dependabot-nuget 0.301.1 → 0.303.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 956d84d6354497a9a36a640e0851ae0c97b739f32d8a4fcedc670eb3dc9f2175
-  data.tar.gz: bdabf60631928f0bdb355d92b8f12466764349c5e482b9da073679b733531be2
+  metadata.gz: c0d78d1b91ae626712aaadfdc2f4d03f8f15247b88b869a7285e0b4ad75a36c6
+  data.tar.gz: 6bb59e2674de36c8fae8ee8172db65e6c64447a9f951bd9717bc5915b1a491b3
 SHA512:
-  metadata.gz: 677106b7e78e73b53bc3238a802e56028f18e33104b3ef7e15107abff684241bc87cfcf44f6c64470bf32ae3e0e3dded3c45f3799c422838239f06f9edd70b3a
-  data.tar.gz: b906f03ce619ac2d45a907325e7b2a249976ef34056ef8e0d06db38f3c3f8a9a02be72c6e8210749cee1fcc03c4ca9afa9c0b5659838625ecd76bc00c121e19a
+  metadata.gz: 0d71151a04b9a0ad457713832a763169027b9e24dc95366ffad4fa0011c7820f458410b288d4b85b3382f28923369cf56a60aa0d1970e66c91096c49c857b8b9
+  data.tar.gz: c041d7724ecfbf3dd2cd43064ff566eae5526ee5fe73f5b51df153b093f75b5fbc3a0600bbbe4b250bb1919de3e779f233f9a6100d20bfcc1f0b67cbbb82a503

data/helpers/lib/NuGetUpdater/Directory.Packages.props

@@ -19,7 +19,7 @@
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.12.0" />
     <PackageVersion Include="Microsoft.CSharp" Version="4.7.0" />
     <PackageVersion Include="Microsoft.Extensions.FileProviders.Abstractions" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="9.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="9.0.3" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
     <PackageVersion Include="Microsoft.VisualStudio.Setup.Configuration.Interop" Version="3.12.2149" />
     <PackageVersion Include="Microsoft.Web.Xdt" Version="3.1.0" />
@@ -28,16 +28,16 @@
     <PackageVersion Include="NuGet.Core" Version="2.14.0" Aliases="CoreV2" />
     <PackageVersion Include="Semver" Version="3.0.0" />
     <PackageVersion Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
-    <PackageVersion Include="System.ComponentModel.Composition" Version="9.0.0" />
+    <PackageVersion Include="System.ComponentModel.Composition" Version="9.0.3" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <PackageVersion Include="System.Formats.Asn1" Version="8.0.1" />
     <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.0" />
     <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.0" />
-    <PackageVersion Include="System.Text.Json" Version="8.0.4" />
+    <PackageVersion Include="System.Text.Json" Version="9.0.3" />
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
-    <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="9.0.0" />
+    <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="9.0.3" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.0" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.2" />
   </ItemGroup>
 
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyDiscovery.props

@@ -10,7 +10,10 @@
     -->
     <_DefaultTargetPlatformVersion Condition="'$(_DefaultTargetPlatformVersion)' == ''">0.0</_DefaultTargetPlatformVersion>
     <DesignTimeBuild>true</DesignTimeBuild>
+    <GenerateDependencyFile>true</GenerateDependencyFile>
+    <NuGetInteractive>false</NuGetInteractive>
+    <RunAnalyzers>false</RunAnalyzers>
     <EnableWindowsTargeting Condition="$(TargetFramework.Contains('-windows'))">true</EnableWindowsTargeting>
-    <TargetPlatformVersion Condition="$(TargetPlatformVersion) == '' AND $(TargetFramework.Contains('-'))">$(_DefaultTargetPlatformVersion)</TargetPlatformVersion>
+    <TargetPlatformVersion Condition="$(TargetFramework.Contains('-')) AND '$(TargetPlatformVersion)' == ''">$(_DefaultTargetPlatformVersion)</TargetPlatformVersion>
   </PropertyGroup>
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyDiscovery.targets

@@ -1,15 +1,30 @@
 <Project>
   <PropertyGroup>
-    <!-- Dependency discovery requires a non-zero value for $(TargetPlatformVersion) -->
+    <!-- Dependency discovery requires a custom value for $(TargetPlatformVersion).  Minimum version of unspecified Windows targeting is 7.0. -->
     <_DefaultTargetPlatformVersion>1.0</_DefaultTargetPlatformVersion>
+    <_DefaultTargetPlatformVersion Condition="$(TargetFramework.ToLowerInvariant().EndsWith('-windows'))">7.0</_DefaultTargetPlatformVersion>
+    <_DiscoverDependenciesDependsOn>ResolveAssemblyReferences</_DiscoverDependenciesDependsOn>
+
+    <!-- only SDK-style projects set `$(NETCoreSdkVersion)`; legacy projects don't have it -->
+    <_IsLegacyStyleProject Condition="'$(NETCoreSdkVersion)' == ''">true</_IsLegacyStyleProject>
+
+    <!-- These targets only exists for SDK-style projects -->
+    <_DiscoverDependenciesDependsOn Condition="'$(_IsLegacyStyleProject)' != 'true'">$(_DiscoverDependenciesDependsOn);GenerateBuildDependencyFile;ResolvePackageAssets</_DiscoverDependenciesDependsOn>
+
+    <!-- For non-SDK-style projects, use a different target defined below -->
+    <_DiscoverDependenciesDependsOn Condition="'$(_IsLegacyStyleProject)' == 'true'">$(_DiscoverDependenciesDependsOn);_DependencyDiscovery_LegacyProjects</_DiscoverDependenciesDependsOn>
   </PropertyGroup>
 
   <Import Project="DependencyDiscovery.props" />
 
-  <Target Name="_DiscoverDependencies" DependsOnTargets="ResolveAssemblyReferences;GenerateBuildDependencyFile;ResolvePackageAssets">
+  <Target Name="_DiscoverDependencies" DependsOnTargets="$(_DiscoverDependenciesDependsOn)">
     <!--
-    The targets ResolveAssemblyReferences and GenerateBuildDependencyFile are sufficient for projects targeting .NET Standard or .NET Core.
-    The target ResolvePackageAssets is necessary for projects targeting .NET Framework.
+    This is purely a place to collect the `DependsOnTargets` attribute.
     -->
   </Target>
+
+  <Target Name="_DependencyDiscovery_LegacyProjects" Condition="'@(PackageReference)' != ''">
+    <!-- pseudo-sdk-style project; legacy, but with PackageReference elements - dependencies need to be resolved differently; output a sentinel value to notify the dependency discovery -->
+    <Message Text="_DependencyDiscovery_LegacyProjects::UseTemporaryProject" Importance="High" />
+  </Target>
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyDiscoveryTargetingPacks.props

@@ -0,0 +1,10 @@
+<Project>
+  <PropertyGroup>
+    <!--
+    Suppress errors like:
+      error MSB3644: The reference assemblies for .NETFramework,Version=v4.7.2 were not found.
+    because that's irrelevant to dependency discovery.
+    -->
+    <NoWarn>$(NoWarn);MSB3644</NoWarn>
+  </PropertyGroup>
+</Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DiscoveryWorker.cs

@@ -10,6 +10,7 @@ using Microsoft.Build.Exceptions;
 using NuGet.Frameworks;
 
 using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Updater;
 using NuGetUpdater.Core.Utilities;
 
 namespace NuGetUpdater.Core.Discover;
@@ -303,30 +304,24 @@ public partial class DiscoveryWorker : IDiscoveryWorker
 
     private async Task<ImmutableArray<ProjectDiscoveryResult>> RunForProjectPathsAsync(string repoRootPath, string workspacePath, IEnumerable<string> projectPaths)
     {
+        var normalizedProjectPaths = projectPaths.SelectMany(p => PathHelper.ResolveCaseInsensitivePathsInsideRepoRoot(p, repoRootPath) ?? []).Distinct().ToImmutableArray();
+        var disposables = normalizedProjectPaths.Select(p => new SpecialImportsConditionPatcher(p)).ToImmutableArray();
         var results = new Dictionary<string, ProjectDiscoveryResult>(StringComparer.Ordinal);
-        foreach (var projectPath in projectPaths)
-        {
-            // If there is some MSBuild logic that needs to run to fully resolve the path skip the project
-            // Ensure file existence is checked case-insensitively
-            var actualProjectPaths = PathHelper.ResolveCaseInsensitivePathsInsideRepoRoot(projectPath, repoRootPath);
 
-            if (actualProjectPaths == null)
-            {
-                continue;
-            }
-
-            foreach (var actualProjectPath in actualProjectPaths)
+        try
+        {
+            foreach (var projectPath in normalizedProjectPaths)
             {
-                if (_processedProjectPaths.Contains(actualProjectPath))
+                if (_processedProjectPaths.Contains(projectPath))
                 {
                     continue;
                 }
 
-                _processedProjectPaths.Add(actualProjectPath);
+                _processedProjectPaths.Add(projectPath);
 
-                var relativeProjectPath = Path.GetRelativePath(workspacePath, actualProjectPath).NormalizePathToUnix();
-                var packagesConfigResult = await PackagesConfigDiscovery.Discover(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
-                var projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
+                var relativeProjectPath = Path.GetRelativePath(workspacePath, projectPath).NormalizePathToUnix();
+                var packagesConfigResult = await PackagesConfigDiscovery.Discover(repoRootPath, workspacePath, projectPath, _experimentsManager, _logger);
+                var projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, projectPath, _experimentsManager, _logger);
 
                 // Determine if there were unrestored MSBuildSdks
                 var msbuildSdks = projectResults.SelectMany(p => p.Dependencies.Where(d => d.Type == DependencyType.MSBuildSdk)).ToImmutableArray();
@@ -335,7 +330,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                     // If new SDKs were restored, then we need to rerun SdkProjectDiscovery.
                     if (await TryRestoreMSBuildSdksAsync(repoRootPath, workspacePath, msbuildSdks, _logger))
                     {
-                        projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
+                        projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, projectPath, _experimentsManager, _logger);
                     }
                 }
 
@@ -423,6 +418,14 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                 }
             }
         }
+        finally
+        {
+            foreach (var disposable in disposables)
+            {
+                // restore the original project file
+                disposable.Dispose();
+            }
+        }
 
         return [.. results.Values];
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -1,5 +1,4 @@
 using System.Collections.Immutable;
-using System.Reflection;
 using System.Xml.Linq;
 using System.Xml.XPath;
 
@@ -22,6 +21,11 @@ internal static class SdkProjectDiscovery
         "PackageReference"
     };
 
+    private static readonly HashSet<string> PackageVersionItemNames = new HashSet<string>(StringComparer.Ordinal)
+    {
+        "PackageVersion"
+    };
+
     // the items listed below represent collection names that NuGet will resolve a package into, along with the metadata value names to get the package name and version
     private static readonly Dictionary<string, (string NameMetadata, string VersionMetadata)> ResolvedPackageItemNames = new Dictionary<string, (string, string)>(StringComparer.OrdinalIgnoreCase)
     {
@@ -69,26 +73,30 @@ internal static class SdkProjectDiscovery
         // the following collection feature heavily; the shape is described as follows
 
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject = new(PathComparer.Instance);
-        //         projectPath        tfm           packageName, packageVersion
+        //    projectPath                tfm        packageName  packageVersion
 
-        Dictionary<string, HashSet<string>> topLevelPackagesPerProject = new(PathComparer.Instance);
-        //         projectPath, packageNames
+        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject = new(PathComparer.Instance);
+        //    projectPath                tfm, packageNames
+
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> explicitPackageVersionsPerProject = new(PathComparer.Instance);
+        //    projectPath,               tfm,       packageName, packageVersion
 
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesReplacedBySdkPerProject = new(PathComparer.Instance);
-        //         projectPath        tfm           packageName, packageVersion
+        //    projectPath                tfm        packageName  packageVersion
 
         Dictionary<string, Dictionary<string, string>> resolvedProperties = new(PathComparer.Instance);
-        //         projectPath        propertyName, propertyValue
+        //    projectPath       propertyName  propertyValue
 
         Dictionary<string, HashSet<string>> importedFiles = new(PathComparer.Instance);
-        //         projectPath, importedFiles
+        //    projectPath  importedFiles
 
         Dictionary<string, HashSet<string>> referencedProjects = new(PathComparer.Instance);
-        //         projectPath, referencedProjects
+        //    projectPath  referencedProjects
 
         Dictionary<string, HashSet<string>> additionalFiles = new(PathComparer.Instance);
-        //         projectPath, additionalFiles
+        //    projectPath  additionalFiles
 
+        var requiresManualPackageResolution = false;
         var tfms = await MSBuildHelper.GetTargetFrameworkValuesFromProject(repoRootPath, startingProjectPath, experimentsManager, logger);
         foreach (var tfm in tfms)
         {
@@ -100,13 +108,15 @@ internal static class SdkProjectDiscovery
                 var (exitCode, stdOut, stdErr) = await MSBuildHelper.HandleGlobalJsonAsync(startingProjectDirectory, repoRootPath, experimentsManager, async () =>
                 {
                     // the built-in target `GenerateBuildDependencyFile` forces resolution of all NuGet packages, but doesn't invoke a full build
-                    var dependencyDiscoveryTargetsPath = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location)!, "DependencyDiscovery.targets");
+                    var dependencyDiscoveryTargetingPacksPropsPath = MSBuildHelper.GetFileFromRuntimeDirectory("DependencyDiscoveryTargetingPacks.props");
+                    var dependencyDiscoveryTargetsPath = MSBuildHelper.GetFileFromRuntimeDirectory("DependencyDiscovery.targets");
                     var args = new List<string>()
                     {
                         "build",
                         startingProjectPath,
                         "/t:_DiscoverDependencies",
                         $"/p:TargetFramework={tfm}",
+                        $"/p:CustomBeforeMicrosoftCommonProps={dependencyDiscoveryTargetingPacksPropsPath}",
                         $"/p:CustomAfterMicrosoftCommonCrossTargetingTargets={dependencyDiscoveryTargetsPath}",
                         $"/p:CustomAfterMicrosoftCommonTargets={dependencyDiscoveryTargetsPath}",
                         "/p:TreatWarningsAsErrors=false", // if using CPM and a project also sets TreatWarningsAsErrors to true, this can cause discovery to fail; explicitly don't allow that
@@ -127,10 +137,10 @@ internal static class SdkProjectDiscovery
                     return (exitCode, stdOut, stdErr);
                 }, logger, retainMSBuildSdks: true);
                 MSBuildHelper.ThrowOnError(stdOut);
-                if (stdOut.Contains("""error MSB4057: The target "GenerateBuildDependencyFile" does not exist in the project."""))
+                if (stdOut.Contains("_DependencyDiscovery_LegacyProjects::UseTemporaryProject"))
                 {
-                    // this can happen if it's a non-SDK-style project; totally normal, not worth examining the binlog
-                    return [];
+                    // special case - legacy project with <PackageReference> elements; this requires extra handling below
+                    requiresManualPackageResolution = true;
                 }
                 if (exitCode != 0)
                 {
@@ -181,7 +191,7 @@ internal static class SdkProjectDiscovery
                             }
                             break;
                         case NamedNode namedNode when namedNode is AddItem or RemoveItem:
-                            ProcessResolvedPackageReference(namedNode, packagesPerProject, topLevelPackagesPerProject, experimentsManager);
+                            ProcessResolvedPackageReference(namedNode, packagesPerProject, topLevelPackagesPerProject, explicitPackageVersionsPerProject, experimentsManager);
 
                             if (namedNode is AddItem addItem)
                             {
@@ -304,8 +314,52 @@ internal static class SdkProjectDiscovery
             }
         }
 
+        if (requiresManualPackageResolution)
+        {
+            // we were able to collect all <PackageReference> elements, but no transitive dependencies were resolved
+            // to do this we create a temporary project with all of the top-level project elements, resolve _again_, then rebuild the proper result
+            packagesPerProject = await RebuildPackagesPerProject(
+                repoRootPath,
+                startingProjectPath,
+                tfms,
+                packagesPerProject,
+                explicitPackageVersionsPerProject,
+                experimentsManager,
+                logger
+            );
+        }
+
         // and done
-        var projectDiscoveryResults = packagesPerProject.Keys.OrderBy(p => p).Select(projectPath =>
+        var projectDiscoveryResults = BuildResults(
+            repoRootPath,
+            workspacePath,
+            packagesPerProject,
+            explicitPackageVersionsPerProject,
+            packagesReplacedBySdkPerProject,
+            topLevelPackagesPerProject,
+            resolvedProperties,
+            referencedProjects,
+            importedFiles,
+            additionalFiles
+        );
+        return projectDiscoveryResults;
+    }
+
+    private static ImmutableArray<ProjectDiscoveryResult> BuildResults(
+        string repoRootPath,
+        string workspacePath,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packageVersionsPerProject,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesReplacedBySdkPerProject,
+        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject,
+        Dictionary<string, Dictionary<string, string>> resolvedProperties,
+        Dictionary<string, HashSet<string>> referencedProjects,
+        Dictionary<string, HashSet<string>> importedFiles,
+        Dictionary<string, HashSet<string>> additionalFiles
+    )
+    {
+        var projectDiscoveryResults = new List<ProjectDiscoveryResult>();
+        foreach (var projectPath in packagesPerProject.Keys.OrderBy(p => p)) //packagesPerProject.Keys.OrderBy(p => p).Select(projectPath =>
         {
             // gather some project-level information
             var packagesByTfm = packagesPerProject[projectPath];
@@ -341,7 +395,10 @@ internal static class SdkProjectDiscovery
             var localPropertyDefinitionElements = doc.Root!.XPathSelectElements("/Project/PropertyGroup/*");
             var projectPropertyNames = localPropertyDefinitionElements.Select(e => e.Name.LocalName).ToHashSet(StringComparer.OrdinalIgnoreCase);
             var projectRelativePath = Path.GetRelativePath(workspacePath, projectPath);
-            var topLevelPackageNames = topLevelPackagesPerProject.GetOrAdd(projectPath, () => new(StringComparer.OrdinalIgnoreCase));
+            var topLevelPackageNames = topLevelPackagesPerProject
+                .GetOrAdd(projectPath, () => new(StringComparer.OrdinalIgnoreCase))
+                .SelectMany(kvp => kvp.Value)
+                .ToHashSet(StringComparer.OrdinalIgnoreCase);
 
             // create dependencies
             var tfms = packagesByTfm.Keys.OrderBy(tfm => tfm).ToImmutableArray();
@@ -379,7 +436,7 @@ internal static class SdkProjectDiscovery
                 .OrderBy(p => p)
                 .ToImmutableArray();
 
-            return new ProjectDiscoveryResult()
+            var projectDiscoveryResult = new ProjectDiscoveryResult()
             {
                 FilePath = projectRelativePath,
                 Dependencies = dependencies,
@@ -389,14 +446,65 @@ internal static class SdkProjectDiscovery
                 ImportedFiles = imported,
                 AdditionalFiles = additional,
             };
-        }).ToImmutableArray();
-        return projectDiscoveryResults;
+            projectDiscoveryResults.Add(projectDiscoveryResult);
+        }
+        return projectDiscoveryResults.ToImmutableArray();
+    }
+
+    private static async Task<Dictionary<string, Dictionary<string, Dictionary<string, string>>>> RebuildPackagesPerProject(
+        string repoRootPath,
+        string projectPath,
+        ImmutableArray<string> targetFrameworks,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject,
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> explicitPackageVersionsPerProject,
+        ExperimentsManager experimentsManager,
+        ILogger logger
+    )
+    {
+        var tempDirectory = Directory.CreateTempSubdirectory("legacy-package-reference-resolution_");
+        try
+        {
+            // gather top level dependencies from topLevelPackagesPerProject
+            // TODO: we don't currently partition dependencies by TFM; this will have to be redone when that's supported
+            var topLevelDependencies = explicitPackageVersionsPerProject
+                .GetOrAdd(projectPath, () => new(StringComparer.OrdinalIgnoreCase))
+                .SelectMany(kvp => kvp.Value)
+                .Select(kvp => new Dependency(kvp.Key, kvp.Value, DependencyType.PackageReference, TargetFrameworks: targetFrameworks))
+                .ToImmutableArray();
+
+            var tempProjectPath = await MSBuildHelper.CreateTempProjectAsync(tempDirectory, repoRootPath, projectPath, targetFrameworks, topLevelDependencies, experimentsManager, logger);
+            var tempProjectDirectory = Path.GetDirectoryName(tempProjectPath)!;
+            var rediscoveredDependencies = await DiscoverWithBinLogAsync(tempProjectDirectory, tempProjectDirectory, tempProjectPath, experimentsManager, logger);
+            var rediscoveredDependenciesForThisProject = rediscoveredDependencies.Single(); // we started with a single temp project, this will be the only result
+
+            // re-build packagesPerProject
+            var rebuiltPackagesPerProject = packagesPerProject.ToDictionary(PathComparer.Instance); // shallow copy
+            rebuiltPackagesPerProject[projectPath] = new(StringComparer.OrdinalIgnoreCase); // rebuild for this project
+            var rebuiltPackagesForThisProject = rebuiltPackagesPerProject[projectPath];
+            foreach (var tfm in targetFrameworks)
+            {
+                rebuiltPackagesForThisProject[tfm] = rediscoveredDependenciesForThisProject.Dependencies.ToDictionary(d => d.Name, d => d.Version!, StringComparer.OrdinalIgnoreCase);
+            }
+
+            return rebuiltPackagesPerProject;
+        }
+        finally
+        {
+            try
+            {
+                tempDirectory.Delete(recursive: true);
+            }
+            catch
+            {
+            }
+        }
     }
 
     private static void ProcessResolvedPackageReference(
         NamedNode node,
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject, // projectPath -> tfm -> (packageName, packageVersion)
-        Dictionary<string, HashSet<string>> topLevelPackagesPerProject,
+        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject, // projectPath -> tfm -> packageName
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packageVersionsPerProject, // projectPath -> tfm -> (packageName, packageVersion)
         ExperimentsManager experimentsManager
     )
     {
@@ -416,16 +524,28 @@ internal static class SdkProjectDiscovery
                         continue;
                     }
 
-                    var topLevelPackages = topLevelPackagesPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
-
-                    if (doRemoveOperation)
+                    var tfm = GetPropertyValueFromProjectEvaluation(projectEvaluation, "TargetFramework");
+                    if (tfm is not null)
                     {
-                        topLevelPackages.Remove(packageName);
-                    }
+                        var topLevelPackages = topLevelPackagesPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
+                        var topLevelPackagesPerTfm = topLevelPackages.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
 
-                    if (doAddOperation)
-                    {
-                        topLevelPackages.Add(packageName);
+                        if (doRemoveOperation)
+                        {
+                            topLevelPackagesPerTfm.Remove(packageName);
+                        }
+
+                        if (doAddOperation)
+                        {
+                            topLevelPackagesPerTfm.Add(packageName);
+                            var packageVersion = GetChildMetadataValue(child, "Version");
+                            if (packageVersion is not null)
+                            {
+                                var packagesPerTfm = packageVersionsPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
+                                var packageVersions = packagesPerTfm.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
+                                packageVersions[packageName] = packageVersion;
+                            }
+                        }
                     }
                 }
             }
@@ -469,6 +589,37 @@ internal static class SdkProjectDiscovery
                 }
             }
         }
+        else if (PackageVersionItemNames.Contains(node.Name))
+        {
+            foreach (var child in node.Children.OfType<Item>())
+            {
+                var projectEvaluation = GetNearestProjectEvaluation(node);
+                if (projectEvaluation is not null)
+                {
+                    var tfm = GetPropertyValueFromProjectEvaluation(projectEvaluation, "TargetFramework");
+                    if (tfm is not null)
+                    {
+                        var packageName = child.Name;
+                        var packageVersions = packageVersionsPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
+                        var packageVersionsPerTfm = packageVersions.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
+
+                        if (doRemoveOperation)
+                        {
+                            packageVersionsPerTfm.Remove(packageName);
+                        }
+
+                        if (doAddOperation)
+                        {
+                            var packageVersion = GetChildMetadataValue(child, "Version");
+                            if (packageVersion is not null)
+                            {
+                                packageVersionsPerTfm[packageName] = packageVersion;
+                            }
+                        }
+                    }
+                }
+            }
+        }
     }
 
     private static string? GetChildMetadataValue(TreeNode node, string metadataItemName)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/ExperimentsManager.cs

@@ -8,6 +8,7 @@ namespace NuGetUpdater.Core;
 public record ExperimentsManager
 {
     public bool InstallDotnetSdks { get; init; } = false;
+    public bool NativeUpdater { get; init; } = false;
     public bool UseLegacyDependencySolver { get; init; } = false;
     public bool UseDirectDiscovery { get; init; } = false;
 
@@ -16,6 +17,7 @@ public record ExperimentsManager
         return new()
         {
             ["nuget_install_dotnet_sdks"] = InstallDotnetSdks,
+            ["nuget_native_updater"] = NativeUpdater,
             ["nuget_legacy_dependency_solver"] = UseLegacyDependencySolver,
             ["nuget_use_direct_discovery"] = UseDirectDiscovery,
         };
@@ -26,6 +28,7 @@ public record ExperimentsManager
         return new ExperimentsManager()
         {
             InstallDotnetSdks = IsEnabled(experiments, "nuget_install_dotnet_sdks"),
+            NativeUpdater = IsEnabled(experiments, "nuget_native_updater"),
             UseLegacyDependencySolver = IsEnabled(experiments, "nuget_legacy_dependency_solver"),
             UseDirectDiscovery = IsEnabled(experiments, "nuget_use_direct_discovery"),
         };

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/FrameworkChecker/FrameworkCompatibilityService.cs

@@ -61,14 +61,23 @@ public class FrameworkCompatibilityService
             }
         }
 
-        matrix.Add(
-            SupportedFrameworks.Net60Windows7,
-            new HashSet<NuGetFramework>
+        // e.g., explicitly allow a project targeting `net9.0-windows` to consume packages targeting `net9.0-windows7.0`
+        foreach (var packageFramework in SupportedFrameworks.TfmFilters.NetTfms)
+        {
+            if (packageFramework.Version.Major <= 5)
+            {
+                // the TFM `net5.0-windows7.0` isn't valid
+                continue;
+            }
+
+            var packageFrameworkWithWindowsVersion = new NuGetFramework(packageFramework.Framework, packageFramework.Version, "windows", FrameworkConstants.Version7);
+            var compatibleVersions = SupportedFrameworks.TfmFilters.NetTfms.Where(t => t.Version.Major >= packageFrameworkWithWindowsVersion.Version.Major).ToArray();
+            foreach (var compatibleVersion in compatibleVersions)
             {
-                SupportedFrameworks.Net60Windows, SupportedFrameworks.Net60Windows7,
-                SupportedFrameworks.Net70Windows, SupportedFrameworks.Net70Windows7
+                var compatibleWindowsTargetWithoutVersion = new NuGetFramework(compatibleVersion.Framework, compatibleVersion.Version, "windows", FrameworkConstants.EmptyVersion);
+                matrix[packageFrameworkWithWindowsVersion].Add(compatibleWindowsTargetWithoutVersion);
             }
-        );
+        }
 
         return matrix;
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/FrameworkChecker/SupportedFrameworks.cs

@@ -72,6 +72,8 @@ namespace NuGetGallery.Frameworks
 
         public static readonly NuGetFramework Net60Windows7 = new NuGetFramework(FrameworkIdentifiers.NetCoreApp, Version6, "windows", Version7);
         public static readonly NuGetFramework Net70Windows7 = new NuGetFramework(FrameworkIdentifiers.NetCoreApp, Version7, "windows", Version7);
+        public static readonly NuGetFramework Net80Windows7 = new NuGetFramework(FrameworkIdentifiers.NetCoreApp, Version8, "windows", Version7);
+        public static readonly NuGetFramework Net90Windows7 = new NuGetFramework(FrameworkIdentifiers.NetCoreApp, Version9, "windows", Version7);
 
         public static readonly IReadOnlyList<NuGetFramework> AllSupportedNuGetFrameworks;
 
@@ -83,10 +85,10 @@ namespace NuGetGallery.Frameworks
                 Native,
                 Net11, Net2, Net35, Net4, Net403, Net45, Net451, Net452, Net46, Net461, Net462, Net463, Net47, Net471, Net472, Net48, Net481,
                 Net50, Net50Windows,
-                Net60, Net60Android, Net60Ios, Net60MacCatalyst, Net60MacOs, Net60TvOs, Net60Windows,
-                Net70, Net70Android, Net70Ios, Net70MacCatalyst, Net70MacOs, Net70TvOs, Net70Windows,
-                Net80, Net80Android, Net80Ios, Net80MacCatalyst, Net80MacOs, Net80TvOs, Net80Windows,
-                Net90, Net90Android, Net90Ios, Net90MacCatalyst, Net90MacOs, Net90TvOs, Net90Windows,
+                Net60, Net60Android, Net60Ios, Net60MacCatalyst, Net60MacOs, Net60TvOs, Net60Windows, Net60Windows7,
+                Net70, Net70Android, Net70Ios, Net70MacCatalyst, Net70MacOs, Net70TvOs, Net70Windows, Net70Windows7,
+                Net80, Net80Android, Net80Ios, Net80MacCatalyst, Net80MacOs, Net80TvOs, Net80Windows, Net80Windows7,
+                Net90, Net90Android, Net90Ios, Net90MacCatalyst, Net90MacOs, Net90TvOs, Net90Windows, Net90Windows7,
                 NetCore, NetCore45, NetCore451,
                 NetCoreApp10, NetCoreApp11, NetCoreApp20, NetCoreApp21, NetCoreApp22, NetCoreApp30, NetCoreApp31,
                 NetMf,

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/NuGetUpdater.Core.csproj

@@ -9,6 +9,7 @@
 
   <ItemGroup>
     <None Include="DependencyDiscovery.props" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="DependencyDiscoveryTargetingPacks.props" CopyToOutputDirectory="PreserveNewest" />
     <None Include="DependencyDiscovery.targets" CopyToOutputDirectory="PreserveNewest" />
     <None Include="TargetFrameworkReporter.targets" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -10,6 +10,7 @@ using NuGet.Versioning;
 using NuGetUpdater.Core.Analyze;
 using NuGetUpdater.Core.Discover;
 using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Updater;
 using NuGetUpdater.Core.Utilities;
 
 using static NuGetUpdater.Core.Utilities.EOLHandling;
@@ -158,6 +159,7 @@ public class RunWorker
         }
 
         // do update
+        var updateOperationsPerformed = new List<UpdateOperationBase>();
         var existingPullRequests = job.GetAllExistingPullRequests();
         var unhandledPullRequestDependenciesSet = existingPullRequests
             .Select(pr => pr.Item2.Select(d => d.DependencyName).ToHashSet(StringComparer.OrdinalIgnoreCase))
@@ -240,6 +242,8 @@ public class RunWorker
                 {
                     actualUpdatedDependencies.Add(updatedDependency);
                 }
+
+                updateOperationsPerformed.AddRange(updateResult.UpdateOperations);
             }
         }
 
@@ -317,6 +321,10 @@ public class RunWorker
             await SendApiMessage(new SecurityUpdateNotNeeded(depName));
         }
 
+        var normalizedUpdateOperationsPerformed = UpdateOperationBase.NormalizeUpdateOperationCollection(repoContentsPath.FullName, updateOperationsPerformed);
+        var report = UpdateOperationBase.GenerateUpdateOperationReport(normalizedUpdateOperationsPerformed);
+        _logger.Info(report);
+
         var result = new RunResult()
         {
             Base64DependencyFiles = originalDependencyFileContents.OrderBy(kvp => kvp.Key).Select(kvp =>