dependabot-nuget 0.301.1 → 0.302.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 956d84d6354497a9a36a640e0851ae0c97b739f32d8a4fcedc670eb3dc9f2175
-  data.tar.gz: bdabf60631928f0bdb355d92b8f12466764349c5e482b9da073679b733531be2
+  metadata.gz: aa40dad694a6849be3c9da853f6d075f0db1f44f9cc9338e07586405e5f02bcc
+  data.tar.gz: 0f7ddac2d69e9a1dce70c7000b3159c0daf337816c93b9498678d58fa3753afc
 SHA512:
-  metadata.gz: 677106b7e78e73b53bc3238a802e56028f18e33104b3ef7e15107abff684241bc87cfcf44f6c64470bf32ae3e0e3dded3c45f3799c422838239f06f9edd70b3a
-  data.tar.gz: b906f03ce619ac2d45a907325e7b2a249976ef34056ef8e0d06db38f3c3f8a9a02be72c6e8210749cee1fcc03c4ca9afa9c0b5659838625ecd76bc00c121e19a
+  metadata.gz: ee07bf8ca5e089cc11ec1e077e2982b0525ac071f77f1411c3f2fdda7ffe378e6ecfa9d00c2762dee45dc65dd5fd76bcea3f1e2688dae83a1e431470744695f3
+  data.tar.gz: 5f0837e22360fb06fca6271bbd335e921e72be1d79d1b36802ca7aa80cecfb92c0218ae7b1a1914de7b45bde64d5c5ff34c4f1450c2405c30ac981d0dd90ea67

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyDiscovery.props

@@ -10,7 +10,10 @@
     -->
     <_DefaultTargetPlatformVersion Condition="'$(_DefaultTargetPlatformVersion)' == ''">0.0</_DefaultTargetPlatformVersion>
     <DesignTimeBuild>true</DesignTimeBuild>
+    <GenerateDependencyFile>true</GenerateDependencyFile>
+    <NuGetInteractive>false</NuGetInteractive>
+    <RunAnalyzers>false</RunAnalyzers>
     <EnableWindowsTargeting Condition="$(TargetFramework.Contains('-windows'))">true</EnableWindowsTargeting>
-    <TargetPlatformVersion Condition="$(TargetPlatformVersion) == '' AND $(TargetFramework.Contains('-'))">$(_DefaultTargetPlatformVersion)</TargetPlatformVersion>
+    <TargetPlatformVersion Condition="$(TargetFramework.Contains('-')) AND '$(TargetPlatformVersion)' == ''">$(_DefaultTargetPlatformVersion)</TargetPlatformVersion>
   </PropertyGroup>
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyDiscovery.targets

@@ -1,15 +1,30 @@
 <Project>
   <PropertyGroup>
-    <!-- Dependency discovery requires a non-zero value for $(TargetPlatformVersion) -->
+    <!-- Dependency discovery requires a custom value for $(TargetPlatformVersion).  Minimum version of unspecified Windows targeting is 7.0. -->
     <_DefaultTargetPlatformVersion>1.0</_DefaultTargetPlatformVersion>
+    <_DefaultTargetPlatformVersion Condition="$(TargetFramework.ToLowerInvariant().EndsWith('-windows'))">7.0</_DefaultTargetPlatformVersion>
+    <_DiscoverDependenciesDependsOn>ResolveAssemblyReferences</_DiscoverDependenciesDependsOn>
+
+    <!-- only SDK-style projects set `$(NETCoreSdkVersion)`; legacy projects don't have it -->
+    <_IsLegacyStyleProject Condition="'$(NETCoreSdkVersion)' == ''">true</_IsLegacyStyleProject>
+
+    <!-- These targets only exists for SDK-style projects -->
+    <_DiscoverDependenciesDependsOn Condition="'$(_IsLegacyStyleProject)' != 'true'">$(_DiscoverDependenciesDependsOn);GenerateBuildDependencyFile;ResolvePackageAssets</_DiscoverDependenciesDependsOn>
+
+    <!-- For non-SDK-style projects, use a different target defined below -->
+    <_DiscoverDependenciesDependsOn Condition="'$(_IsLegacyStyleProject)' == 'true'">$(_DiscoverDependenciesDependsOn);_DependencyDiscovery_LegacyProjects</_DiscoverDependenciesDependsOn>
   </PropertyGroup>
 
   <Import Project="DependencyDiscovery.props" />
 
-  <Target Name="_DiscoverDependencies" DependsOnTargets="ResolveAssemblyReferences;GenerateBuildDependencyFile;ResolvePackageAssets">
+  <Target Name="_DiscoverDependencies" DependsOnTargets="$(_DiscoverDependenciesDependsOn)">
     <!--
-    The targets ResolveAssemblyReferences and GenerateBuildDependencyFile are sufficient for projects targeting .NET Standard or .NET Core.
-    The target ResolvePackageAssets is necessary for projects targeting .NET Framework.
+    This is purely a place to collect the `DependsOnTargets` attribute.
     -->
   </Target>
+
+  <Target Name="_DependencyDiscovery_LegacyProjects" Condition="'@(PackageReference)' != ''">
+    <!-- pseudo-sdk-style project; legacy, but with PackageReference elements - dependencies need to be resolved differently; output a sentinel value to notify the dependency discovery -->
+    <Message Text="_DependencyDiscovery_LegacyProjects::UseTemporaryProject" Importance="High" />
+  </Target>
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DiscoveryWorker.cs

@@ -10,6 +10,7 @@ using Microsoft.Build.Exceptions;
 using NuGet.Frameworks;
 
 using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Updater;
 using NuGetUpdater.Core.Utilities;
 
 namespace NuGetUpdater.Core.Discover;
@@ -324,101 +325,104 @@ public partial class DiscoveryWorker : IDiscoveryWorker
 
                 _processedProjectPaths.Add(actualProjectPath);
 
-                var relativeProjectPath = Path.GetRelativePath(workspacePath, actualProjectPath).NormalizePathToUnix();
-                var packagesConfigResult = await PackagesConfigDiscovery.Discover(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
-                var projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
-
-                // Determine if there were unrestored MSBuildSdks
-                var msbuildSdks = projectResults.SelectMany(p => p.Dependencies.Where(d => d.Type == DependencyType.MSBuildSdk)).ToImmutableArray();
-                if (msbuildSdks.Length > 0)
+                using (new SpecialImportsConditionPatcher(actualProjectPath))
                 {
-                    // If new SDKs were restored, then we need to rerun SdkProjectDiscovery.
-                    if (await TryRestoreMSBuildSdksAsync(repoRootPath, workspacePath, msbuildSdks, _logger))
-                    {
-                        projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
-                    }
-                }
+                    var relativeProjectPath = Path.GetRelativePath(workspacePath, actualProjectPath).NormalizePathToUnix();
+                    var packagesConfigResult = await PackagesConfigDiscovery.Discover(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
+                    var projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
 
-                foreach (var projectResult in projectResults)
-                {
-                    if (results.ContainsKey(projectResult.FilePath))
+                    // Determine if there were unrestored MSBuildSdks
+                    var msbuildSdks = projectResults.SelectMany(p => p.Dependencies.Where(d => d.Type == DependencyType.MSBuildSdk)).ToImmutableArray();
+                    if (msbuildSdks.Length > 0)
                     {
-                        continue;
+                        // If new SDKs were restored, then we need to rerun SdkProjectDiscovery.
+                        if (await TryRestoreMSBuildSdksAsync(repoRootPath, workspacePath, msbuildSdks, _logger))
+                        {
+                            projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
+                        }
                     }
 
-                    // If we had packages.config dependencies, merge them with the project dependencies
-                    if (projectResult.FilePath == relativeProjectPath && packagesConfigResult is not null)
+                    foreach (var projectResult in projectResults)
                     {
-                        var packagesConfigDependencies = packagesConfigResult.Dependencies
-                            .Select(d => d with { TargetFrameworks = projectResult.TargetFrameworks })
-                            .ToImmutableArray();
+                        if (results.ContainsKey(projectResult.FilePath))
+                        {
+                            continue;
+                        }
 
-                        results[projectResult.FilePath] = projectResult with
+                        // If we had packages.config dependencies, merge them with the project dependencies
+                        if (projectResult.FilePath == relativeProjectPath && packagesConfigResult is not null)
                         {
-                            Dependencies = [.. projectResult.Dependencies, .. packagesConfigDependencies],
-                        };
-                    }
-                    else
-                    {
-                        results[projectResult.FilePath] = projectResult;
-                    }
-                }
+                            var packagesConfigDependencies = packagesConfigResult.Dependencies
+                                .Select(d => d with { TargetFrameworks = projectResult.TargetFrameworks })
+                                .ToImmutableArray();
 
-                if (packagesConfigResult is not null)
-                {
-                    // we might have to merge this dependency with some others
-                    if (results.TryGetValue(relativeProjectPath, out var existingProjectDiscovery))
-                    {
-                        // merge SDK and packages.config results
-                        var mergedDependencies = existingProjectDiscovery.Dependencies.Concat(packagesConfigResult.Dependencies)
-                            .DistinctBy(d => d.Name, StringComparer.OrdinalIgnoreCase)
-                            .OrderBy(d => d.Name)
-                            .ToImmutableArray();
-                        var mergedTargetFrameworks = existingProjectDiscovery.TargetFrameworks.Concat(packagesConfigResult.TargetFrameworks)
-                            .Select(t =>
+                            results[projectResult.FilePath] = projectResult with
                             {
-                                try
-                                {
-                                    var tfm = NuGetFramework.Parse(t);
-                                    return tfm.GetShortFolderName();
-                                }
-                                catch
-                                {
-                                    return string.Empty;
-                                }
-                            })
-                            .Where(tfm => !string.IsNullOrEmpty(tfm))
-                            .Distinct()
-                            .OrderBy(tfm => tfm)
-                            .ToImmutableArray();
-                        var mergedProperties = existingProjectDiscovery.Properties; // packages.config discovery doesn't produce properties
-                        var mergedImportedFiles = existingProjectDiscovery.ImportedFiles; // packages.config discovery doesn't produce imported files
-                        var mergedAdditionalFiles = existingProjectDiscovery.AdditionalFiles.Concat(packagesConfigResult.AdditionalFiles)
-                            .Distinct(StringComparer.OrdinalIgnoreCase)
-                            .OrderBy(f => f)
-                            .ToImmutableArray();
-                        var mergedResult = new ProjectDiscoveryResult()
+                                Dependencies = [.. projectResult.Dependencies, .. packagesConfigDependencies],
+                            };
+                        }
+                        else
                         {
-                            FilePath = existingProjectDiscovery.FilePath,
-                            Dependencies = mergedDependencies,
-                            TargetFrameworks = mergedTargetFrameworks,
-                            Properties = mergedProperties,
-                            ImportedFiles = mergedImportedFiles,
-                            AdditionalFiles = mergedAdditionalFiles,
-                        };
-                        results[relativeProjectPath] = mergedResult;
+                            results[projectResult.FilePath] = projectResult;
+                        }
                     }
-                    else
+
+                    if (packagesConfigResult is not null)
                     {
-                        // add packages.config results
-                        results[relativeProjectPath] = new ProjectDiscoveryResult()
+                        // we might have to merge this dependency with some others
+                        if (results.TryGetValue(relativeProjectPath, out var existingProjectDiscovery))
                         {
-                            FilePath = relativeProjectPath,
-                            Dependencies = packagesConfigResult.Dependencies,
-                            TargetFrameworks = packagesConfigResult.TargetFrameworks,
-                            ImportedFiles = [], // no imported files resolved for packages.config scenarios
-                            AdditionalFiles = packagesConfigResult.AdditionalFiles,
-                        };
+                            // merge SDK and packages.config results
+                            var mergedDependencies = existingProjectDiscovery.Dependencies.Concat(packagesConfigResult.Dependencies)
+                                .DistinctBy(d => d.Name, StringComparer.OrdinalIgnoreCase)
+                                .OrderBy(d => d.Name)
+                                .ToImmutableArray();
+                            var mergedTargetFrameworks = existingProjectDiscovery.TargetFrameworks.Concat(packagesConfigResult.TargetFrameworks)
+                                .Select(t =>
+                                {
+                                    try
+                                    {
+                                        var tfm = NuGetFramework.Parse(t);
+                                        return tfm.GetShortFolderName();
+                                    }
+                                    catch
+                                    {
+                                        return string.Empty;
+                                    }
+                                })
+                                .Where(tfm => !string.IsNullOrEmpty(tfm))
+                                .Distinct()
+                                .OrderBy(tfm => tfm)
+                                .ToImmutableArray();
+                            var mergedProperties = existingProjectDiscovery.Properties; // packages.config discovery doesn't produce properties
+                            var mergedImportedFiles = existingProjectDiscovery.ImportedFiles; // packages.config discovery doesn't produce imported files
+                            var mergedAdditionalFiles = existingProjectDiscovery.AdditionalFiles.Concat(packagesConfigResult.AdditionalFiles)
+                                .Distinct(StringComparer.OrdinalIgnoreCase)
+                                .OrderBy(f => f)
+                                .ToImmutableArray();
+                            var mergedResult = new ProjectDiscoveryResult()
+                            {
+                                FilePath = existingProjectDiscovery.FilePath,
+                                Dependencies = mergedDependencies,
+                                TargetFrameworks = mergedTargetFrameworks,
+                                Properties = mergedProperties,
+                                ImportedFiles = mergedImportedFiles,
+                                AdditionalFiles = mergedAdditionalFiles,
+                            };
+                            results[relativeProjectPath] = mergedResult;
+                        }
+                        else
+                        {
+                            // add packages.config results
+                            results[relativeProjectPath] = new ProjectDiscoveryResult()
+                            {
+                                FilePath = relativeProjectPath,
+                                Dependencies = packagesConfigResult.Dependencies,
+                                TargetFrameworks = packagesConfigResult.TargetFrameworks,
+                                ImportedFiles = [], // no imported files resolved for packages.config scenarios
+                                AdditionalFiles = packagesConfigResult.AdditionalFiles,
+                            };
+                        }
                     }
                 }
             }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -1,5 +1,4 @@
 using System.Collections.Immutable;
-using System.Reflection;
 using System.Xml.Linq;
 using System.Xml.XPath;
 
@@ -22,6 +21,11 @@ internal static class SdkProjectDiscovery
         "PackageReference"
     };
 
+    private static readonly HashSet<string> PackageVersionItemNames = new HashSet<string>(StringComparer.Ordinal)
+    {
+        "PackageVersion"
+    };
+
     // the items listed below represent collection names that NuGet will resolve a package into, along with the metadata value names to get the package name and version
     private static readonly Dictionary<string, (string NameMetadata, string VersionMetadata)> ResolvedPackageItemNames = new Dictionary<string, (string, string)>(StringComparer.OrdinalIgnoreCase)
     {
@@ -69,26 +73,30 @@ internal static class SdkProjectDiscovery
         // the following collection feature heavily; the shape is described as follows
 
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject = new(PathComparer.Instance);
-        //         projectPath        tfm           packageName, packageVersion
+        //    projectPath                tfm        packageName  packageVersion
 
-        Dictionary<string, HashSet<string>> topLevelPackagesPerProject = new(PathComparer.Instance);
-        //         projectPath, packageNames
+        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject = new(PathComparer.Instance);
+        //    projectPath                tfm, packageNames
+
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> explicitPackageVersionsPerProject = new(PathComparer.Instance);
+        //    projectPath,               tfm,       packageName, packageVersion
 
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesReplacedBySdkPerProject = new(PathComparer.Instance);
-        //         projectPath        tfm           packageName, packageVersion
+        //    projectPath                tfm        packageName  packageVersion
 
         Dictionary<string, Dictionary<string, string>> resolvedProperties = new(PathComparer.Instance);
-        //         projectPath        propertyName, propertyValue
+        //    projectPath       propertyName  propertyValue
 
         Dictionary<string, HashSet<string>> importedFiles = new(PathComparer.Instance);
-        //         projectPath, importedFiles
+        //    projectPath  importedFiles
 
         Dictionary<string, HashSet<string>> referencedProjects = new(PathComparer.Instance);
-        //         projectPath, referencedProjects
+        //    projectPath  referencedProjects
 
         Dictionary<string, HashSet<string>> additionalFiles = new(PathComparer.Instance);
-        //         projectPath, additionalFiles
+        //    projectPath  additionalFiles
 
+        var requiresManualPackageResolution = false;
         var tfms = await MSBuildHelper.GetTargetFrameworkValuesFromProject(repoRootPath, startingProjectPath, experimentsManager, logger);
         foreach (var tfm in tfms)
         {
@@ -100,7 +108,7 @@ internal static class SdkProjectDiscovery
                 var (exitCode, stdOut, stdErr) = await MSBuildHelper.HandleGlobalJsonAsync(startingProjectDirectory, repoRootPath, experimentsManager, async () =>
                 {
                     // the built-in target `GenerateBuildDependencyFile` forces resolution of all NuGet packages, but doesn't invoke a full build
-                    var dependencyDiscoveryTargetsPath = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location)!, "DependencyDiscovery.targets");
+                    var dependencyDiscoveryTargetsPath = MSBuildHelper.GetFileFromRuntimeDirectory("DependencyDiscovery.targets");
                     var args = new List<string>()
                     {
                         "build",
@@ -127,10 +135,10 @@ internal static class SdkProjectDiscovery
                     return (exitCode, stdOut, stdErr);
                 }, logger, retainMSBuildSdks: true);
                 MSBuildHelper.ThrowOnError(stdOut);
-                if (stdOut.Contains("""error MSB4057: The target "GenerateBuildDependencyFile" does not exist in the project."""))
+                if (stdOut.Contains("_DependencyDiscovery_LegacyProjects::UseTemporaryProject"))
                 {
-                    // this can happen if it's a non-SDK-style project; totally normal, not worth examining the binlog
-                    return [];
+                    // special case - legacy project with <PackageReference> elements; this requires extra handling below
+                    requiresManualPackageResolution = true;
                 }
                 if (exitCode != 0)
                 {
@@ -181,7 +189,7 @@ internal static class SdkProjectDiscovery
                             }
                             break;
                         case NamedNode namedNode when namedNode is AddItem or RemoveItem:
-                            ProcessResolvedPackageReference(namedNode, packagesPerProject, topLevelPackagesPerProject, experimentsManager);
+                            ProcessResolvedPackageReference(namedNode, packagesPerProject, topLevelPackagesPerProject, explicitPackageVersionsPerProject, experimentsManager);
 
                             if (namedNode is AddItem addItem)
                             {
@@ -304,8 +312,52 @@ internal static class SdkProjectDiscovery
             }
         }
 
+        if (requiresManualPackageResolution)
+        {
+            // we were able to collect all <PackageReference> elements, but no transitive dependencies were resolved
+            // to do this we create a temporary project with all of the top-level project elements, resolve _again_, then rebuild the proper result
+            packagesPerProject = await RebuildPackagesPerProject(
+                repoRootPath,
+                startingProjectPath,
+                tfms,
+                packagesPerProject,
+                explicitPackageVersionsPerProject,
+                experimentsManager,
+                logger
+            );
+        }
+
         // and done
-        var projectDiscoveryResults = packagesPerProject.Keys.OrderBy(p => p).Select(projectPath =>
+        var projectDiscoveryResults = BuildResults(
+            repoRootPath,
+            workspacePath,
+            packagesPerProject,
+            explicitPackageVersionsPerProject,
+            packagesReplacedBySdkPerProject,
+            topLevelPackagesPerProject,
+            resolvedProperties,
+            referencedProjects,
+            importedFiles,
+            additionalFiles
+        );
+        return projectDiscoveryResults;
+    }
+
+    private static ImmutableArray<ProjectDiscoveryResult> BuildResults(
+        string repoRootPath,
+        string workspacePath,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packageVersionsPerProject,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesReplacedBySdkPerProject,
+        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject,
+        Dictionary<string, Dictionary<string, string>> resolvedProperties,
+        Dictionary<string, HashSet<string>> referencedProjects,
+        Dictionary<string, HashSet<string>> importedFiles,
+        Dictionary<string, HashSet<string>> additionalFiles
+    )
+    {
+        var projectDiscoveryResults = new List<ProjectDiscoveryResult>();
+        foreach (var projectPath in packagesPerProject.Keys.OrderBy(p => p)) //packagesPerProject.Keys.OrderBy(p => p).Select(projectPath =>
         {
             // gather some project-level information
             var packagesByTfm = packagesPerProject[projectPath];
@@ -341,7 +393,10 @@ internal static class SdkProjectDiscovery
             var localPropertyDefinitionElements = doc.Root!.XPathSelectElements("/Project/PropertyGroup/*");
             var projectPropertyNames = localPropertyDefinitionElements.Select(e => e.Name.LocalName).ToHashSet(StringComparer.OrdinalIgnoreCase);
             var projectRelativePath = Path.GetRelativePath(workspacePath, projectPath);
-            var topLevelPackageNames = topLevelPackagesPerProject.GetOrAdd(projectPath, () => new(StringComparer.OrdinalIgnoreCase));
+            var topLevelPackageNames = topLevelPackagesPerProject
+                .GetOrAdd(projectPath, () => new(StringComparer.OrdinalIgnoreCase))
+                .SelectMany(kvp => kvp.Value)
+                .ToHashSet(StringComparer.OrdinalIgnoreCase);
 
             // create dependencies
             var tfms = packagesByTfm.Keys.OrderBy(tfm => tfm).ToImmutableArray();
@@ -379,7 +434,7 @@ internal static class SdkProjectDiscovery
                 .OrderBy(p => p)
                 .ToImmutableArray();
 
-            return new ProjectDiscoveryResult()
+            var projectDiscoveryResult = new ProjectDiscoveryResult()
             {
                 FilePath = projectRelativePath,
                 Dependencies = dependencies,
@@ -389,14 +444,65 @@ internal static class SdkProjectDiscovery
                 ImportedFiles = imported,
                 AdditionalFiles = additional,
             };
-        }).ToImmutableArray();
-        return projectDiscoveryResults;
+            projectDiscoveryResults.Add(projectDiscoveryResult);
+        }
+        return projectDiscoveryResults.ToImmutableArray();
+    }
+
+    private static async Task<Dictionary<string, Dictionary<string, Dictionary<string, string>>>> RebuildPackagesPerProject(
+        string repoRootPath,
+        string projectPath,
+        ImmutableArray<string> targetFrameworks,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> explicitPackageVersionsPerProject,
+        ExperimentsManager experimentsManager,
+        ILogger logger
+    )
+    {
+        var tempDirectory = Directory.CreateTempSubdirectory("legacy-package-reference-resolution_");
+        try
+        {
+            // gather top level dependencies from topLevelPackagesPerProject
+            // TODO: we don't currently partition dependencies by TFM; this will have to be redone when that's supported
+            var topLevelDependencies = explicitPackageVersionsPerProject
+                .GetOrAdd(projectPath, () => new(StringComparer.OrdinalIgnoreCase))
+                .SelectMany(kvp => kvp.Value)
+                .Select(kvp => new Dependency(kvp.Key, kvp.Value, DependencyType.PackageReference, TargetFrameworks: targetFrameworks))
+                .ToImmutableArray();
+
+            var tempProjectPath = await MSBuildHelper.CreateTempProjectAsync(tempDirectory, repoRootPath, projectPath, targetFrameworks, topLevelDependencies, experimentsManager, logger);
+            var tempProjectDirectory = Path.GetDirectoryName(tempProjectPath)!;
+            var rediscoveredDependencies = await DiscoverWithBinLogAsync(tempProjectDirectory, tempProjectDirectory, tempProjectPath, experimentsManager, logger);
+            var rediscoveredDependenciesForThisProject = rediscoveredDependencies.Single(); // we started with a single temp project, this will be the only result
+
+            // re-build packagesPerProject
+            var rebuiltPackagesPerProject = packagesPerProject.ToDictionary(PathComparer.Instance); // shallow copy
+            rebuiltPackagesPerProject[projectPath] = new(StringComparer.OrdinalIgnoreCase); // rebuild for this project
+            var rebuiltPackagesForThisProject = rebuiltPackagesPerProject[projectPath];
+            foreach (var tfm in targetFrameworks)
+            {
+                rebuiltPackagesForThisProject[tfm] = rediscoveredDependenciesForThisProject.Dependencies.ToDictionary(d => d.Name, d => d.Version!, StringComparer.OrdinalIgnoreCase);
+            }
+
+            return rebuiltPackagesPerProject;
+        }
+        finally
+        {
+            try
+            {
+                tempDirectory.Delete(recursive: true);
+            }
+            catch
+            {
+            }
+        }
     }
 
     private static void ProcessResolvedPackageReference(
         NamedNode node,
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject, // projectPath -> tfm -> (packageName, packageVersion)
-        Dictionary<string, HashSet<string>> topLevelPackagesPerProject,
+        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject, // projectPath -> tfm -> packageName
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packageVersionsPerProject, // projectPath -> tfm -> (packageName, packageVersion)
         ExperimentsManager experimentsManager
     )
     {
@@ -416,16 +522,28 @@ internal static class SdkProjectDiscovery
                         continue;
                     }
 
-                    var topLevelPackages = topLevelPackagesPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
-
-                    if (doRemoveOperation)
+                    var tfm = GetPropertyValueFromProjectEvaluation(projectEvaluation, "TargetFramework");
+                    if (tfm is not null)
                     {
-                        topLevelPackages.Remove(packageName);
-                    }
+                        var topLevelPackages = topLevelPackagesPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
+                        var topLevelPackagesPerTfm = topLevelPackages.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
 
-                    if (doAddOperation)
-                    {
-                        topLevelPackages.Add(packageName);
+                        if (doRemoveOperation)
+                        {
+                            topLevelPackagesPerTfm.Remove(packageName);
+                        }
+
+                        if (doAddOperation)
+                        {
+                            topLevelPackagesPerTfm.Add(packageName);
+                            var packageVersion = GetChildMetadataValue(child, "Version");
+                            if (packageVersion is not null)
+                            {
+                                var packagesPerTfm = packageVersionsPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
+                                var packageVersions = packagesPerTfm.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
+                                packageVersions[packageName] = packageVersion;
+                            }
+                        }
                     }
                 }
             }
@@ -469,6 +587,37 @@ internal static class SdkProjectDiscovery
                 }
             }
         }
+        else if (PackageVersionItemNames.Contains(node.Name))
+        {
+            foreach (var child in node.Children.OfType<Item>())
+            {
+                var projectEvaluation = GetNearestProjectEvaluation(node);
+                if (projectEvaluation is not null)
+                {
+                    var tfm = GetPropertyValueFromProjectEvaluation(projectEvaluation, "TargetFramework");
+                    if (tfm is not null)
+                    {
+                        var packageName = child.Name;
+                        var packageVersions = packageVersionsPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
+                        var packageVersionsPerTfm = packageVersions.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
+
+                        if (doRemoveOperation)
+                        {
+                            packageVersionsPerTfm.Remove(packageName);
+                        }
+
+                        if (doAddOperation)
+                        {
+                            var packageVersion = GetChildMetadataValue(child, "Version");
+                            if (packageVersion is not null)
+                            {
+                                packageVersionsPerTfm[packageName] = packageVersion;
+                            }
+                        }
+                    }
+                }
+            }
+        }
     }
 
     private static string? GetChildMetadataValue(TreeNode node, string metadataItemName)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/FrameworkChecker/FrameworkCompatibilityService.cs

@@ -61,14 +61,23 @@ public class FrameworkCompatibilityService
             }
         }
 
-        matrix.Add(
-            SupportedFrameworks.Net60Windows7,
-            new HashSet<NuGetFramework>
+        // e.g., explicitly allow a project targeting `net9.0-windows` to consume packages targeting `net9.0-windows7.0`
+        foreach (var packageFramework in SupportedFrameworks.TfmFilters.NetTfms)
+        {
+            if (packageFramework.Version.Major <= 5)
+            {
+                // the TFM `net5.0-windows7.0` isn't valid
+                continue;
+            }
+
+            var packageFrameworkWithWindowsVersion = new NuGetFramework(packageFramework.Framework, packageFramework.Version, "windows", FrameworkConstants.Version7);
+            var compatibleVersions = SupportedFrameworks.TfmFilters.NetTfms.Where(t => t.Version.Major >= packageFrameworkWithWindowsVersion.Version.Major).ToArray();
+            foreach (var compatibleVersion in compatibleVersions)
             {
-                SupportedFrameworks.Net60Windows, SupportedFrameworks.Net60Windows7,
-                SupportedFrameworks.Net70Windows, SupportedFrameworks.Net70Windows7
+                var compatibleWindowsTargetWithoutVersion = new NuGetFramework(compatibleVersion.Framework, compatibleVersion.Version, "windows", FrameworkConstants.EmptyVersion);
+                matrix[packageFrameworkWithWindowsVersion].Add(compatibleWindowsTargetWithoutVersion);
             }
-        );
+        }
 
         return matrix;
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/FrameworkChecker/SupportedFrameworks.cs

@@ -72,6 +72,8 @@ namespace NuGetGallery.Frameworks
 
         public static readonly NuGetFramework Net60Windows7 = new NuGetFramework(FrameworkIdentifiers.NetCoreApp, Version6, "windows", Version7);
         public static readonly NuGetFramework Net70Windows7 = new NuGetFramework(FrameworkIdentifiers.NetCoreApp, Version7, "windows", Version7);
+        public static readonly NuGetFramework Net80Windows7 = new NuGetFramework(FrameworkIdentifiers.NetCoreApp, Version8, "windows", Version7);
+        public static readonly NuGetFramework Net90Windows7 = new NuGetFramework(FrameworkIdentifiers.NetCoreApp, Version9, "windows", Version7);
 
         public static readonly IReadOnlyList<NuGetFramework> AllSupportedNuGetFrameworks;
 
@@ -83,10 +85,10 @@ namespace NuGetGallery.Frameworks
                 Native,
                 Net11, Net2, Net35, Net4, Net403, Net45, Net451, Net452, Net46, Net461, Net462, Net463, Net47, Net471, Net472, Net48, Net481,
                 Net50, Net50Windows,
-                Net60, Net60Android, Net60Ios, Net60MacCatalyst, Net60MacOs, Net60TvOs, Net60Windows,
-                Net70, Net70Android, Net70Ios, Net70MacCatalyst, Net70MacOs, Net70TvOs, Net70Windows,
-                Net80, Net80Android, Net80Ios, Net80MacCatalyst, Net80MacOs, Net80TvOs, Net80Windows,
-                Net90, Net90Android, Net90Ios, Net90MacCatalyst, Net90MacOs, Net90TvOs, Net90Windows,
+                Net60, Net60Android, Net60Ios, Net60MacCatalyst, Net60MacOs, Net60TvOs, Net60Windows, Net60Windows7,
+                Net70, Net70Android, Net70Ios, Net70MacCatalyst, Net70MacOs, Net70TvOs, Net70Windows, Net70Windows7,
+                Net80, Net80Android, Net80Ios, Net80MacCatalyst, Net80MacOs, Net80TvOs, Net80Windows, Net80Windows7,
+                Net90, Net90Android, Net90Ios, Net90MacCatalyst, Net90MacOs, Net90TvOs, Net90Windows, Net90Windows7,
                 NetCore, NetCore45, NetCore451,
                 NetCoreApp10, NetCoreApp11, NetCoreApp20, NetCoreApp21, NetCoreApp22, NetCoreApp30, NetCoreApp31,
                 NetMf,

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs

@@ -86,7 +86,7 @@ internal static partial class PackagesConfigUpdater
             }
         }
 
-        using (new WebApplicationTargetsConditionPatcher(projectPath))
+        using (new SpecialImportsConditionPatcher(projectPath))
         {
             RunNugetUpdate(updateArgs, restoreArgs, projectDirectory ?? packagesDirectory, logger);
         }