]")])]),
+
+            MockNuGetPackage.CreateSimplePackage("Microsoft.CodeAnalysis.CSharp", "3.10.0", "net8.0", [(null, [("Microsoft.CodeAnalysis.Common", "[3.10.0]")])]),
+            MockNuGetPackage.CreateSimplePackage("Microsoft.CodeAnalysis.CSharp", "4.0.1", "net8.0", [(null, [("Microsoft.CodeAnalysis.Common", "[4.0.1]")])]),
+
+            MockNuGetPackage.CreateSimplePackage("Microsoft.CodeAnalysis.Common", "3.10.0", "net8.0"),
+            MockNuGetPackage.CreateSimplePackage("Microsoft.CodeAnalysis.Common", "4.0.1", "net8.0"),
+        };
+        await UpdateWorkerTestBase.MockNuGetPackagesInDirectory(testPackages, tempDirectory.DirectoryPath);
+
         var dependencies = new[]
         {
             new Dependency("Buildalyzer", "6.0.4", DependencyType.PackageReference),
@@ -890,25 +905,28 @@ public class MSBuildHelperTests : TestBase
             new Dependency("Buildalyzer", "7.0.1", DependencyType.PackageReference),
         };
 
+        // act
         var resolvedDependencies = await MSBuildHelper.ResolveDependencyConflicts(
             tempDirectory.DirectoryPath,
             projectPath,
             "net8.0",
             dependencies,
             update,
-            new ExperimentsManager() { InstallDotnetSdks = useExistingSdks },
+            new ExperimentsManager(),
             new TestLogger()
         );
+
+        // assert
+        var expectedDependencies = new[]
+        {
+            "Buildalyzer/7.0.1",
+            "Microsoft.CodeAnalysis.CSharp.Scripting/4.0.1",
+            "Microsoft.CodeAnalysis.CSharp/4.0.1",
+            "Microsoft.CodeAnalysis.Common/4.0.1"
+        };
         Assert.NotNull(resolvedDependencies);
-        Assert.Equal(4, resolvedDependencies.Length);
-        Assert.Equal("Buildalyzer", resolvedDependencies[0].Name);
-        Assert.Equal("7.0.1", resolvedDependencies[0].Version);
-        Assert.Equal("Microsoft.CodeAnalysis.CSharp.Scripting", resolvedDependencies[1].Name);
-        Assert.Equal("4.0.0", resolvedDependencies[1].Version);
-        Assert.Equal("Microsoft.CodeAnalysis.CSharp", resolvedDependencies[2].Name);
-        Assert.Equal("4.0.0", resolvedDependencies[2].Version);
-        Assert.Equal("Microsoft.CodeAnalysis.Common", resolvedDependencies[3].Name);
-        Assert.Equal("4.0.0", resolvedDependencies[3].Version);
+        var actualDependencies = resolvedDependencies.Select(d => $"{d.Name}/{d.Version}").ToArray();
+        AssertEx.Equal(expectedDependencies, actualDependencies);
     }
 
     // Updating two families at once to test efficiency

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/ProjectHelperTests.cs

@@ -0,0 +1,65 @@
+using NuGetUpdater.Core.Utilities;
+
+using Xunit;
+
+namespace NuGetUpdater.Core.Test.Utilities;
+
+public class ProjectHelperTests : TestBase
+{
+    [Theory]
+    [MemberData(nameof(AdditionalFile))]
+    public async Task GetAdditionalFilesFromProject(string projectPath, (string Name, string Content)[] files, string[] expectedAdditionalFiles)
+    {
+        using var tempDirectory = await TemporaryDirectory.CreateWithContentsAsync(files);
+        var fullProjectPath = Path.Join(tempDirectory.DirectoryPath, projectPath);
+
+        var actualAdditionalFiles = ProjectHelper.GetAllAdditionalFilesFromProject(fullProjectPath, ProjectHelper.PathFormat.Relative);
+        AssertEx.Equal(expectedAdditionalFiles, actualAdditionalFiles);
+    }
+
+    public static IEnumerable<object[]> AdditionalFile()
+    {
+        // no additional files
+        yield return
+        [
+            // project path
+            "src/project.csproj",
+            // files
+            new[]
+            {
+                ("src/project.csproj", """
+                    <Project>
+                    </Project>
+                    """)
+            },
+            // expected additional files
+            Array.Empty<string>()
+        ];
+
+        // files with relative paths
+        yield return
+        [
+            // project path
+            "src/project.csproj",
+            // files
+            new[]
+            {
+                ("src/project.csproj", """
+                    <Project>
+                      <ItemGroup>
+                        <None Include="..\unexpected-path\packages.config" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("unexpected-path/packages.config", """
+                    <packages></packages>
+                    """)
+            },
+            // expected additional files
+            new[]
+            {
+                "../unexpected-path/packages.config"
+            }
+        ];
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.sln

@@ -1,4 +1,3 @@
-
 Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio Version 17
 VisualStudioVersion = 17.5.33516.290
@@ -43,6 +42,12 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "NuGet.Versioning", "NuGetPr
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "NuGetUpdater.Cli.Test", "NuGetUpdater.Cli.Test\NuGetUpdater.Cli.Test.csproj", "{BDBEBF91-F5FD-4589-B4FB-B3DE3103B04B}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DotNetPackageCorrelation", "DotNetPackageCorrelation\DotNetPackageCorrelation.csproj", "{52A6437B-7E72-4CCF-8E1E-355000F5DC10}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DotNetPackageCorrelation.Test", "DotNetPackageCorrelation.Test\DotNetPackageCorrelation.Test.csproj", "{0945703C-C8DC-44F0-B1D8-0EFE011411AE}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DotNetPackageCorrelation.Cli", "DotNetPackageCorrelation.Cli\DotNetPackageCorrelation.Cli.csproj", "{509454EE-629F-4767-B1D4-7F2DF86C11B5}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -125,6 +130,18 @@ Global
 		{BDBEBF91-F5FD-4589-B4FB-B3DE3103B04B}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{BDBEBF91-F5FD-4589-B4FB-B3DE3103B04B}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{BDBEBF91-F5FD-4589-B4FB-B3DE3103B04B}.Release|Any CPU.Build.0 = Release|Any CPU
+		{52A6437B-7E72-4CCF-8E1E-355000F5DC10}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{52A6437B-7E72-4CCF-8E1E-355000F5DC10}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{52A6437B-7E72-4CCF-8E1E-355000F5DC10}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{52A6437B-7E72-4CCF-8E1E-355000F5DC10}.Release|Any CPU.Build.0 = Release|Any CPU
+		{0945703C-C8DC-44F0-B1D8-0EFE011411AE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{0945703C-C8DC-44F0-B1D8-0EFE011411AE}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{0945703C-C8DC-44F0-B1D8-0EFE011411AE}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{0945703C-C8DC-44F0-B1D8-0EFE011411AE}.Release|Any CPU.Build.0 = Release|Any CPU
+		{509454EE-629F-4767-B1D4-7F2DF86C11B5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{509454EE-629F-4767-B1D4-7F2DF86C11B5}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{509454EE-629F-4767-B1D4-7F2DF86C11B5}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{509454EE-629F-4767-B1D4-7F2DF86C11B5}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

data/helpers/lib/NuGetUpdater/global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "9.0.100",
+    "version": "9.0.101",
     "rollForward": "latestMinor"
   }
 }

data/lib/dependabot/nuget/language.rb

@@ -12,7 +12,11 @@ module Dependabot
 
       sig { params(language: String, raw_version: String, requirement: T.nilable(Requirement)).void }
       def initialize(language, raw_version, requirement = nil)
-        super(language, Version.new(raw_version), [], [], requirement)
+        super(
+          name: language,
+          version: Version.new(raw_version),
+          requirement: requirement,
+       )
       end
     end
 
@@ -28,7 +32,10 @@ module Dependabot
 
       sig { params(language: String, requirement: T.nilable(Requirement)).void }
       def initialize(language, requirement = nil)
-        super(language, Version.new(nil), [], [], requirement)
+        super(
+          name: language,
+          requirement: requirement,
+       )
       end
     end
 
@@ -44,7 +51,10 @@ module Dependabot
 
       sig { params(language: String, requirement: T.nilable(Requirement)).void }
       def initialize(language, requirement = nil)
-        super(language, Version.new(nil), [], [], requirement)
+        super(
+          name: language,
+          requirement: requirement,
+       )
       end
     end
 
@@ -60,7 +70,10 @@ module Dependabot
 
       sig { params(language: String, requirement: T.nilable(Requirement)).void }
       def initialize(language, requirement = nil)
-        super(language, Version.new(nil), [], [], requirement)
+        super(
+          name: language,
+          requirement: requirement,
+       )
       end
     end
 
@@ -75,7 +88,10 @@ module Dependabot
 
       sig { params(language: String, requirement: T.nilable(Requirement)).void }
       def initialize(language, requirement = nil)
-        super(language, Version.new(nil), [], [], requirement)
+        super(
+          name: language,
+          requirement: requirement,
+       )
       end
     end
   end