dependabot-nuget 0.298.0 → 0.299.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ddf8333c71d3c76213603301923f6005fc9a35a3a7b1f59dedf21ff2381a5ac
-  data.tar.gz: b2e38e24b320965f93d502eacdc0622b354e915a0366bc8478a9528c053e4410
+  metadata.gz: 47471c96a0fec7881b5454528d6cd07199cd600b1ec4dde66656fc754db318fe
+  data.tar.gz: 2364b4e071736115c1cb9503dc40562819e4c376198321761812c70dc309f1bd
 SHA512:
-  metadata.gz: 317614f24858deff63cad0dddfcfb80f53c6e8330b4dfd64d9946a34c50afed27f9e63527f3563ebc2678f7c5ad6e43078ddf4feb7944c10fb7947056f31740d
-  data.tar.gz: 8cb7df04044fc6a1bb421508bbf1bf1fdebab675f81c30d188963e6991f2bd84b4d4f165a315fbfec3257a97e85f232ed824cef7d01f3ab658cd5f9247d44035
+  metadata.gz: d31e631d9c1dd411843c4c911ad2db4e8a19f4d1fd15ffb0e5c2d4af1b092520bcc4aea2b31996c765870973e0da47b85910fb7d14f81ca973a7069554dc6733
+  data.tar.gz: 48714dea50d6fab935c7ca952e5d992f9aaf0699a54f99f576db55575b36251af0b7503744d229d187245b7e1eab687ce639fad574c8b15bb795f569720a0c99

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/VersionFinder.cs

@@ -62,23 +62,24 @@ internal static class VersionFinder
 
         foreach (var source in sources)
         {
-            var sourceRepository = Repository.Factory.GetCoreV3(source);
-            var feed = await sourceRepository.GetResourceAsync<MetadataResource>();
-            if (feed is null)
+            MetadataResource? feed = null;
+            try
             {
-                logger.Warn($"Failed to get {nameof(MetadataResource)} for [{source.Source}]");
-                continue;
-            }
+                var sourceRepository = Repository.Factory.GetCoreV3(source);
+                feed = await sourceRepository.GetResourceAsync<MetadataResource>();
+                if (feed is null)
+                {
+                    logger.Warn($"Failed to get {nameof(MetadataResource)} for [{source.Source}]");
+                    continue;
+                }
 
-            var packageFinder = await sourceRepository.GetResourceAsync<FindPackageByIdResource>();
-            if (packageFinder is null)
-            {
-                logger.Warn($"Failed to get {nameof(FindPackageByIdResource)} for [{source.Source}]");
-                continue;
-            }
+                var packageFinder = await sourceRepository.GetResourceAsync<FindPackageByIdResource>();
+                if (packageFinder is null)
+                {
+                    logger.Warn($"Failed to get {nameof(FindPackageByIdResource)} for [{source.Source}]");
+                    continue;
+                }
 
-            try
-            {
                 // a non-compliant v2 API returning 404 can cause this to throw
                 var existsInFeed = await feed.Exists(
                     packageId,

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -147,20 +147,43 @@ public class RunWorker
                 var extraFilePath = Path.Join(projectDirectory, extraFile);
                 await TrackOriginalContentsAsync(discoveryResult.Path, extraFilePath);
             }
-            // TODO: include global.json, etc.
+        }
+
+        var nonProjectFiles = new[]
+        {
+            discoveryResult.GlobalJson?.FilePath,
+            discoveryResult.DotNetToolsJson?.FilePath,
+        }.Where(f => f is not null).Cast<string>().ToArray();
+        foreach (var nonProjectFile in nonProjectFiles)
+        {
+            await TrackOriginalContentsAsync(discoveryResult.Path, nonProjectFile);
         }
 
         // do update
         var updateOperations = GetUpdateOperations(discoveryResult).ToArray();
-        foreach (var updateOperation in updateOperations)
+        var allowedUpdateOperations = updateOperations.Where(u => IsUpdateAllowed(job, u.Dependency)).ToArray();
+
+        // requested update isn't listed => SecurityUpdateNotNeeded
+        var expectedSecurityUpdateDependencyNames = job.SecurityAdvisories
+            .Select(s => s.DependencyName)
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        var actualUpdateDependencyNames = allowedUpdateOperations
+            .Select(u => u.Dependency.Name)
+            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        var expectedDependencyUpdateMissingInActual = expectedSecurityUpdateDependencyNames
+            .Except(actualUpdateDependencyNames, StringComparer.OrdinalIgnoreCase)
+            .OrderBy(d => d, StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+
+        foreach (var missingSecurityUpdate in expectedDependencyUpdateMissingInActual)
         {
-            var dependency = updateOperation.Dependency;
-            if (!IsUpdateAllowed(job, dependency))
-            {
-                continue;
-            }
+            await _apiHandler.RecordUpdateJobError(new SecurityUpdateNotNeeded(missingSecurityUpdate));
+        }
 
-            _logger.Info($"Updating [{dependency.Name}] in [{updateOperation.ProjectPath}]");
+        foreach (var updateOperation in allowedUpdateOperations)
+        {
+            var dependency = updateOperation.Dependency;
+            _logger.Info($"Updating [{dependency.Name}] in [{updateOperation.FilePath}]");
 
             var dependencyInfo = GetDependencyInfo(job, dependency);
             var analysisResult = await _analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
@@ -169,7 +192,7 @@ public class RunWorker
             {
                 // TODO: this is inefficient, but not likely causing a bottleneck
                 var previousDependency = discoveredUpdatedDependencies.Dependencies
-                    .Single(d => d.Name == dependency.Name && d.Requirements.Single().File == updateOperation.ProjectPath);
+                    .Single(d => d.Name == dependency.Name && d.Requirements.Single().File == updateOperation.FilePath);
                 var updatedDependency = new ReportedDependency()
                 {
                     Name = dependency.Name,
@@ -178,7 +201,7 @@ public class RunWorker
                     [
                         new ReportedRequirement()
                         {
-                            File = updateOperation.ProjectPath,
+                            File = updateOperation.FilePath,
                             Requirement = analysisResult.UpdatedVersion,
                             Groups = previousDependency.Requirements.Single().Groups,
                             Source = new RequirementSource()
@@ -191,7 +214,7 @@ public class RunWorker
                     PreviousRequirements = previousDependency.Requirements,
                 };
 
-                var updateResult = await _updaterWorker.RunAsync(repoContentsPath.FullName, updateOperation.ProjectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, isTransitive: dependency.IsTransitive);
+                var updateResult = await _updaterWorker.RunAsync(repoContentsPath.FullName, updateOperation.FilePath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, isTransitive: dependency.IsTransitive);
                 // TODO: need to report if anything was actually updated
                 if (updateResult.Error is null)
                 {
@@ -214,7 +237,6 @@ public class RunWorker
 
             if (updatedContent != originalContent)
             {
-
                 updatedDependencyFiles[localFullPath] = new DependencyFile()
                 {
                     Name = Path.GetFileName(repoFullPath),
@@ -233,7 +255,11 @@ public class RunWorker
                 var extraFilePath = Path.Join(projectDirectory, extraFile);
                 await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, extraFilePath);
             }
-            // TODO: handle global.json, etc.
+        }
+
+        foreach (var nonProjectFile in nonProjectFiles)
+        {
+            await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, nonProjectFile);
         }
 
         if (updatedDependencyFiles.Count > 0)
@@ -276,34 +302,50 @@ public class RunWorker
         return result;
     }
 
-    internal static IEnumerable<(string ProjectPath, Dependency Dependency)> GetUpdateOperations(WorkspaceDiscoveryResult discovery)
+    internal static IEnumerable<(string FilePath, Dependency Dependency)> GetUpdateOperations(WorkspaceDiscoveryResult discovery)
     {
-        // discovery is grouped by project then dependency, but we want to pivot and return a list of update operations sorted by dependency name then project path
+        // discovery is grouped by project/file then dependency, but we want to pivot and return a list of update operations sorted by dependency name then file path
 
         var updateOrder = new Dictionary<string, Dictionary<string, Dictionary<string, Dependency>>>(StringComparer.OrdinalIgnoreCase);
-        //                     <dependency name,     <project path, specific dependencies>>
+        //                     <dependency name,        <file path, specific dependencies>>
 
         // collect
-        foreach (var project in discovery.Projects)
+        void CollectDependenciesForFile(string filePath, IEnumerable<Dependency> dependencies)
         {
-            var projectPath = Path.Join(discovery.Path, project.FilePath).FullyNormalizedRootedPath();
-            foreach (var dependency in project.Dependencies)
+            foreach (var dependency in dependencies)
             {
                 var dependencyGroup = updateOrder.GetOrAdd(dependency.Name, () => new Dictionary<string, Dictionary<string, Dependency>>(PathComparer.Instance));
-                var dependenciesForProject = dependencyGroup.GetOrAdd(projectPath, () => new Dictionary<string, Dependency>(StringComparer.OrdinalIgnoreCase));
-                dependenciesForProject[dependency.Name] = dependency;
+                var dependenciesForFile = dependencyGroup.GetOrAdd(filePath, () => new Dictionary<string, Dependency>(StringComparer.OrdinalIgnoreCase));
+                dependenciesForFile[dependency.Name] = dependency;
             }
         }
+        foreach (var project in discovery.Projects)
+        {
+            var projectPath = Path.Join(discovery.Path, project.FilePath).FullyNormalizedRootedPath();
+            CollectDependenciesForFile(projectPath, project.Dependencies);
+        }
+
+        if (discovery.GlobalJson is not null)
+        {
+            var globalJsonPath = Path.Join(discovery.Path, discovery.GlobalJson.FilePath).FullyNormalizedRootedPath();
+            CollectDependenciesForFile(globalJsonPath, discovery.GlobalJson.Dependencies);
+        }
+
+        if (discovery.DotNetToolsJson is not null)
+        {
+            var dotnetToolsJsonPath = Path.Join(discovery.Path, discovery.DotNetToolsJson.FilePath).FullyNormalizedRootedPath();
+            CollectDependenciesForFile(dotnetToolsJsonPath, discovery.DotNetToolsJson.Dependencies);
+        }
 
         // return
         foreach (var dependencyName in updateOrder.Keys.OrderBy(k => k, StringComparer.OrdinalIgnoreCase))
         {
-            var projectDependencies = updateOrder[dependencyName];
-            foreach (var projectPath in projectDependencies.Keys.OrderBy(p => p, PathComparer.Instance))
+            var fileDependencies = updateOrder[dependencyName];
+            foreach (var filePath in fileDependencies.Keys.OrderBy(p => p, PathComparer.Instance))
             {
-                var dependencies = projectDependencies[projectPath];
+                var dependencies = fileDependencies[filePath];
                 var dependency = dependencies[dependencyName];
-                yield return (projectPath, dependency);
+                yield return (filePath, dependency);
             }
         }
     }
@@ -450,35 +492,69 @@ public class RunWorker
             }
         }
 
+        var allDependenciesWithFilePath = discoveryResult.Projects.SelectMany(p =>
+        {
+            return p.Dependencies
+                .Where(d => d.Version is not null)
+                .Select(d =>
+                    (p.FilePath, new ReportedDependency()
+                    {
+                        Name = d.Name,
+                        Requirements = [new ReportedRequirement()
+                            {
+                                File = GetFullRepoPath(p.FilePath),
+                                Requirement = d.Version!,
+                                Groups = ["dependencies"],
+                            }],
+                        Version = d.Version,
+                    }));
+        }).ToList();
+
+        var nonProjectDependencySet = new (string?, IEnumerable<Dependency>)[]
+        {
+            (discoveryResult.GlobalJson?.FilePath, discoveryResult.GlobalJson?.Dependencies ?? []),
+            (discoveryResult.DotNetToolsJson?.FilePath, discoveryResult.DotNetToolsJson?.Dependencies ?? []),
+        };
+
+        foreach (var (filePath, dependencies) in nonProjectDependencySet)
+        {
+            if (filePath is null)
+            {
+                continue;
+            }
+
+            allDependenciesWithFilePath.AddRange(dependencies
+                .Where(d => d.Version is not null)
+                .Select(d =>
+                    (filePath, new ReportedDependency()
+                    {
+                        Name = d.Name,
+                        Requirements = [new ReportedRequirement()
+                            {
+                                File = GetFullRepoPath(filePath),
+                                Requirement = d.Version!,
+                                Groups = ["dependencies"],
+                            }],
+                        Version = d.Version,
+                    })));
+        }
+
+        var sortedDependencies = allDependenciesWithFilePath
+            .OrderBy(pair => Path.Join(discoveryResult.Path, pair.FilePath).FullyNormalizedRootedPath(), PathComparer.Instance)
+            .ThenBy(pair => pair.Item2.Name, StringComparer.OrdinalIgnoreCase)
+            .Select(pair => pair.Item2)
+            .ToArray();
+
         var dependencyFiles = discoveryResult.Projects
             .Select(p => GetFullRepoPath(p.FilePath))
             .Concat(auxiliaryFiles)
             .Distinct()
             .OrderBy(p => p)
             .ToArray();
-        var orderedProjects = discoveryResult.Projects
-            .OrderBy(p => Path.Join(discoveryResult.Path, p.FilePath).FullyNormalizedRootedPath(), PathComparer.Instance)
-            .ToArray();
+
         var updatedDependencyList = new UpdatedDependencyList()
         {
-            Dependencies = orderedProjects.SelectMany(p =>
-            {
-                return p.Dependencies
-                    .Where(d => d.Version is not null)
-                    .OrderBy(d => d.Name, StringComparer.OrdinalIgnoreCase)
-                    .Select(d =>
-                        new ReportedDependency()
-                        {
-                            Name = d.Name,
-                            Requirements = [new ReportedRequirement()
-                            {
-                                File = GetFullRepoPath(p.FilePath),
-                                Requirement = d.Version!,
-                                Groups = ["dependencies"],
-                            }],
-                            Version = d.Version,
-                        });
-            }).ToArray(),
+            Dependencies = sortedDependencies,
             DependencyFiles = dependencyFiles,
         };
         return updatedDependencyList;

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -795,7 +795,7 @@ internal static partial class MSBuildHelper
             );
             return (exitCode, stdOut, stdErr);
         });
-        ThrowOnUnauthenticatedFeed(stdOut);
+        ThrowOnError(stdOut);
         if (exitCode != 0)
         {
             logger.Warn($"Error determining target frameworks.\nSTDOUT:\n{stdOut}\nSTDERR:\n{stdErr}");
@@ -975,6 +975,7 @@ internal static partial class MSBuildHelper
             new Regex(@"Package '(?<PackageName>[^']*)' is not found on source '(?<PackageSource>[^$\r\n]*)'\."),
             new Regex(@"Unable to find package (?<PackageName>[^ ]+)\. No packages exist with this id in source\(s\): (?<PackageSource>.*)$", RegexOptions.Multiline),
             new Regex(@"Unable to find package (?<PackageName>[^ ]+) with version \((?<PackageVersion>[^)]+)\)"),
+            new Regex(@"Could not resolve SDK ""(?<PackageName>[^ ]+)""\."),
         };
         var matches = patterns.Select(p => p.Match(output)).Where(m => m.Success);
         if (matches.Any())

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs

@@ -1300,6 +1300,56 @@ public partial class AnalyzeWorkerTests : AnalyzeWorkerTestBase
         );
     }
 
+    [Fact]
+    public async Task NuGetSourceDoesNotExist()
+    {
+        // this test simulates a `NuGet.Config` that points to an internal-only domain that dependabot doesn't have access to
+        await TestAnalyzeAsync(
+            extraFiles: [
+                ("NuGet.Config", """
+                    <configuration>
+                      <packageSources>
+                        <clear />
+                        <add key="feed_that_does_not_exist" value="https://this-domain-does-not-exist/nuget/v2" />
+                      </packageSources>
+                    </configuration>
+                    """)
+            ],
+            discovery: new()
+            {
+                Path = "/",
+                Projects = [
+                    new()
+                    {
+                        FilePath = "./project.csproj",
+                        TargetFrameworks = ["net9.0"],
+                        Dependencies = [
+                            new("Some.Package", "1.0.0", DependencyType.PackageReference),
+                        ],
+                        ReferencedProjectPaths = [],
+                        ImportedFiles = [],
+                        AdditionalFiles = [],
+                    }
+                ]
+            },
+            dependencyInfo: new()
+            {
+                Name = "Some.Package",
+                Version = "1.0.0",
+                IgnoredVersions = [],
+                IsVulnerable = false,
+                Vulnerabilities = [],
+            },
+            expectedResult: new()
+            {
+                CanUpdate = false,
+                UpdatedVersion = "1.0.0",
+                VersionComesFromMultiDependencyProperty = false,
+                UpdatedDependencies = [],
+            }
+        );
+    }
+
     [Fact]
     public void DeserializeDependencyInfo_UnsupportedIgnoredVersionsAreIgnored()
     {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs

@@ -1355,4 +1355,30 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
             }
         );
     }
+
+    [Fact]
+    public async Task MissingFileIsReported()
+    {
+        await TestDiscoveryAsync(
+            packages: [],
+            experimentsManager: new ExperimentsManager() { UseDirectDiscovery = true, InstallDotnetSdks = true },
+            workspacePath: "",
+            files: [
+                ("project.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <Import Project="file-that-does-not-exist.props" />
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                      </PropertyGroup>
+                    </Project>
+                    """)
+            ],
+            expectedResult: new()
+            {
+                Path = "",
+                Projects = [],
+                ErrorRegex = @"file-that-does-not-exist\.props",
+            }
+        );
+    }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/MiscellaneousTests.cs

@@ -58,7 +58,7 @@ public class MiscellaneousTests
     public void GetUpdateOperations(WorkspaceDiscoveryResult discovery, (string ProjectPath, string DependencyName)[] expectedUpdateOperations)
     {
         var updateOperations = RunWorker.GetUpdateOperations(discovery).ToArray();
-        var actualUpdateOperations = updateOperations.Select(uo => (uo.ProjectPath, uo.Dependency.Name)).ToArray();
+        var actualUpdateOperations = updateOperations.Select(uo => (uo.FilePath, uo.Dependency.Name)).ToArray();
         Assert.Equal(expectedUpdateOperations, actualUpdateOperations);
     }
 
@@ -94,6 +94,34 @@ public class MiscellaneousTests
                 ("/src/Common.csproj", "Package.D"),
             },
         ];
+
+        yield return
+        [
+            new WorkspaceDiscoveryResult()
+            {
+                Path = "",
+                Projects = [],
+                GlobalJson = new()
+                {
+                    FilePath = "global.json",
+                    Dependencies = [
+                        new("Some.MSBuild.Sdk", "1.0.0", DependencyType.MSBuildSdk)
+                    ]
+                },
+                DotNetToolsJson = new()
+                {
+                    FilePath = ".config/dotnet-tools.json",
+                    Dependencies = [
+                        new("some-tool", "2.0.0", DependencyType.DotNetTool)
+                    ]
+                }
+            },
+            new (string, string)[]
+            {
+                ("/.config/dotnet-tools.json", "some-tool"),
+                ("/global.json", "Some.MSBuild.Sdk"),
+            }
+        ];
     }
 
     public static IEnumerable<object?[]> RequirementsFromIgnoredVersionsData()

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/RunWorkerTests.cs

@@ -2072,6 +2072,391 @@ public class RunWorkerTests
         );
     }
 
+    [Fact]
+    public async Task PackageListedInSecurityAdvisoriesSectionIsNotVulnerable()
+    {
+        await RunAsync(
+            job: new()
+            {
+                Source = new()
+                {
+                    Provider = "github",
+                    Repo = "test/repo",
+                },
+                SecurityUpdatesOnly = true,
+                SecurityAdvisories = [
+                    new()
+                    {
+                        DependencyName = "Package.Is.Not.Vulnerable",
+                        AffectedVersions = [Requirement.Parse("< 1.0.0")]
+                    }
+                ]
+            },
+            files: [
+                ("project.csproj", "contents irrelevant")
+            ],
+            discoveryWorker: new TestDiscoveryWorker(_input =>
+            {
+                return Task.FromResult(new WorkspaceDiscoveryResult()
+                {
+                    Path = "",
+                    Projects = [
+                        new()
+                        {
+                            FilePath = "project.csproj",
+                            Dependencies = [
+                                new("Package.Is.Not.Vulnerable", "1.0.1", DependencyType.PackageReference)
+                            ],
+                            ImportedFiles = [],
+                            AdditionalFiles = [],
+                        }
+                    ]
+                });
+            }),
+            analyzeWorker: new TestAnalyzeWorker(_input => throw new NotImplementedException("test shouldn't get this far")),
+            updaterWorker: new TestUpdaterWorker(_input => throw new NotImplementedException("test shouldn't get this far")),
+            expectedResult: new()
+            {
+                Base64DependencyFiles = [
+                    new()
+                    {
+                        Directory = "/",
+                        Name = "project.csproj",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("contents irrelevant"))
+                    }
+                ],
+                BaseCommitSha = "TEST-COMMIT-SHA",
+            },
+            expectedApiMessages: [
+                new UpdatedDependencyList()
+                {
+                    Dependencies = [
+                        new()
+                        {
+                            Name = "Package.Is.Not.Vulnerable",
+                            Version = "1.0.1",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "1.0.1",
+                                    File = "/project.csproj",
+                                    Groups = ["dependencies"],
+                                }
+                            ]
+                        }
+                    ],
+                    DependencyFiles = ["/project.csproj"]
+                },
+                new IncrementMetric()
+                {
+                    Metric = "updater.started",
+                    Tags = new()
+                    {
+                        ["operation"] = "create_security_pr"
+                    }
+                },
+                new SecurityUpdateNotNeeded("Package.Is.Not.Vulnerable"),
+                new MarkAsProcessed("TEST-COMMIT-SHA"),
+            ]
+        );
+    }
+
+    [Fact]
+    public async Task PackageListedInSecurityAdvisoriesSectionIsNotPresent()
+    {
+        await RunAsync(
+            job: new()
+            {
+                Source = new()
+                {
+                    Provider = "github",
+                    Repo = "test/repo",
+                },
+                SecurityUpdatesOnly = true,
+                SecurityAdvisories = [
+                    new()
+                    {
+                        DependencyName = "Package.Is.Not.Vulnerable",
+                        AffectedVersions = [Requirement.Parse("< 1.0.0")]
+                    }
+                ]
+            },
+            files: [
+                ("project.csproj", "contents irrelevant")
+            ],
+            discoveryWorker: new TestDiscoveryWorker(_input =>
+            {
+                return Task.FromResult(new WorkspaceDiscoveryResult()
+                {
+                    Path = "",
+                    Projects = [
+                        new()
+                        {
+                            FilePath = "project.csproj",
+                            Dependencies = [
+                                new("Unrelated.Package", "0.1.0", DependencyType.PackageReference)
+                            ],
+                            ImportedFiles = [],
+                            AdditionalFiles = [],
+                        }
+                    ]
+                });
+            }),
+            analyzeWorker: new TestAnalyzeWorker(_input => throw new NotImplementedException("test shouldn't get this far")),
+            updaterWorker: new TestUpdaterWorker(_input => throw new NotImplementedException("test shouldn't get this far")),
+            expectedResult: new()
+            {
+                Base64DependencyFiles = [
+                    new()
+                    {
+                        Directory = "/",
+                        Name = "project.csproj",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("contents irrelevant"))
+                    }
+                ],
+                BaseCommitSha = "TEST-COMMIT-SHA",
+            },
+            expectedApiMessages: [
+                new UpdatedDependencyList()
+                {
+                    Dependencies = [
+                        new()
+                        {
+                            Name = "Unrelated.Package",
+                            Version = "0.1.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "0.1.0",
+                                    File = "/project.csproj",
+                                    Groups = ["dependencies"],
+                                }
+                            ]
+                        }
+                    ],
+                    DependencyFiles = ["/project.csproj"]
+                },
+                new IncrementMetric()
+                {
+                    Metric = "updater.started",
+                    Tags = new()
+                    {
+                        ["operation"] = "create_security_pr"
+                    }
+                },
+                new SecurityUpdateNotNeeded("Package.Is.Not.Vulnerable"),
+                new MarkAsProcessed("TEST-COMMIT-SHA"),
+            ]
+        );
+    }
+
+    [Fact]
+    public async Task NonProjectFilesAreIncludedInPullRequest()
+    {
+        await RunAsync(
+            job: new()
+            {
+                Source = new()
+                {
+                    Provider = "github",
+                    Repo = "test/repo",
+                },
+            },
+            files: [
+                (".config/dotnet-tools.json", "dotnet-tools.json content old"),
+                ("global.json", "global.json content old")
+            ],
+            discoveryWorker: new TestDiscoveryWorker(input =>
+            {
+                return Task.FromResult(new WorkspaceDiscoveryResult()
+                {
+                    Path = "",
+                    Projects = [],
+                    DotNetToolsJson = new()
+                    {
+                        FilePath = ".config/dotnet-tools.json",
+                        Dependencies = [
+                            new("some-tool", "2.0.0", DependencyType.DotNetTool),
+                        ]
+                    },
+                    GlobalJson = new()
+                    {
+                        FilePath = "global.json",
+                        Dependencies = [
+                            new("Some.MSBuild.Sdk", "1.0.0", DependencyType.MSBuildSdk),
+                        ],
+                    },
+                });
+            }),
+            analyzeWorker: new TestAnalyzeWorker(input =>
+            {
+                var (_repoRoot, _discoveryResult, dependencyInfo) = input;
+                var result = dependencyInfo.Name switch
+                {
+                    "some-tool" => new AnalysisResult() { CanUpdate = true, UpdatedVersion = "2.0.1", UpdatedDependencies = [new("some-tool", "2.0.1", DependencyType.DotNetTool)] },
+                    "Some.MSBuild.Sdk" => new AnalysisResult() { CanUpdate = true, UpdatedVersion = "1.0.1", UpdatedDependencies = [new("Some.MSBuild.Sdk", "1.0.1", DependencyType.MSBuildSdk)] },
+                    _ => throw new NotImplementedException("unreachable")
+                };
+                return Task.FromResult(result);
+            }),
+            updaterWorker: new TestUpdaterWorker(async input =>
+            {
+                var (repoRoot, filePath, dependencyName, _previousVersion, _newVersion, _isTransitive) = input;
+                var dependencyFilePath = Path.Join(repoRoot, filePath);
+                var updatedContent = dependencyName switch
+                {
+                    "some-tool" => "dotnet-tools.json content UPDATED",
+                    "Some.MSBuild.Sdk" => "global.json content UPDATED",
+                    _ => throw new NotImplementedException("unreachable")
+                };
+                await File.WriteAllTextAsync(dependencyFilePath, updatedContent);
+                return new UpdateOperationResult();
+            }),
+            expectedResult: new()
+            {
+                Base64DependencyFiles = [
+                    new()
+                    {
+                        Directory = "/.config",
+                        Name = "dotnet-tools.json",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("dotnet-tools.json content old"))
+                    },
+                    new()
+                    {
+                        Directory = "/",
+                        Name = "global.json",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("global.json content old"))
+                    },
+                ],
+                BaseCommitSha = "TEST-COMMIT-SHA",
+            },
+            expectedApiMessages: [
+                new UpdatedDependencyList()
+                {
+                    Dependencies = [
+                        new()
+                        {
+                            Name = "some-tool",
+                            Version = "2.0.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "2.0.0",
+                                    File = "/.config/dotnet-tools.json",
+                                    Groups = ["dependencies"],
+                                }
+                            ]
+                        },
+                        new()
+                        {
+                            Name = "Some.MSBuild.Sdk",
+                            Version = "1.0.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "1.0.0",
+                                    File = "/global.json",
+                                    Groups = ["dependencies"],
+                                }
+                            ]
+                        },
+                    ],
+                    DependencyFiles = ["/.config/dotnet-tools.json", "/global.json"]
+                },
+                new IncrementMetric()
+                {
+                    Metric = "updater.started",
+                    Tags = new()
+                    {
+                        ["operation"] = "group_update_all_versions"
+                    }
+                },
+                new CreatePullRequest()
+                {
+                    Dependencies =
+                    [
+                        new ReportedDependency()
+                        {
+                            Name = "some-tool",
+                            Version = "2.0.1",
+                            Requirements =
+                            [
+                                new ReportedRequirement()
+                                {
+                                    Requirement = "2.0.1",
+                                    File = "/.config/dotnet-tools.json",
+                                    Groups = ["dependencies"],
+                                    Source = new()
+                                    {
+                                        SourceUrl = null,
+                                    }
+                                }
+                            ],
+                            PreviousVersion = "2.0.0",
+                            PreviousRequirements =
+                            [
+                                new ReportedRequirement()
+                                {
+                                    Requirement = "2.0.0",
+                                    File = "/.config/dotnet-tools.json",
+                                    Groups = ["dependencies"],
+                                }
+                            ],
+                        },
+                        new ReportedDependency()
+                        {
+                            Name = "Some.MSBuild.Sdk",
+                            Version = "1.0.1",
+                            Requirements =
+                            [
+                                new ReportedRequirement()
+                                {
+                                    Requirement = "1.0.1",
+                                    File = "/global.json",
+                                    Groups = ["dependencies"],
+                                    Source = new()
+                                    {
+                                        SourceUrl = null,
+                                    }
+                                }
+                            ],
+                            PreviousVersion = "1.0.0",
+                            PreviousRequirements =
+                            [
+                                new ReportedRequirement()
+                                {
+                                    Requirement = "1.0.0",
+                                    File = "/global.json",
+                                    Groups = ["dependencies"],
+                                }
+                            ],
+                        },
+                    ],
+                    UpdatedDependencyFiles =
+                    [
+                        new DependencyFile()
+                        {
+                            Name = "dotnet-tools.json",
+                            Directory = "/.config",
+                            Content = "dotnet-tools.json content UPDATED",
+                        },
+                        new DependencyFile()
+                        {
+                            Name = "global.json",
+                            Directory = "/",
+                            Content = "global.json content UPDATED",
+                        },
+                    ],
+                    BaseCommitSha = "TEST-COMMIT-SHA",
+                    CommitMessage = "TODO: message",
+                    PrTitle = "TODO: title",
+                    PrBody = "TODO: body",
+                },
+                new MarkAsProcessed("TEST-COMMIT-SHA"),
+            ]
+        );
+    }
+
     private static async Task RunAsync(Job job, TestFile[] files, IDiscoveryWorker? discoveryWorker, IAnalyzeWorker? analyzeWorker, IUpdaterWorker? updaterWorker, RunResult expectedResult, object[] expectedApiMessages, MockNuGetPackage[]? packages = null, ExperimentsManager? experimentsManager = null, string? repoContentsPath = null)
     {
         // arrange

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/UpdatedDependencyListTests.cs

@@ -17,6 +17,7 @@ public class UpdatedDependencyListTests
         Directory.CreateDirectory(Path.Combine(temp.DirectoryPath, "src", "a"));
         Directory.CreateDirectory(Path.Combine(temp.DirectoryPath, "src", "b"));
         Directory.CreateDirectory(Path.Combine(temp.DirectoryPath, "src", "c"));
+        Directory.CreateDirectory(Path.Combine(temp.DirectoryPath, ".config"));
 
         File.WriteAllText(Path.Combine(temp.DirectoryPath, "src", "a", "packages.config"), "");
         File.WriteAllText(Path.Combine(temp.DirectoryPath, "src", "b", "packages.config"), "");
@@ -25,6 +26,9 @@ public class UpdatedDependencyListTests
         File.WriteAllText(Path.Combine(temp.DirectoryPath, "src", "b", "project.csproj"), "");
         File.WriteAllText(Path.Combine(temp.DirectoryPath, "src", "c", "project.csproj"), "");
 
+        File.WriteAllText(Path.Combine(temp.DirectoryPath, "global.json"), "");
+        File.WriteAllText(Path.Combine(temp.DirectoryPath, ".config/dotnet-tools.json"), "");
+
         var discovery = new WorkspaceDiscoveryResult()
         {
             Path = "src",
@@ -69,13 +73,55 @@ public class UpdatedDependencyListTests
                     ImportedFiles = [],
                     AdditionalFiles = ["packages.config"],
                 }
-            ]
+            ],
+            GlobalJson = new()
+            {
+                FilePath = "../global.json",
+                Dependencies = [
+                    new("Some.MSBuild.Sdk", "1.0.0", DependencyType.MSBuildSdk)
+                ]
+            },
+            DotNetToolsJson = new()
+            {
+                FilePath = "../.config/dotnet-tools.json",
+                Dependencies = [
+                    new("some-tool", "2.0.0", DependencyType.DotNetTool)
+                ]
+            }
         };
         var updatedDependencyList = RunWorker.GetUpdatedDependencyListFromDiscovery(discovery, pathToContents: temp.DirectoryPath);
         var expectedDependencyList = new UpdatedDependencyList()
         {
             Dependencies =
             [
+                new ReportedDependency()
+                {
+                    Name = "some-tool",
+                    Version = "2.0.0",
+                    Requirements =
+                    [
+                        new ReportedRequirement()
+                        {
+                            Requirement = "2.0.0",
+                            File = "/.config/dotnet-tools.json",
+                            Groups = ["dependencies"],
+                        }
+                    ]
+                },
+                new ReportedDependency()
+                {
+                    Name = "Some.MSBuild.Sdk",
+                    Version = "1.0.0",
+                    Requirements =
+                    [
+                        new ReportedRequirement()
+                        {
+                            Requirement = "1.0.0",
+                            File = "/global.json",
+                            Groups = ["dependencies"],
+                        }
+                    ]
+                },
                 new ReportedDependency()
                 {
                     Name = "Microsoft.Extensions.DependencyModel",
@@ -119,7 +165,7 @@ public class UpdatedDependencyListTests
                     ],
                 },
             ],
-            DependencyFiles = ["/src/a/packages.config", "/src/a/project.csproj", "/src/b/packages.config", "/src/b/project.csproj", "/src/c/packages.config", "/src/c/project.csproj"],
+            DependencyFiles = ["/.config/dotnet-tools.json", "/global.json", "/src/a/packages.config", "/src/a/project.csproj", "/src/b/packages.config", "/src/b/project.csproj", "/src/c/packages.config", "/src/c/project.csproj"],
         };
 
         // doing JSON comparison makes this easier; we don't have to define custom record equality and we get an easy diff

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs

@@ -1542,6 +1542,14 @@ public class MSBuildHelperTests : TestBase
             new DependencyNotFound("Some.Package"),
         ];
 
+        yield return
+        [
+            // output
+            """error : Could not resolve SDK "missing-sdk".""",
+            // expectedError
+            new DependencyNotFound("missing-sdk"),
+        ];
+
         yield return
         [
             // output

data/lib/dependabot/nuget/file_fetcher.rb

@@ -26,6 +26,7 @@ module Dependabot
 
       sig { override.returns(T::Array[DependencyFile]) }
       def fetch_files
+        NativeHelpers.normalize_file_names
         NativeHelpers.install_dotnet_sdks
         discovery_json_reader = DiscoveryJsonReader.run_discovery_in_directory(
           repo_contents_path: T.must(repo_contents_path),

data/lib/dependabot/nuget/native_helpers.rb

@@ -286,6 +286,22 @@ module Dependabot
         end
       end
 
+      sig { void }
+      def self.normalize_file_names
+        # environment variables are required and the following will generate an actionable error message if they're not
+        _dependabot_repo_contents_path = ENV.fetch("DEPENDABOT_REPO_CONTENTS_PATH")
+
+        # this environment variable is directly used
+        dependabot_home = ENV.fetch("DEPENDABOT_HOME")
+
+        command = [
+          "pwsh",
+          "#{dependabot_home}/dependabot-updater/bin/normalize-file-names.ps1"
+        ].join(" ")
+        output = SharedHelpers.run_shell_command(command)
+        puts output
+      end
+
       sig { void }
       def self.install_dotnet_sdks
         return unless Dependabot::Experiments.enabled?(:nuget_install_dotnet_sdks)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.298.0
+  version: 0.299.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-02-20 00:00:00.000000000 Z
+date: 2025-02-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.298.0
+        version: 0.299.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.298.0
+        version: 0.299.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -537,7 +537,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.298.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.299.0
 post_install_message:
 rdoc_options: []
 require_paths: