dependabot-nuget 0.301.1 → 0.303.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/{WebApplicationTargetsConditionPatcher.cs → SpecialImportsConditionPatcher.cs}

@@ -2,43 +2,50 @@ using Microsoft.Language.Xml;
 
 namespace NuGetUpdater.Core.Updater
 {
-    internal class WebApplicationTargetsConditionPatcher : IDisposable
+    internal class SpecialImportsConditionPatcher : IDisposable
     {
-        private string? _capturedCondition;
+        private readonly List<string?> _capturedConditions = new List<string?>();
         private readonly XmlFilePreAndPostProcessor _processor;
 
-        public WebApplicationTargetsConditionPatcher(string projectFilePath)
+        private readonly HashSet<string> ImportedFilesToIgnore = new(StringComparer.OrdinalIgnoreCase)
+        {
+            "Microsoft.TextTemplating.targets",
+            "Microsoft.WebApplication.targets"
+        };
+
+        public SpecialImportsConditionPatcher(string projectFilePath)
         {
             _processor = new XmlFilePreAndPostProcessor(
                 getContent: () => File.ReadAllText(projectFilePath),
                 setContent: s => File.WriteAllText(projectFilePath, s),
                 nodeFinder: doc => doc.Descendants()
                     .Where(e => e.Name == "Import")
-                    .FirstOrDefault(e =>
+                    .Where(e =>
                     {
                         var projectPath = e.GetAttributeValue("Project");
                         if (projectPath is not null)
                         {
                             var projectFileName = Path.GetFileName(projectPath.NormalizePathToUnix());
-                            return projectFileName.Equals("Microsoft.WebApplication.targets", StringComparison.OrdinalIgnoreCase);
+                            return ImportedFilesToIgnore.Contains(projectFileName);
                         }
 
                         return false;
                     })
-                    as XmlNodeSyntax,
-                preProcessor: n =>
+                    .Cast<XmlNodeSyntax>(),
+                preProcessor: (i, n) =>
                 {
                     var element = (IXmlElementSyntax)n;
-                    _capturedCondition = element.GetAttributeValue("Condition");
+                    _capturedConditions.Add(element.GetAttributeValue("Condition"));
                     return (XmlNodeSyntax)element.RemoveAttributeByName("Condition").WithAttribute("Condition", "false");
                 },
-                postProcessor: n =>
+                postProcessor: (i, n) =>
                 {
                     var element = (IXmlElementSyntax)n;
                     var newElement = element.RemoveAttributeByName("Condition");
-                    if (_capturedCondition is not null)
+                    var capturedCondition = _capturedConditions[i];
+                    if (capturedCondition is not null)
                     {
-                        newElement = newElement.WithAttribute("Condition", _capturedCondition);
+                        newElement = newElement.WithAttribute("Condition", capturedCondition);
                     }
 
                     return (XmlNodeSyntax)newElement;

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdateOperationBase.cs

@@ -0,0 +1,209 @@
+using System.Collections.Immutable;
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Json.Serialization;
+
+using NuGet.Versioning;
+
+using NuGetUpdater.Core.Utilities;
+
+
+namespace NuGetUpdater.Core.Updater;
+
+[JsonDerivedType(typeof(DirectUpdate))]
+[JsonDerivedType(typeof(PinnedUpdate))]
+[JsonDerivedType(typeof(ParentUpdate))]
+public abstract record UpdateOperationBase
+{
+    public abstract string Type { get; }
+    public required string DependencyName { get; init; }
+    public required NuGetVersion NewVersion { get; init; }
+    public required ImmutableArray<string> UpdatedFiles { get; init; }
+
+    public abstract string GetReport();
+
+    internal static string GenerateUpdateOperationReport(IEnumerable<UpdateOperationBase> updateOperations)
+    {
+        var updateMessages = updateOperations.Select(u => u.GetReport()).ToImmutableArray();
+        if (updateMessages.Length == 0)
+        {
+            return string.Empty;
+        }
+
+        var separator = "\n    ";
+        var report = $"Performed the following updates:{separator}{string.Join(separator, updateMessages.Select(m => $"- {m}"))}";
+        return report;
+    }
+
+    internal static ImmutableArray<UpdateOperationBase> NormalizeUpdateOperationCollection(string repoRootPath, IEnumerable<UpdateOperationBase> updateOperations)
+    {
+        var groupedByKindWithCombinedFiles = updateOperations
+            .GroupBy(u => (u.GetType(), u.DependencyName, u.NewVersion))
+            .Select(g =>
+            {
+                if (g.Key.Item1 == typeof(DirectUpdate))
+                {
+                    return new DirectUpdate()
+                    {
+                        DependencyName = g.Key.DependencyName,
+                        NewVersion = g.Key.NewVersion,
+                        UpdatedFiles = [.. g.SelectMany(u => u.UpdatedFiles)],
+                    } as UpdateOperationBase;
+                }
+                else if (g.Key.Item1 == typeof(PinnedUpdate))
+                {
+                    return new PinnedUpdate()
+                    {
+                        DependencyName = g.Key.DependencyName,
+                        NewVersion = g.Key.NewVersion,
+                        UpdatedFiles = [.. g.SelectMany(u => u.UpdatedFiles)],
+                    };
+                }
+                else if (g.Key.Item1 == typeof(ParentUpdate))
+                {
+                    var parentUpdate = (ParentUpdate)g.First();
+                    return new ParentUpdate()
+                    {
+                        DependencyName = g.Key.DependencyName,
+                        NewVersion = g.Key.NewVersion,
+                        UpdatedFiles = [.. g.SelectMany(u => u.UpdatedFiles)],
+                        ParentDependencyName = parentUpdate.ParentDependencyName,
+                        ParentNewVersion = parentUpdate.ParentNewVersion,
+                    };
+                }
+                else
+                {
+                    throw new NotImplementedException(g.Key.Item1.FullName);
+                }
+            })
+            .ToImmutableArray();
+        var withNormalizedAndDistinctPaths = groupedByKindWithCombinedFiles
+            .Select(u => u with { UpdatedFiles = [.. u.UpdatedFiles.Select(f => Path.GetRelativePath(repoRootPath, f).FullyNormalizedRootedPath()).Distinct(PathComparer.Instance).OrderBy(f => f, StringComparer.Ordinal)] })
+            .ToImmutableArray();
+        var uniqueUpdateOperations = withNormalizedAndDistinctPaths.Distinct(UpdateOperationBaseComparer.Instance).ToImmutableArray();
+        var ordered = uniqueUpdateOperations
+            .OrderBy(u => u.GetType().Name)
+            .ThenBy(u => u.DependencyName)
+            .ThenBy(u => u.NewVersion)
+            .ThenBy(u => u.UpdatedFiles.Length)
+            .ThenBy(u => string.Join(",", u.UpdatedFiles))
+            .ThenBy(u => u is ParentUpdate parentUpdate ? parentUpdate.ParentDependencyName : string.Empty)
+            .ThenBy(u => u is ParentUpdate parentUpdate ? parentUpdate.ParentNewVersion : u.NewVersion)
+            .ToImmutableArray();
+        return ordered;
+    }
+
+    public override int GetHashCode()
+    {
+        var hash = new HashCode();
+        hash.Add(DependencyName);
+        hash.Add(NewVersion);
+        hash.Add(UpdatedFiles.Length);
+        for (int i = 0; i < UpdatedFiles.Length; i++)
+        {
+            hash.Add(UpdatedFiles[i]);
+        }
+
+        return hash.ToHashCode();
+    }
+
+    protected string GetString() => $"{GetType().Name} {{ {nameof(DependencyName)} = {DependencyName}, {nameof(NewVersion)} = {NewVersion}, {nameof(UpdatedFiles)} = {string.Join(",", UpdatedFiles)} }}";
+}
+
+public record DirectUpdate : UpdateOperationBase
+{
+    public override string Type => nameof(DirectUpdate);
+    public override string GetReport() => $"Updated {DependencyName} to {NewVersion} in {string.Join("", UpdatedFiles)}";
+    public sealed override string ToString() => GetString();
+}
+
+public record PinnedUpdate : UpdateOperationBase
+{
+    public override string Type => nameof(PinnedUpdate);
+    public override string GetReport() => $"Pinned {DependencyName} at {NewVersion} in {string.Join("", UpdatedFiles)}";
+    public sealed override string ToString() => GetString();
+}
+
+public record ParentUpdate : UpdateOperationBase, IEquatable<UpdateOperationBase>
+{
+    public override string Type => nameof(ParentUpdate);
+    public required string ParentDependencyName { get; init; }
+    public required NuGetVersion ParentNewVersion { get; init; }
+
+    public override string GetReport() => $"Updated {DependencyName} to {NewVersion} indirectly via {ParentDependencyName}/{ParentNewVersion} in {string.Join("", UpdatedFiles)}";
+
+    bool IEquatable<UpdateOperationBase>.Equals(UpdateOperationBase? other)
+    {
+        if (!base.Equals(other))
+        {
+            return false;
+        }
+
+        if (other is not ParentUpdate otherParentUpdate)
+        {
+            return false;
+        }
+
+        return ParentDependencyName == otherParentUpdate.ParentDependencyName
+            && ParentNewVersion == otherParentUpdate.ParentNewVersion;
+    }
+
+    public override int GetHashCode()
+    {
+        var hash = new HashCode();
+        hash.Add(base.GetHashCode());
+        hash.Add(ParentDependencyName);
+        hash.Add(ParentNewVersion);
+        return hash.ToHashCode();
+    }
+
+    public sealed override string ToString() => $"{GetType().Name} {{ {nameof(DependencyName)} = {DependencyName}, {nameof(NewVersion)} = {NewVersion}, {nameof(ParentDependencyName)} = {ParentDependencyName}, {nameof(ParentNewVersion)} = {ParentNewVersion}, {nameof(UpdatedFiles)} = {string.Join(",", UpdatedFiles)} }}";
+}
+
+public class UpdateOperationBaseComparer : IEqualityComparer<UpdateOperationBase>
+{
+    public static UpdateOperationBaseComparer Instance = new();
+
+    public bool Equals(UpdateOperationBase? x, UpdateOperationBase? y)
+    {
+        if (x is null && y is null)
+        {
+            return true;
+        }
+
+        if (x is null || y is null)
+        {
+            return false;
+        }
+
+        if (ReferenceEquals(x, y))
+        {
+            return true;
+        }
+
+        if (x.GetType() != y.GetType())
+        {
+            return false;
+        }
+
+        if (x.DependencyName != y.DependencyName ||
+            x.NewVersion != y.NewVersion ||
+            !x.UpdatedFiles.SequenceEqual(y.UpdatedFiles))
+        {
+            return false;
+        }
+
+        if (x is ParentUpdate px && y is ParentUpdate py)
+        {
+            // the `.GetType()` check above ensures this is safe
+            if (px.ParentDependencyName != py.ParentDependencyName ||
+                px.ParentNewVersion != py.ParentNewVersion)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    public int GetHashCode([DisallowNull] UpdateOperationBase obj) => obj.GetHashCode();
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdateOperationResult.cs

@@ -1,5 +1,8 @@
+using System.Collections.Immutable;
+
 namespace NuGetUpdater.Core.Updater;
 
 public record UpdateOperationResult : NativeResult
 {
+    public required ImmutableArray<UpdateOperationBase> UpdateOperations { get; init; }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdaterWorker.cs

@@ -1,3 +1,4 @@
+using System.Collections.Immutable;
 using System.Net;
 using System.Text.Json;
 using System.Text.Json.Serialization;
@@ -19,7 +20,7 @@ public class UpdaterWorker : IUpdaterWorker
     internal static readonly JsonSerializerOptions SerializerOptions = new()
     {
         WriteIndented = true,
-        Converters = { new JsonStringEnumConverter() },
+        Converters = { new JsonStringEnumConverter(), new VersionConverter() },
     };
 
     public UpdaterWorker(string jobId, ExperimentsManager experimentsManager, ILogger logger)
@@ -41,10 +42,10 @@ public class UpdaterWorker : IUpdaterWorker
     // this is a convenient method for tests
     internal async Task<UpdateOperationResult> RunWithErrorHandlingAsync(string repoRootPath, string workspacePath, string dependencyName, string previousDependencyVersion, string newDependencyVersion, bool isTransitive)
     {
-        UpdateOperationResult result = new(); // assumed to be ok until proven otherwise
         try
         {
-            result = await RunAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+            var result = await RunAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+            return result;
         }
         catch (Exception ex)
         {
@@ -52,13 +53,15 @@ public class UpdaterWorker : IUpdaterWorker
             {
                 workspacePath = Path.GetFullPath(Path.Join(repoRootPath, workspacePath));
             }
-            result = new()
+
+            var error = JobErrorBase.ErrorFromException(ex, _jobId, workspacePath);
+            var result = new UpdateOperationResult()
             {
-                Error = JobErrorBase.ErrorFromException(ex, _jobId, workspacePath),
+                UpdateOperations = [],
+                Error = error,
             };
+            return result;
         }
-
-        return result;
     }
 
     public async Task<UpdateOperationResult> RunAsync(string repoRootPath, string workspacePath, string dependencyName, string previousDependencyVersion, string newDependencyVersion, bool isTransitive)
@@ -76,40 +79,60 @@ public class UpdaterWorker : IUpdaterWorker
             await GlobalJsonUpdater.UpdateDependencyAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, _logger);
         }
 
+        UpdateOperationResult result;
         var extension = Path.GetExtension(workspacePath).ToLowerInvariant();
         switch (extension)
         {
             case ".sln":
-                await RunForSolutionAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                result = await RunForSolutionAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
                 break;
             case ".proj":
-                await RunForProjFileAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                result = await RunForProjFileAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
                 break;
             case ".csproj":
             case ".fsproj":
             case ".vbproj":
-                await RunForProjectAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                result = await RunForProjectAsync(repoRootPath, workspacePath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
                 break;
             default:
                 _logger.Info($"File extension [{extension}] is not supported.");
+                result = new UpdateOperationResult()
+                {
+                    UpdateOperations = [],
+                };
                 break;
         }
 
+        result = result with { UpdateOperations = UpdateOperationBase.NormalizeUpdateOperationCollection(repoRootPath, result.UpdateOperations) };
+
+        if (!_experimentsManager.NativeUpdater)
+        {
+            // native updater reports the changes elsewhere
+            var updateReport = UpdateOperationBase.GenerateUpdateOperationReport(result.UpdateOperations);
+            _logger.Info(updateReport);
+        }
+
         _logger.Info("Update complete.");
 
         _processedProjectPaths.Clear();
-        return new UpdateOperationResult();
+        return result;
+    }
+
+    internal static string Serialize(UpdateOperationResult result)
+    {
+        var resultJson = JsonSerializer.Serialize(result, SerializerOptions);
+        return resultJson;
     }
 
     internal static async Task WriteResultFile(UpdateOperationResult result, string resultOutputPath, ILogger logger)
     {
         logger.Info($"  Writing update result to [{resultOutputPath}].");
 
-        var resultJson = JsonSerializer.Serialize(result, SerializerOptions);
+        var resultJson = Serialize(result);
         await File.WriteAllTextAsync(resultOutputPath, resultJson);
     }
 
-    private async Task RunForSolutionAsync(
+    private async Task<UpdateOperationResult> RunForSolutionAsync(
         string repoRootPath,
         string solutionPath,
         string dependencyName,
@@ -118,14 +141,21 @@ public class UpdaterWorker : IUpdaterWorker
         bool isTransitive)
     {
         _logger.Info($"Running for solution [{Path.GetRelativePath(repoRootPath, solutionPath)}]");
+        var updateOperations = new List<UpdateOperationBase>();
         var projectPaths = MSBuildHelper.GetProjectPathsFromSolution(solutionPath);
         foreach (var projectPath in projectPaths)
         {
-            await RunForProjectAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+            var projectResult = await RunForProjectAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+            updateOperations.AddRange(projectResult.UpdateOperations);
         }
+
+        return new UpdateOperationResult()
+        {
+            UpdateOperations = updateOperations.ToImmutableArray(),
+        };
     }
 
-    private async Task RunForProjFileAsync(
+    private async Task<UpdateOperationResult> RunForProjFileAsync(
         string repoRootPath,
         string projFilePath,
         string dependencyName,
@@ -137,21 +167,31 @@ public class UpdaterWorker : IUpdaterWorker
         if (!File.Exists(projFilePath))
         {
             _logger.Info($"File [{projFilePath}] does not exist.");
-            return;
+            return new UpdateOperationResult()
+            {
+                UpdateOperations = [],
+            };
         }
 
+        var updateOperations = new List<UpdateOperationBase>();
         var projectFilePaths = MSBuildHelper.GetProjectPathsFromProject(projFilePath);
         foreach (var projectFullPath in projectFilePaths)
         {
             // If there is some MSBuild logic that needs to run to fully resolve the path skip the project
             if (File.Exists(projectFullPath))
             {
-                await RunForProjectAsync(repoRootPath, projectFullPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                var projectResult = await RunForProjectAsync(repoRootPath, projectFullPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                updateOperations.AddRange(projectResult.UpdateOperations);
             }
         }
+
+        return new UpdateOperationResult()
+        {
+            UpdateOperations = updateOperations.ToImmutableArray(),
+        };
     }
 
-    private async Task RunForProjectAsync(
+    private async Task<UpdateOperationResult> RunForProjectAsync(
         string repoRootPath,
         string projectPath,
         string dependencyName,
@@ -163,21 +203,31 @@ public class UpdaterWorker : IUpdaterWorker
         if (!File.Exists(projectPath))
         {
             _logger.Info($"File [{projectPath}] does not exist.");
-            return;
+            return new UpdateOperationResult()
+            {
+                UpdateOperations = [],
+            };
         }
 
+        var updateOperations = new List<UpdateOperationBase>();
         var projectFilePaths = MSBuildHelper.GetProjectPathsFromProject(projectPath);
         foreach (var projectFullPath in projectFilePaths.Concat([projectPath]))
         {
             // If there is some MSBuild logic that needs to run to fully resolve the path skip the project
             if (File.Exists(projectFullPath))
             {
-                await RunUpdaterAsync(repoRootPath, projectFullPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                var performedOperations = await RunUpdaterAsync(repoRootPath, projectFullPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive);
+                updateOperations.AddRange(performedOperations);
             }
         }
+
+        return new UpdateOperationResult()
+        {
+            UpdateOperations = updateOperations.ToImmutableArray(),
+        };
     }
 
-    private async Task RunUpdaterAsync(
+    private async Task<IEnumerable<UpdateOperationBase>> RunUpdaterAsync(
         string repoRootPath,
         string projectPath,
         string dependencyName,
@@ -187,22 +237,25 @@ public class UpdaterWorker : IUpdaterWorker
     {
         if (_processedProjectPaths.Contains(projectPath))
         {
-            return;
+            return [];
         }
 
         _processedProjectPaths.Add(projectPath);
 
         _logger.Info($"Updating project [{projectPath}]");
 
+        var updateOperations = new List<UpdateOperationBase>();
         var additionalFiles = ProjectHelper.GetAllAdditionalFilesFromProject(projectPath, ProjectHelper.PathFormat.Full);
         var packagesConfigFullPath = additionalFiles.Where(p => Path.GetFileName(p).Equals(ProjectHelper.PackagesConfigFileName, StringComparison.OrdinalIgnoreCase)).FirstOrDefault();
         if (packagesConfigFullPath is not null)
         {
-            await PackagesConfigUpdater.UpdateDependencyAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, packagesConfigFullPath, _logger);
+            var packagesConfigOperations = await PackagesConfigUpdater.UpdateDependencyAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, packagesConfigFullPath, _logger);
+            updateOperations.AddRange(packagesConfigOperations);
         }
 
         // Some repos use a mix of packages.config and PackageReference
-        await PackageReferenceUpdater.UpdateDependencyAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive, _experimentsManager, _logger);
+        var packageReferenceOperations = await PackageReferenceUpdater.UpdateDependencyAsync(repoRootPath, projectPath, dependencyName, previousDependencyVersion, newDependencyVersion, isTransitive, _experimentsManager, _logger);
+        updateOperations.AddRange(packageReferenceOperations);
 
         // Update lock file if exists
         var packagesLockFullPath = additionalFiles.Where(p => Path.GetFileName(p).Equals(ProjectHelper.PackagesLockJsonFileName, StringComparison.OrdinalIgnoreCase)).FirstOrDefault();
@@ -210,5 +263,7 @@ public class UpdaterWorker : IUpdaterWorker
         {
             await LockFileUpdater.UpdateLockFileAsync(repoRootPath, projectPath, _experimentsManager, _logger);
         }
+
+        return updateOperations;
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/XmlFilePreAndPostProcessor.cs

@@ -1,3 +1,5 @@
+using System.Collections.Immutable;
+
 using Microsoft.Language.Xml;
 
 namespace NuGetUpdater.Core.Updater
@@ -6,11 +8,11 @@ namespace NuGetUpdater.Core.Updater
     {
         public Func<string> GetContent { get; }
         public Action<string> SetContent { get; }
-        public Func<XmlDocumentSyntax, XmlNodeSyntax?> NodeFinder { get; }
-        public Func<XmlNodeSyntax, XmlNodeSyntax> PreProcessor { get; }
-        public Func<XmlNodeSyntax, XmlNodeSyntax> PostProcessor { get; }
+        public Func<XmlDocumentSyntax, IEnumerable<XmlNodeSyntax>> NodeFinder { get; }
+        public Func<int, XmlNodeSyntax, XmlNodeSyntax> PreProcessor { get; }
+        public Func<int, XmlNodeSyntax, XmlNodeSyntax> PostProcessor { get; }
 
-        public XmlFilePreAndPostProcessor(Func<string> getContent, Action<string> setContent, Func<XmlDocumentSyntax, XmlNodeSyntax?> nodeFinder, Func<XmlNodeSyntax, XmlNodeSyntax> preProcessor, Func<XmlNodeSyntax, XmlNodeSyntax> postProcessor)
+        public XmlFilePreAndPostProcessor(Func<string> getContent, Action<string> setContent, Func<XmlDocumentSyntax, IEnumerable<XmlNodeSyntax>> nodeFinder, Func<int, XmlNodeSyntax, XmlNodeSyntax> preProcessor, Func<int, XmlNodeSyntax, XmlNodeSyntax> postProcessor)
         {
             GetContent = getContent;
             SetContent = setContent;
@@ -29,7 +31,7 @@ namespace NuGetUpdater.Core.Updater
 
         private void PostProcess() => RunProcessor(PostProcessor);
 
-        private void RunProcessor(Func<XmlNodeSyntax, XmlNodeSyntax> processor)
+        private void RunProcessor(Func<int, XmlNodeSyntax, XmlNodeSyntax> processor)
         {
             var content = GetContent();
             var xml = Parser.ParseText(content);
@@ -38,15 +40,28 @@ namespace NuGetUpdater.Core.Updater
                 return;
             }
 
-            var node = NodeFinder(xml);
-            if (node is null)
+            var offset = 0;
+            var nodes = NodeFinder(xml).ToImmutableArray();
+            for (int i = 0; i < nodes.Length; i++)
             {
-                return;
+                // modify the node...
+                var node = nodes[i];
+                var replacementElement = processor(i, node);
+
+                // ...however, the XML structure we're using is immutable and calling `.ReplaceNode()` below will fail because the nodes are no longer equal
+                // find the equivalent node by offset, accounting for any changes in length
+                var candidateEquivalentNodes = xml.DescendantNodes().OfType<XmlNodeSyntax>().ToArray();
+                var equivalentNode = candidateEquivalentNodes.First(n => n.Start == node.Start + offset);
+
+                // do the actual replacement
+                xml = xml.ReplaceNode(equivalentNode, replacementElement);
+
+                // update our offset
+                var thisNodeOffset = replacementElement.ToFullString().Length - node.ToFullString().Length;
+                offset += thisNodeOffset;
             }
 
-            var replacementElement = processor(node);
-            var replacementXml = xml.ReplaceNode(node, replacementElement);
-            var replacementString = replacementXml.ToFullString();
+            var replacementString = xml.ToFullString();
             SetContent(replacementString);
         }
     }