dependabot-nuget 0.292.0 → 0.294.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs

@@ -3,6 +3,7 @@ using System.Runtime.InteropServices;
 using System.Text.Json;
 
 using NuGetUpdater.Core.Discover;
+using NuGetUpdater.Core.Run.ApiModel;
 
 using Xunit;
 
@@ -1130,8 +1131,7 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
             {
                 Path = "",
                 Projects = [],
-                ErrorType = ErrorType.DependencyFileNotParseable,
-                ErrorDetails = "project2.csproj",
+                Error = new DependencyFileNotParseable("project2.csproj"),
             });
     }
 
@@ -1142,8 +1142,7 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
         var discoveryResultPath = Path.Combine(temporaryDirectory.DirectoryPath, DiscoveryWorker.DiscoveryResultFileName);
         await DiscoveryWorker.WriteResultsAsync(temporaryDirectory.DirectoryPath, discoveryResultPath, new()
         {
-            ErrorType = ErrorType.AuthenticationFailure,
-            ErrorDetails = "<some package feed>",
+            Error = new PrivateSourceAuthenticationFailure(["<some package feed>"]),
             Path = "/",
             Projects = [],
         });
@@ -1152,16 +1151,22 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
         // raw result file should look like this:
         // {
         //   ...
-        //   "ErrorType": "AuthenticationFailure",
-        //   "ErrorDetails": "<some package feed>",
+        //   "Error": {
+        //     "error-type": "private_source_authentication_failure",
+        //     "error-detail": {
+        //       "source": "(<some package feed>)"
+        //     }
+        //   }
         //   ...
         // }
         var jsonDocument = JsonDocument.Parse(discoveryContents);
-        var errorType = jsonDocument.RootElement.GetProperty("ErrorType");
-        var errorDetails = jsonDocument.RootElement.GetProperty("ErrorDetails");
+        var error = jsonDocument.RootElement.GetProperty("Error");
+        var errorType = error.GetProperty("error-type");
+        var errorDetail = error.GetProperty("error-details");
+        var errorSource = errorDetail.GetProperty("source");
 
-        Assert.Equal("AuthenticationFailure", errorType.GetString());
-        Assert.Equal("<some package feed>", errorDetails.GetString());
+        Assert.Equal("private_source_authentication_failure", errorType.GetString());
+        Assert.Equal("(<some package feed>)", errorSource.GetString());
     }
 
     [Theory]
@@ -1236,8 +1241,7 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
             ],
             expectedResult: new()
             {
-                ErrorType = ErrorType.AuthenticationFailure,
-                ErrorDetails = $"({http.BaseUrl.TrimEnd('/')}/index.json)",
+                Error = new PrivateSourceAuthenticationFailure([$"{http.BaseUrl.TrimEnd('/')}/index.json"]),
                 Path = "",
                 Projects = [],
             }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/ExpectedDiscoveryResults.cs

@@ -12,7 +12,7 @@ public record ExpectedWorkspaceDiscoveryResult : NativeResult
     public int? ExpectedProjectCount { get; init; }
     public ExpectedDependencyDiscoveryResult? GlobalJson { get; init; }
     public ExpectedDependencyDiscoveryResult? DotNetToolsJson { get; init; }
-    public string? ErrorDetailsPattern { get; init; } = null;
+    public string? ErrorRegex { get; init; } = null;
 }
 
 public record ExpectedSdkProjectDiscoveryResult : ExpectedDependencyDiscoveryResult

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/MockNuGetPackage.cs

@@ -388,6 +388,17 @@ namespace NuGetUpdater.Core.Test
             return WellKnownPackages[key];
         }
 
+        public static MockNuGetPackage GetMicrosoftNETCoreAppRefPackage(int majorRuntimeVersion)
+        {
+            return WellKnownReferencePackage("Microsoft.NETCore.App", $"net{majorRuntimeVersion}.0",
+            [
+                ("data/FrameworkList.xml", Encoding.UTF8.GetBytes($"""
+                    <FileList TargetFrameworkIdentifier=".NETCoreApp" TargetFrameworkVersion="{majorRuntimeVersion}.0" FrameworkName="Microsoft.NETCore.App" Name=".NET Runtime">
+                    </FileList>
+                    """))
+            ]);
+        }
+
         public static MockNuGetPackage WellKnownHostPackage(string packageName, string targetFramework, (string Path, byte[] Content)[]? files = null)
         {
             string key = $"{packageName}/{targetFramework}";
@@ -437,34 +448,10 @@ namespace NuGetUpdater.Core.Test
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net7.0"),
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net8.0"),
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net9.0"),
-            WellKnownReferencePackage("Microsoft.NETCore.App", "net6.0",
-            [
-                ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
-                    <FileList TargetFrameworkIdentifier=".NETCoreApp" TargetFrameworkVersion="6.0" FrameworkName="Microsoft.NETCore.App" Name=".NET Runtime">
-                    </FileList>
-                    """))
-            ]),
-            WellKnownReferencePackage("Microsoft.NETCore.App", "net7.0",
-            [
-                ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
-                    <FileList TargetFrameworkIdentifier=".NETCoreApp" TargetFrameworkVersion="7.0" FrameworkName="Microsoft.NETCore.App" Name=".NET Runtime">
-                    </FileList>
-                    """))
-            ]),
-            WellKnownReferencePackage("Microsoft.NETCore.App", "net8.0",
-            [
-                ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
-                    <FileList TargetFrameworkIdentifier=".NETCoreApp" TargetFrameworkVersion="8.0" FrameworkName="Microsoft.NETCore.App" Name=".NET Runtime">
-                    </FileList>
-                    """))
-            ]),
-            WellKnownReferencePackage("Microsoft.NETCore.App", "net9.0",
-            [
-                ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
-                    <FileList TargetFrameworkIdentifier=".NETCoreApp" TargetFrameworkVersion="9.0" FrameworkName="Microsoft.NETCore.App" Name=".NET Runtime">
-                    </FileList>
-                    """))
-            ]),
+            GetMicrosoftNETCoreAppRefPackage(6),
+            GetMicrosoftNETCoreAppRefPackage(7),
+            GetMicrosoftNETCoreAppRefPackage(8),
+            GetMicrosoftNETCoreAppRefPackage(9),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net6.0"),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net7.0"),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net8.0"),

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/MiscellaneousTests.cs

@@ -1,3 +1,5 @@
+using System.Text.Json;
+
 using NuGet.Versioning;
 
 using NuGetUpdater.Core.Analyze;
@@ -29,6 +31,16 @@ public class MiscellaneousTests
         Assert.Equal(expectedRequirementsStrings, actualRequirementsStrings);
     }
 
+    [Theory]
+    [MemberData(nameof(DependencyInfoFromJobData))]
+    public void DependencyInfoFromJob(Job job, Dependency dependency, DependencyInfo expectedDependencyInfo)
+    {
+        var actualDependencyInfo = RunWorker.GetDependencyInfo(job, dependency);
+        var expectedString = JsonSerializer.Serialize(expectedDependencyInfo, AnalyzeWorker.SerializerOptions);
+        var actualString = JsonSerializer.Serialize(actualDependencyInfo, AnalyzeWorker.SerializerOptions);
+        Assert.Equal(expectedString, actualString);
+    }
+
     public static IEnumerable<object?[]> RequirementsFromIgnoredVersionsData()
     {
         yield return
@@ -82,4 +94,53 @@ public class MiscellaneousTests
             }
         ];
     }
+
+    public static IEnumerable<object[]> DependencyInfoFromJobData()
+    {
+        yield return
+        [
+            // job
+            new Job()
+            {
+                Source = new()
+                {
+                    Provider = "github",
+                    Repo = "some/repo"
+                },
+                SecurityAdvisories = [
+                    new()
+                    {
+                        DependencyName = "Some.Dependency",
+                        AffectedVersions = [Requirement.Parse(">= 1.0.0, < 1.1.0")],
+                        PatchedVersions = [Requirement.Parse("= 1.1.0")],
+                        UnaffectedVersions = [Requirement.Parse("= 1.2.0")]
+                    },
+                    new()
+                    {
+                        DependencyName = "Unrelated.Dependency",
+                        AffectedVersions = [Requirement.Parse(">= 1.0.0, < 99.99.99")]
+                    }
+                ]
+            },
+            // dependency
+            new Dependency("Some.Dependency", "1.0.0", DependencyType.PackageReference),
+            // expectedDependencyInfo
+            new DependencyInfo()
+            {
+                Name = "Some.Dependency",
+                Version = "1.0.0",
+                IsVulnerable = true,
+                IgnoredVersions = [],
+                Vulnerabilities = [
+                    new()
+                    {
+                        DependencyName = "Some.Dependency",
+                        PackageManager = "nuget",
+                        VulnerableVersions = [Requirement.Parse(">= 1.0.0, < 1.1.0")],
+                        SafeVersions = [Requirement.Parse("= 1.1.0"), Requirement.Parse("= 1.2.0")],
+                    }
+                ]
+            }
+        ];
+    }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/RunWorkerTests.cs

@@ -1729,11 +1729,12 @@ public class RunWorkerTests
         experimentsManager ??= new ExperimentsManager();
         var testApiHandler = new TestApiHandler();
         var logger = new TestLogger();
-        discoveryWorker ??= new DiscoveryWorker(experimentsManager, logger);
-        analyzeWorker ??= new AnalyzeWorker(experimentsManager, logger);
-        updaterWorker ??= new UpdaterWorker(experimentsManager, logger);
+        var jobId = "TEST-JOB-ID";
+        discoveryWorker ??= new DiscoveryWorker(jobId, experimentsManager, logger);
+        analyzeWorker ??= new AnalyzeWorker(jobId, experimentsManager, logger);
+        updaterWorker ??= new UpdaterWorker(jobId, experimentsManager, logger);
 
-        var worker = new RunWorker("TEST-JOB-ID", testApiHandler, discoveryWorker, analyzeWorker, updaterWorker, logger);
+        var worker = new RunWorker(jobId, testApiHandler, discoveryWorker, analyzeWorker, updaterWorker, logger);
         var repoContentsPathDirectoryInfo = new DirectoryInfo(tempDirectory.DirectoryPath);
         var actualResult = await worker.RunAsync(job, repoContentsPathDirectoryInfo, "TEST-COMMIT-SHA");
         var actualApiMessages = testApiHandler.ReceivedMessages.ToArray();

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/SerializationTests.cs

@@ -523,12 +523,20 @@ public class SerializationTests
 
         yield return
         [
-            new DependencyFileNotFound("some message", "/some/file"),
+            new DependencyFileNotFound("/some/file", "some message"),
             """
             {"data":{"error-type":"dependency_file_not_found","error-details":{"message":"some message","file-path":"/some/file"}}}
             """
         ];
 
+        yield return
+        [
+            new DependencyFileNotParseable("/some/file", "some message"),
+            """
+            {"data":{"error-type":"dependency_file_not_parseable","error-details":{"message":"some message","file-path":"/some/file"}}}
+            """
+        ];
+
         yield return
         [
             new JobRepoNotFound("some message"),

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/TestBase.cs

@@ -1,3 +1,10 @@
+using System.Text.Json;
+
+using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Run;
+
+using Xunit;
+
 namespace NuGetUpdater.Core.Test
 {
     public abstract class TestBase
@@ -6,5 +13,22 @@ namespace NuGetUpdater.Core.Test
         {
             MSBuildHelper.RegisterMSBuild(Environment.CurrentDirectory, Environment.CurrentDirectory);
         }
+
+        protected static void ValidateError(JobErrorBase expected, JobErrorBase? actual)
+        {
+            var expectedErrorString = JsonSerializer.Serialize(expected, RunWorker.SerializerOptions);
+            var actualErrorString = actual is null
+                ? null
+                : JsonSerializer.Serialize(actual, RunWorker.SerializerOptions);
+            Assert.Equal(expectedErrorString, actualErrorString);
+        }
+
+        protected static void ValidateErrorRegex(string expectedErrorRegex, JobErrorBase? actual)
+        {
+            var actualErrorString = actual is null
+                ? null
+                : JsonSerializer.Serialize(actual, RunWorker.SerializerOptions);
+            Assert.Matches(expectedErrorRegex, actualErrorString);
+        }
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/ExpectedUpdateOperationResult.cs

@@ -4,5 +4,5 @@ namespace NuGetUpdater.Core.Test.Updater;
 
 public record ExpectedUpdateOperationResult : UpdateOperationResult
 {
-    public string? ErrorDetailsRegex { get; init; } = null;
+    public string? ErrorRegex { get; init; } = null;
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTestBase.cs

@@ -152,17 +152,10 @@ public abstract class UpdateWorkerTestBase : TestBase
 
             // run update
             experimentsManager ??= new ExperimentsManager();
-            var worker = new UpdaterWorker(experimentsManager, new TestLogger());
+            var worker = new UpdaterWorker("TEST-JOB-ID", experimentsManager, new TestLogger());
             var projectPath = placeFilesInSrc ? $"src/{projectFilePath}" : projectFilePath;
             var actualResult = await worker.RunWithErrorHandlingAsync(temporaryDirectory, projectPath, dependencyName, oldVersion, newVersion, isTransitive);
-            if (expectedResult is { })
-            {
-                ValidateUpdateOperationResult(expectedResult, actualResult!);
-            }
-            else if ((actualResult.ErrorType ?? ErrorType.None) != ErrorType.None)
-            {
-                throw new Exception($"Result indicates failure: ErrorType={actualResult.ErrorType}, ErrorDetails={actualResult.ErrorDetails}");
-            }
+            ValidateUpdateOperationResult(expectedResult, actualResult!);
 
             if (additionalChecks is not null)
             {
@@ -185,16 +178,19 @@ public abstract class UpdateWorkerTestBase : TestBase
         AssertContainsFiles(expectedResultFiles, actualResult);
     }
 
-    protected static void ValidateUpdateOperationResult(ExpectedUpdateOperationResult expectedResult, UpdateOperationResult actualResult)
+    protected static void ValidateUpdateOperationResult(ExpectedUpdateOperationResult? expectedResult, UpdateOperationResult actualResult)
     {
-        Assert.Equal(expectedResult.ErrorType, actualResult.ErrorType);
-        if (expectedResult.ErrorDetailsRegex is not null && actualResult.ErrorDetails is string errorDetails)
+        if (expectedResult?.Error is not null)
+        {
+            ValidateError(expectedResult.Error, actualResult.Error);
+        }
+        else if (expectedResult?.ErrorRegex is not null)
         {
-            Assert.Matches(expectedResult.ErrorDetailsRegex, errorDetails);
+            ValidateErrorRegex(expectedResult.ErrorRegex, actualResult.Error);
         }
         else
         {
-            Assert.Equivalent(expectedResult.ErrorDetails, actualResult.ErrorDetails);
+            Assert.Null(actualResult.Error);
         }
     }
 
@@ -274,7 +270,7 @@ public abstract class UpdateWorkerTestBase : TestBase
 
             experimentsManager ??= new ExperimentsManager();
             var slnPath = Path.Combine(temporaryDirectory, slnName);
-            var worker = new UpdaterWorker(experimentsManager, new TestLogger());
+            var worker = new UpdaterWorker("TEST-JOB-ID", experimentsManager, new TestLogger());
             await worker.RunAsync(temporaryDirectory, slnPath, dependencyName, oldVersion, newVersion, isTransitive);
         });
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.DirsProj.cs

@@ -366,7 +366,7 @@ public partial class UpdateWorkerTests
 
                 experimentsManager ??= new ExperimentsManager();
                 var projectPath = Path.Combine(temporaryDirectory, projectFileName);
-                var worker = new UpdaterWorker(experimentsManager, new TestLogger());
+                var worker = new UpdaterWorker("TEST-JOB-ID", experimentsManager, new TestLogger());
                 await worker.RunAsync(temporaryDirectory, projectPath, dependencyName, oldVersion, newVersion, isTransitive);
             });
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.Mixed.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 
+using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Updater;
 
 using Xunit;
@@ -16,8 +17,7 @@ public partial class UpdateWorkerTests
             using var temporaryDirectory = await TemporaryDirectory.CreateWithContentsAsync([]);
             var result = new UpdateOperationResult()
             {
-                ErrorType = ErrorType.AuthenticationFailure,
-                ErrorDetails = "<some package feed>",
+                Error = new PrivateSourceAuthenticationFailure(["<some package feed>"]),
             };
             var resultFilePath = Path.Combine(temporaryDirectory.DirectoryPath, "update-result.json");
             await UpdaterWorker.WriteResultFile(result, resultFilePath, new TestLogger());
@@ -26,16 +26,22 @@ public partial class UpdateWorkerTests
             // raw result file should look like this:
             // {
             //   ...
-            //   "ErrorType": "AuthenticationFailure",
-            //   "ErrorDetails": "<some package feed>",
+            //   "Error": {
+            //     "error-type": "private_source_authentication_failure",
+            //     "error-details": {
+            //       "source": "<some package feed>"
+            //     }
+            //   }
             //   ...
             // }
             var jsonDocument = JsonDocument.Parse(resultContent);
-            var errorType = jsonDocument.RootElement.GetProperty("ErrorType");
-            var errorDetails = jsonDocument.RootElement.GetProperty("ErrorDetails");
+            var error = jsonDocument.RootElement.GetProperty("Error");
+            var errorType = error.GetProperty("error-type");
+            var errorDetails = error.GetProperty("error-details");
+            var source = errorDetails.GetProperty("source");
 
-            Assert.Equal("AuthenticationFailure", errorType.GetString());
-            Assert.Equal("<some package feed>", errorDetails.GetString());
+            Assert.Equal("private_source_authentication_failure", errorType.GetString());
+            Assert.Equal("(<some package feed>)", source.GetString());
         }
 
         [Fact]

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.PackageReference.cs

@@ -2,6 +2,7 @@ using System.Linq;
 using System.Text;
 using System.Text.Json;
 
+using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Updater;
 
 using Xunit;
@@ -571,7 +572,7 @@ public partial class UpdateWorkerTests
             //
             // do the update
             //
-            UpdaterWorker worker = new(new ExperimentsManager(), new TestLogger());
+            UpdaterWorker worker = new("TEST-JOB-ID", new ExperimentsManager(), new TestLogger());
             await worker.RunAsync(tempDirectory.DirectoryPath, projectPath, "Some.Package", "1.0.0", "1.1.0", isTransitive: false);
 
             //
@@ -3482,10 +3483,154 @@ public partial class UpdateWorkerTests
                     """,
                 expectedResult: new()
                 {
-                    ErrorType = ErrorType.AuthenticationFailure,
-                    ErrorDetails = $"({http.BaseUrl.TrimEnd('/')}/index.json)",
+                    Error = new PrivateSourceAuthenticationFailure([$"{http.BaseUrl.TrimEnd('/')}/index.json"]),
                 }
             );
         }
+
+        [Fact]
+        public async Task UpdateSdkManagedPackage_DirectDependency()
+        {
+            // To avoid a unit test that's tightly coupled to the installed SDK, several values are simulated,
+            // including the runtime major version, the current Microsoft.NETCore.App.Ref package, and the package
+            // correlation file.  Doing this requires a temporary file and environment variable override.
+            var runtimeMajorVersion = Environment.Version.Major;
+            var netCoreAppRefPackage = MockNuGetPackage.GetMicrosoftNETCoreAppRefPackage(runtimeMajorVersion);
+            using var tempDirectory = new TemporaryDirectory();
+            var packageCorrelationFile = Path.Combine(tempDirectory.DirectoryPath, "dotnet-package-correlation.json");
+            await File.WriteAllTextAsync(packageCorrelationFile, $$"""
+                {
+                    "Runtimes": {
+                        "{{runtimeMajorVersion}}.0.0": {
+                            "Packages": {
+                                "{{netCoreAppRefPackage.Id}}": "{{netCoreAppRefPackage.Version}}",
+                                "System.Text.Json": "{{runtimeMajorVersion}}.0.98"
+                            }
+                        }
+                    }
+                }
+                """);
+            using var tempEnvironment = new TemporaryEnvironment([("DOTNET_PACKAGE_CORRELATION_FILE_PATH", packageCorrelationFile)]);
+
+            // In the `packages` section below, we fake a `System.Text.Json` package with a low assembly version that
+            // will always trigger the replacement so that can be detected and then the equivalent version is pulled
+            // from the correlation file specified above.  In the original project contents, package version `x.0.98`
+            // is reported which makes the update to `x.0.99` always possible.
+            await TestUpdateForProject("System.Text.Json", $"{runtimeMajorVersion}.0.98", $"{runtimeMajorVersion}.0.99",
+                experimentsManager: new ExperimentsManager() { UseDirectDiscovery = true, InstallDotnetSdks = true },
+                packages:
+                [
+                    // this assembly version is lower than what the SDK will have
+                    MockNuGetPackage.CreatePackageWithAssembly("System.Text.Json", $"{runtimeMajorVersion}.0.0", $"net{runtimeMajorVersion}.0", assemblyVersion: $"{runtimeMajorVersion}.0.0.0"),
+                    // this assembly version is greater than what the SDK will have
+                    MockNuGetPackage.CreatePackageWithAssembly("System.Text.Json", $"{runtimeMajorVersion}.0.99", $"net{runtimeMajorVersion}.0", assemblyVersion: $"{runtimeMajorVersion}.99.99.99"),
+                ],
+                projectContents: $"""
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net{runtimeMajorVersion}.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="System.Text.Json" Version="{runtimeMajorVersion}.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                additionalFiles: [
+                    ("global.json", $$"""
+                        {
+                            "sdk": {
+                                "version": "{{runtimeMajorVersion}}.0.100",
+                                "allowPrerelease": true,
+                                "rollForward": "latestMinor"
+                            }
+                        }
+                        """)
+                ],
+                expectedProjectContents: $"""
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net{runtimeMajorVersion}.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="System.Text.Json" Version="{runtimeMajorVersion}.0.99" />
+                      </ItemGroup>
+                    </Project>
+                    """
+            );
+        }
+
+        [Fact]
+        public async Task UpdateSdkManagedPackage_TransitiveDependency()
+        {
+            // To avoid a unit test that's tightly coupled to the installed SDK, several values are simulated,
+            // including the runtime major version, the current Microsoft.NETCore.App.Ref package, and the package
+            // correlation file.  Doing this requires a temporary file and environment variable override.
+            var runtimeMajorVersion = Environment.Version.Major;
+            var netCoreAppRefPackage = MockNuGetPackage.GetMicrosoftNETCoreAppRefPackage(runtimeMajorVersion);
+            using var tempDirectory = new TemporaryDirectory();
+            var packageCorrelationFile = Path.Combine(tempDirectory.DirectoryPath, "dotnet-package-correlation.json");
+            await File.WriteAllTextAsync(packageCorrelationFile, $$"""
+                {
+                    "Runtimes": {
+                        "{{runtimeMajorVersion}}.0.0": {
+                            "Packages": {
+                                "{{netCoreAppRefPackage.Id}}": "{{netCoreAppRefPackage.Version}}",
+                                "System.Text.Json": "{{runtimeMajorVersion}}.0.98"
+                            }
+                        }
+                    }
+                }
+                """);
+            using var tempEnvironment = new TemporaryEnvironment([("DOTNET_PACKAGE_CORRELATION_FILE_PATH", packageCorrelationFile)]);
+
+            // In the `packages` section below, we fake a `System.Text.Json` package with a low assembly version that
+            // will always trigger the replacement so that can be detected and then the equivalent version is pulled
+            // from the correlation file specified above.  In the original project contents, package version `x.0.98`
+            // is reported which makes the update to `x.0.99` always possible.
+            await TestUpdateForProject("System.Text.Json", $"{runtimeMajorVersion}.0.98", $"{runtimeMajorVersion}.0.99",
+                isTransitive: true,
+                experimentsManager: new ExperimentsManager() { UseDirectDiscovery = true, InstallDotnetSdks = true },
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", $"net{runtimeMajorVersion}.0", [(null, [("System.Text.Json", $"[{runtimeMajorVersion}.0.0]")])]),
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", $"net{runtimeMajorVersion}.0", [(null, [("System.Text.Json", $"[{runtimeMajorVersion}.0.99]")])]),
+                    // this assembly version is lower than what the SDK will have
+                    MockNuGetPackage.CreatePackageWithAssembly("System.Text.Json", $"{runtimeMajorVersion}.0.0", $"net{runtimeMajorVersion}.0", assemblyVersion: $"{runtimeMajorVersion}.0.0.0"),
+                    // this assembly version is greater than what the SDK will have
+                    MockNuGetPackage.CreatePackageWithAssembly("System.Text.Json", $"{runtimeMajorVersion}.0.99", $"net{runtimeMajorVersion}.0", assemblyVersion: $"{runtimeMajorVersion}.99.99.99"),
+                ],
+                projectContents: $"""
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net{runtimeMajorVersion}.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="1.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """,
+                additionalFiles: [
+                    ("global.json", $$"""
+                        {
+                            "sdk": {
+                                "version": "{{runtimeMajorVersion}}.0.100",
+                                "allowPrerelease": true,
+                                "rollForward": "latestMinor"
+                            }
+                        }
+                        """)
+                ],
+                expectedProjectContents: $"""
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net{runtimeMajorVersion}.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="2.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """
+            );
+        }
     }
 }