dependabot-nuget 0.303.0 → 0.304.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0d78d1b91ae626712aaadfdc2f4d03f8f15247b88b869a7285e0b4ad75a36c6
-  data.tar.gz: 6bb59e2674de36c8fae8ee8172db65e6c64447a9f951bd9717bc5915b1a491b3
+  metadata.gz: d547d192189427062cf34249cc425d0f2f9caf8819fd458ff9e2843ef55dcba1
+  data.tar.gz: 23a7375b74154eb6340e503b338b165f76c6b4d0f7d86cea2db51094a174d121
 SHA512:
-  metadata.gz: 0d71151a04b9a0ad457713832a763169027b9e24dc95366ffad4fa0011c7820f458410b288d4b85b3382f28923369cf56a60aa0d1970e66c91096c49c857b8b9
-  data.tar.gz: c041d7724ecfbf3dd2cd43064ff566eae5526ee5fe73f5b51df153b093f75b5fbc3a0600bbbe4b250bb1919de3e779f233f9a6100d20bfcc1f0b67cbbb82a503
+  metadata.gz: 3f18c6832a2d52a4a758a474c73d475695d0eccfbff98e3eb1c582e75078bbcc68f2ef49ceac6b759ff4c91fb56a70a46b6ca2873f03ddce279f724d13c5a9d7
+  data.tar.gz: 2b5d56a8a30569675d58ddf27b9947c4eba359559940d5f64c5486756c0fa6df1d69ede0f3e0212a5adb04dd854ac6aebcc5564f9d4b8b65b08edac265b84537

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/JobErrorBase.cs

@@ -30,6 +30,7 @@ public abstract record JobErrorBase : MessageBase
             {
                 HttpStatusCode.Unauthorized or
                 HttpStatusCode.Forbidden => new PrivateSourceAuthenticationFailure(NuGetContext.GetPackageSourceUrls(currentDirectory)),
+                HttpStatusCode.TooManyRequests => new PrivateSourceBadResponse(NuGetContext.GetPackageSourceUrls(currentDirectory)),
                 _ => new UnknownError(ex, jobId),
             },
             InvalidProjectFileException invalidProjectFile => new DependencyFileNotParseable(invalidProjectFile.ProjectFile),

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/PrivateSourceBadResponse.cs

@@ -0,0 +1,10 @@
+namespace NuGetUpdater.Core.Run.ApiModel;
+
+public record PrivateSourceBadResponse : JobErrorBase
+{
+    public PrivateSourceBadResponse(string[] urls)
+        : base("private_source_bad_response")
+    {
+        Details["source"] = $"({string.Join("|", urls)})";
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -968,6 +968,7 @@ internal static partial class MSBuildHelper
         ThrowOnMissingFile(output);
         ThrowOnMissingPackages(output);
         ThrowOnUpdateNotPossible(output);
+        ThrowOnRateLimitExceeded(output);
     }
 
     private static void ThrowOnUnauthenticatedFeed(string stdout)
@@ -985,6 +986,19 @@ internal static partial class MSBuildHelper
         }
     }
 
+    private static void ThrowOnRateLimitExceeded(string stdout)
+    {
+        var rateLimitMessageSnippets = new string[]
+        {
+            "Response status code does not indicate success: 429",
+            "429 (Too Many Requests)",
+        };
+        if (rateLimitMessageSnippets.Any(stdout.Contains))
+        {
+            throw new HttpRequestException(message: stdout, inner: null, statusCode: System.Net.HttpStatusCode.TooManyRequests);
+        }
+    }
+
     private static void ThrowOnMissingFile(string output)
     {
         var missingFile = GetMissingFile(output);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs

@@ -1247,6 +1247,83 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
         );
     }
 
+    [Fact]
+    public async Task ReportsPrivateSourceBadResponseFailure()
+    {
+        static (int, string) TestHttpHandler(string uriString)
+        {
+            var uri = new Uri(uriString, UriKind.Absolute);
+            var baseUrl = $"{uri.Scheme}://{uri.Host}:{uri.Port}";
+            return uri.PathAndQuery switch
+            {
+                // initial request is good
+                "/index.json" => (200, $$"""
+                    {
+                        "version": "3.0.0",
+                        "resources": [
+                            {
+                                "@id": "{{baseUrl}}/download",
+                                "@type": "PackageBaseAddress/3.0.0"
+                            },
+                            {
+                                "@id": "{{baseUrl}}/query",
+                                "@type": "SearchQueryService"
+                            },
+                            {
+                                "@id": "{{baseUrl}}/registrations",
+                                "@type": "RegistrationsBaseUrl"
+                            }
+                        ]
+                    }
+                    """),
+                // all other requests are unauthorized
+                _ => (429, "{}"),
+            };
+        }
+        // override various nuget locations
+        using var tempDir = new TemporaryDirectory();
+        using var _ = new TemporaryEnvironment(
+        [
+            ("NUGET_PACKAGES", Path.Combine(tempDir.DirectoryPath, "NUGET_PACKAGES")),
+            ("NUGET_HTTP_CACHE_PATH", Path.Combine(tempDir.DirectoryPath, "NUGET_HTTP_CACHE_PATH")),
+            ("NUGET_SCRATCH", Path.Combine(tempDir.DirectoryPath, "NUGET_SCRATCH")),
+            ("NUGET_PLUGINS_CACHE_PATH", Path.Combine(tempDir.DirectoryPath, "NUGET_PLUGINS_CACHE_PATH")),
+        ]);
+        using var http = TestHttpServer.CreateTestStringServer(TestHttpHandler);
+        var experimentsManager = new ExperimentsManager() { UseDirectDiscovery = true };
+        await TestDiscoveryAsync(
+            experimentsManager: experimentsManager,
+            workspacePath: "",
+            files:
+            [
+                ("project.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="1.2.3" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("NuGet.Config", $"""
+                    <configuration>
+                      <packageSources>
+                        <clear />
+                        <add key="private_feed" value="{http.BaseUrl.TrimEnd('/')}/index.json" allowInsecureConnections="true" />
+                      </packageSources>
+                    </configuration>
+                    """),
+            ],
+            expectedResult: new()
+            {
+                Error = new PrivateSourceBadResponse([$"{http.BaseUrl.TrimEnd('/')}/index.json"]),
+                Path = "",
+                Projects = [],
+            }
+        );
+    }
+
     [LinuxOnlyFact]
     public async Task DiscoverySucceedsWhenNoWindowsAppRefPackageCanBeFound()
     {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/SerializationTests.cs

@@ -649,6 +649,14 @@ public class SerializationTests
             """
         ];
 
+        yield return
+        [
+            new PrivateSourceBadResponse(["url1", "url2"]),
+            """
+            {"data":{"error-type":"private_source_bad_response","error-details":{"source":"(url1|url2)"}}}
+            """
+        ];
+
         yield return
         [
             new PullRequestExistsForLatestVersion("dep", "ver"),

data/lib/dependabot/nuget/native_helpers.rb

@@ -348,6 +348,8 @@ module Dependabot
           raise BadRequirementError, T.let(error_details.fetch("message"), String)
         when "private_source_authentication_failure"
           raise PrivateSourceAuthenticationFailure, T.let(error_details.fetch("source"), String)
+        when "private_source_bad_response"
+          raise PrivateSourceBadResponse, T.let(error_details.fetch("source"), String)
         when "update_not_possible"
           raise UpdateNotPossible, T.let(error_details.fetch("dependencies"), T::Array[String])
         when "unknown_error"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.303.0
+  version: 0.304.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-27 00:00:00.000000000 Z
+date: 2025-04-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.303.0
+        version: 0.304.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.303.0
+        version: 0.304.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -465,6 +465,7 @@ files:
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/MarkAsProcessed.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/MessageBase.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/PrivateSourceAuthenticationFailure.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/PrivateSourceBadResponse.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/PullRequest.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/PullRequestDependency.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/PullRequestExistsForLatestVersion.cs
@@ -549,7 +550,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.303.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.304.0
 post_install_message:
 rdoc_options: []
 require_paths: