dependabot-nuget 0.304.0 → 0.305.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d547d192189427062cf34249cc425d0f2f9caf8819fd458ff9e2843ef55dcba1
-  data.tar.gz: 23a7375b74154eb6340e503b338b165f76c6b4d0f7d86cea2db51094a174d121
+  metadata.gz: 137dd6d83f2c7ddfa976b7c2f4998569608d53591fcb78c71493a2a2f6ba38ba
+  data.tar.gz: 95c0a8c95e46fd79bbea338e110c675ee9e56983b587cea9392aa2161d939efa
 SHA512:
-  metadata.gz: 3f18c6832a2d52a4a758a474c73d475695d0eccfbff98e3eb1c582e75078bbcc68f2ef49ceac6b759ff4c91fb56a70a46b6ca2873f03ddce279f724d13c5a9d7
-  data.tar.gz: 2b5d56a8a30569675d58ddf27b9947c4eba359559940d5f64c5486756c0fa6df1d69ede0f3e0212a5adb04dd854ac6aebcc5564f9d4b8b65b08edac265b84537
+  metadata.gz: 4c1f3bc6e859ebadea39a5f5c142270458abd1b6778f872dc3026bec5489652bd652356ee37c8f8b5f5f57397e00c81914281f2d3380584afea88e8080eab0a2
+  data.tar.gz: 2b23f7200bf17572009da8f6eed84bbac0fd6e8a0d9c52eb781e6a32fa0933598adb25732d8488cef709eed07a10b88d2146618f8444350e35d0798e8c74030b

data/helpers/lib/NuGetUpdater/Directory.Packages.props

@@ -1,13 +1,10 @@
 <Project>
-
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
   </PropertyGroup>
-
   <PropertyGroup>
     <MSBuildPackageVersion>17.12.6</MSBuildPackageVersion>
   </PropertyGroup>
-
   <ItemGroup>
     <PackageVersion Include="DiffPlex" Version="1.7.2" />
     <PackageVersion Include="GuiLabs.Language.Xml" Version="1.2.93" />
@@ -20,12 +17,16 @@
     <PackageVersion Include="Microsoft.CSharp" Version="4.7.0" />
     <PackageVersion Include="Microsoft.Extensions.FileProviders.Abstractions" Version="9.0.0" />
     <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="9.0.3" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.3" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
     <PackageVersion Include="Microsoft.VisualStudio.Setup.Configuration.Interop" Version="3.12.2149" />
     <PackageVersion Include="Microsoft.Web.Xdt" Version="3.1.0" />
     <PackageVersion Include="MSBuild.StructuredLogger" Version="2.2.386" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageVersion Include="NuGet.Core" Version="2.14.0" Aliases="CoreV2" />
+    <PackageVersion Include="OpenTelemetry" Version="1.11.2" />
+    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.11.2" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.11.2" />
     <PackageVersion Include="Semver" Version="3.0.0" />
     <PackageVersion Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
     <PackageVersion Include="System.ComponentModel.Composition" Version="9.0.3" />
@@ -39,5 +40,4 @@
     <PackageVersion Include="xunit" Version="2.9.3" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.2" />
   </ItemGroup>
-
-</Project>
+</Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/AnalyzeCommand.cs

@@ -30,7 +30,7 @@ internal static class AnalyzeCommand
 
         command.SetHandler(async (jobId, jobPath, repoRoot, discoveryPath, dependencyPath, analysisDirectory) =>
         {
-            var logger = new ConsoleLogger();
+            var logger = new OpenTelemetryLogger();
             var (experimentsManager, _errorResult) = await ExperimentsManager.FromJobFileAsync(jobId, jobPath.FullName);
             var worker = new AnalyzeWorker(jobId, experimentsManager, logger);
             await worker.RunAsync(repoRoot.FullName, discoveryPath.FullName, dependencyPath.FullName, analysisDirectory.FullName);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/CloneCommand.cs

@@ -28,7 +28,7 @@ internal static class CloneCommand
         command.SetHandler(async (jobPath, repoContentsPath, apiUrl, jobId) =>
         {
             var apiHandler = new HttpApiHandler(apiUrl.ToString(), jobId);
-            var logger = new ConsoleLogger();
+            var logger = new OpenTelemetryLogger();
             var gitCommandHandler = new ShellGitCommandHandler(logger);
             var worker = new CloneWorker(jobId, apiHandler, gitCommandHandler);
             var exitCode = await worker.RunAsync(jobPath, repoContentsPath);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/DiscoverCommand.cs

@@ -28,7 +28,8 @@ internal static class DiscoverCommand
 
         command.SetHandler(async (jobId, jobPath, repoRoot, workspace, outputPath) =>
         {
-            MSBuildHelper.RegisterMSBuild(repoRoot.FullName, repoRoot.FullName);
+            var logger = new OpenTelemetryLogger();
+            MSBuildHelper.RegisterMSBuild(repoRoot.FullName, repoRoot.FullName, logger);
             var (experimentsManager, error) = await ExperimentsManager.FromJobFileAsync(jobId, jobPath.FullName);
             if (error is not null)
             {
@@ -43,7 +44,6 @@ internal static class DiscoverCommand
                 return;
             }
 
-            var logger = new ConsoleLogger();
             var worker = new DiscoveryWorker(jobId, experimentsManager, logger);
             await worker.RunAsync(repoRoot.FullName, workspace, outputPath.FullName);
         }, JobIdOption, JobPathOption, RepoRootOption, WorkspaceOption, OutputOption);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/RunCommand.cs

@@ -34,7 +34,7 @@ internal static class RunCommand
         {
             var apiHandler = new HttpApiHandler(apiUrl.ToString(), jobId);
             var (experimentsManager, _errorResult) = await ExperimentsManager.FromJobFileAsync(jobId, jobPath.FullName);
-            var logger = new ConsoleLogger();
+            var logger = new OpenTelemetryLogger();
             var discoverWorker = new DiscoveryWorker(jobId, experimentsManager, logger);
             var analyzeWorker = new AnalyzeWorker(jobId, experimentsManager, logger);
             var updateWorker = new UpdaterWorker(jobId, experimentsManager, logger);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/UpdateCommand.cs

@@ -46,7 +46,7 @@ internal static class UpdateCommand
             var resultOutputPath = context.ParseResult.GetValueForOption(ResultOutputPathOption);
 
             var (experimentsManager, _error) = await ExperimentsManager.FromJobFileAsync(jobId, jobPath.FullName);
-            var logger = new ConsoleLogger();
+            var logger = new OpenTelemetryLogger();
             var worker = new UpdaterWorker(jobId, experimentsManager, logger);
             await worker.RunAsync(repoRoot.FullName, solutionOrProjectFile.FullName, dependencyName, previousVersion, newVersion, isTransitive, resultOutputPath);
             setExitCode(0);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/AnalyzeWorker.cs

@@ -67,7 +67,7 @@ public partial class AnalyzeWorker : IAnalyzeWorker
 
     public async Task<AnalysisResult> RunAsync(string repoRoot, WorkspaceDiscoveryResult discovery, DependencyInfo dependencyInfo)
     {
-        MSBuildHelper.RegisterMSBuild(repoRoot, repoRoot);
+        MSBuildHelper.RegisterMSBuild(repoRoot, repoRoot, _logger);
 
         var startingDirectory = PathHelper.JoinPath(repoRoot, discovery.Path);
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DiscoveryWorker.cs

@@ -65,7 +65,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
 
     public async Task<WorkspaceDiscoveryResult> RunAsync(string repoRootPath, string workspacePath)
     {
-        MSBuildHelper.RegisterMSBuild(repoRootPath, workspacePath);
+        MSBuildHelper.RegisterMSBuild(repoRootPath, workspacePath, _logger);
 
         // the `workspacePath` variable is relative to a repository root, so a rooted path actually isn't rooted; the
         // easy way to deal with this is to just trim the leading "/" if it exists

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/ProjectBuildFile.cs

@@ -8,13 +8,15 @@ internal sealed class ProjectBuildFile : XmlBuildFile
         => Parse(basePath, path, File.ReadAllText(path));
 
     public static ProjectBuildFile Parse(string basePath, string path, string xml)
-        => new(basePath, path, Parser.ParseText(xml));
+        => new(basePath, path, Parse(xml));
 
     public ProjectBuildFile(string basePath, string path, XmlDocumentSyntax contents)
         : base(basePath, path, contents)
     {
     }
 
+    public static XmlDocumentSyntax Parse(string contents) => Parser.ParseText(contents);
+
     public IXmlElementSyntax ProjectNode => Contents.RootSyntax;
 
     public IEnumerable<IXmlElementSyntax> SdkNodes => ProjectNode

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/NuGetUpdater.Core.csproj

@@ -23,8 +23,12 @@
     <PackageReference Include="GuiLabs.Language.Xml" />
     <PackageReference Include="DiffPlex" />
     <PackageReference Include="Microsoft.Build.Locator" />
+    <PackageReference Include="Microsoft.Extensions.Logging" />
     <PackageReference Include="MSBuild.StructuredLogger" />
     <PackageReference Include="NuGet.Core" Aliases="CoreV2" />
+    <PackageReference Include="OpenTelemetry" />
+    <PackageReference Include="OpenTelemetry.Exporter.Console" />
+    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" />
   </ItemGroup>
 
   <ItemGroup>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/JobErrorBase.cs

@@ -31,6 +31,7 @@ public abstract record JobErrorBase : MessageBase
                 HttpStatusCode.Unauthorized or
                 HttpStatusCode.Forbidden => new PrivateSourceAuthenticationFailure(NuGetContext.GetPackageSourceUrls(currentDirectory)),
                 HttpStatusCode.TooManyRequests => new PrivateSourceBadResponse(NuGetContext.GetPackageSourceUrls(currentDirectory)),
+                HttpStatusCode.ServiceUnavailable => new PrivateSourceBadResponse(NuGetContext.GetPackageSourceUrls(currentDirectory)),
                 _ => new UnknownError(ex, jobId),
             },
             InvalidProjectFileException invalidProjectFile => new DependencyFileNotParseable(invalidProjectFile.ProjectFile),

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/PullRequestTextGenerator.cs

@@ -1,44 +1,45 @@
-using NuGet.Versioning;
+using System.Collections.Immutable;
 
 using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Updater;
 
 namespace NuGetUpdater.Core.Run;
 
 public class PullRequestTextGenerator
 {
-    public static string GetPullRequestTitle(Job job, ReportedDependency[] updatedDependencies, DependencyFile[] updatedFiles, string? dependencyGroupName = null)
+    public static string GetPullRequestTitle(Job job, ImmutableArray<UpdateOperationBase> updateOperationsPerformed, string? dependencyGroupName)
     {
         // simple version looks like
         //   Update Some.Package to 1.2.3
         // if multiple packages are updated to multiple versions, result looks like:
         //   Update Package.A to 1.0.0, 2.0.0; Package.B to 3.0.0, 4.0.0
-        var dependencySets = updatedDependencies
-            .GroupBy(d => d.Name, StringComparer.OrdinalIgnoreCase)
+        var dependencySets = updateOperationsPerformed
+            .GroupBy(d => d.DependencyName, StringComparer.OrdinalIgnoreCase)
             .OrderBy(g => g.Key, StringComparer.OrdinalIgnoreCase)
             .Select(g => new
             {
                 Name = g.Key,
                 Versions = g
-                    .Where(d => d.Version is not null)
-                    .Select(d => d.Version!)
-                    .OrderBy(d => NuGetVersion.Parse(d))
+                    .Select(d => d.NewVersion)
+                    .OrderBy(v => v)
                     .ToArray()
             })
             .ToArray();
         var updatedPartTitles = dependencySets
-            .Select(d => $"{d.Name} to {string.Join(", ", d.Versions)}")
+            .Select(d => $"{d.Name} to {string.Join(", ", d.Versions.Select(v => v.ToString()))}")
             .ToArray();
         var title = $"{job.CommitMessageOptions?.Prefix}Update {string.Join("; ", updatedPartTitles)}";
         return title;
     }
 
-    public static string GetPullRequestCommitMessage(Job job, ReportedDependency[] updatedDependencies, DependencyFile[] updatedFiles, string? dependencyGroupName = null)
+    public static string GetPullRequestCommitMessage(Job job, ImmutableArray<UpdateOperationBase> updateOperationsPerformed, string? dependencyGroupName)
     {
-        return GetPullRequestTitle(job, updatedDependencies, updatedFiles, dependencyGroupName);
+        return GetPullRequestTitle(job, updateOperationsPerformed, dependencyGroupName);
     }
 
-    public static string GetPullRequestBody(Job job, ReportedDependency[] updatedDependencies, DependencyFile[] updatedFiles, string? dependencyGroupName = null)
+    public static string GetPullRequestBody(Job job, ImmutableArray<UpdateOperationBase> updateOperationsPerformed, string? dependencyGroupName)
     {
-        return GetPullRequestTitle(job, updatedDependencies, updatedFiles, dependencyGroupName);
+        var report = UpdateOperationBase.GenerateUpdateOperationReport(updateOperationsPerformed);
+        return report;
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -69,7 +69,7 @@ public class RunWorker
 
         try
         {
-            MSBuildHelper.RegisterMSBuild(repoContentsPath.FullName, repoContentsPath.FullName);
+            MSBuildHelper.RegisterMSBuild(repoContentsPath.FullName, repoContentsPath.FullName, _logger);
 
             var experimentsManager = ExperimentsManager.GetExperimentsManager(job.Experiments);
             var allDependencyFiles = new Dictionary<string, DependencyFile>();
@@ -291,7 +291,12 @@ public class RunWorker
             .Select(kvp => kvp.Value)
             .ToArray();
 
-        var resultMessage = GetPullRequestApiMessage(job, updatedDependencyFileList, actualUpdatedDependencies.ToArray(), baseCommitSha);
+        var normalizedUpdateOperationsPerformed = UpdateOperationBase.NormalizeUpdateOperationCollection(repoContentsPath.FullName, updateOperationsPerformed);
+        var report = UpdateOperationBase.GenerateUpdateOperationReport(normalizedUpdateOperationsPerformed);
+        _logger.Info(report);
+
+        var sortedUpdatedDependencies = actualUpdatedDependencies.OrderBy(d => d.Name, StringComparer.OrdinalIgnoreCase).ToArray();
+        var resultMessage = GetPullRequestApiMessage(job, updatedDependencyFileList, sortedUpdatedDependencies, normalizedUpdateOperationsPerformed, baseCommitSha);
         switch (resultMessage)
         {
             case ClosePullRequest close:
@@ -321,10 +326,6 @@ public class RunWorker
             await SendApiMessage(new SecurityUpdateNotNeeded(depName));
         }
 
-        var normalizedUpdateOperationsPerformed = UpdateOperationBase.NormalizeUpdateOperationCollection(repoContentsPath.FullName, updateOperationsPerformed);
-        var report = UpdateOperationBase.GenerateUpdateOperationReport(normalizedUpdateOperationsPerformed);
-        _logger.Info(report);
-
         var result = new RunResult()
         {
             Base64DependencyFiles = originalDependencyFileContents.OrderBy(kvp => kvp.Key).Select(kvp =>
@@ -365,10 +366,16 @@ public class RunWorker
         }
     }
 
-    internal static MessageBase? GetPullRequestApiMessage(Job job, DependencyFile[] updatedFiles, ReportedDependency[] updatedDependencies, string baseCommitSha)
+    internal static MessageBase? GetPullRequestApiMessage(
+        Job job,
+        DependencyFile[] updatedFiles,
+        ReportedDependency[] updatedDependencies,
+        ImmutableArray<UpdateOperationBase> updateOperationsPerformed,
+        string baseCommitSha
+    )
     {
-        updatedDependencies = updatedDependencies.OrderBy(d => d.Name, StringComparer.OrdinalIgnoreCase).ToArray();
-        var updatedDependenciesSet = updatedDependencies.Select(d => d.Name).ToHashSet(StringComparer.OrdinalIgnoreCase);
+        var updatedDependencyNames = updateOperationsPerformed.Select(u => u.DependencyName).OrderBy(d => d, StringComparer.OrdinalIgnoreCase).ToArray();
+        var updatedDependenciesSet = updatedDependencyNames.ToHashSet(StringComparer.OrdinalIgnoreCase);
 
         // all pull request dependencies with optional group name
         var existingPullRequests = job.GetAllExistingPullRequests();
@@ -390,12 +397,12 @@ public class RunWorker
                 return new UpdatePullRequest()
                 {
                     DependencyGroup = existingPullRequest.Item1,
-                    DependencyNames = updatedDependencies.Select(d => d.Name).ToImmutableArray(),
+                    DependencyNames = [.. updatedDependencyNames],
                     UpdatedDependencyFiles = updatedFiles,
                     BaseCommitSha = baseCommitSha,
-                    CommitMessage = PullRequestTextGenerator.GetPullRequestCommitMessage(job, updatedDependencies, updatedFiles, existingPullRequest.Item1),
-                    PrTitle = PullRequestTextGenerator.GetPullRequestTitle(job, updatedDependencies, updatedFiles, existingPullRequest.Item1),
-                    PrBody = PullRequestTextGenerator.GetPullRequestBody(job, updatedDependencies, updatedFiles, existingPullRequest.Item1),
+                    CommitMessage = PullRequestTextGenerator.GetPullRequestCommitMessage(job, updateOperationsPerformed, existingPullRequest.Item1),
+                    PrTitle = PullRequestTextGenerator.GetPullRequestTitle(job, updateOperationsPerformed, existingPullRequest.Item1),
+                    PrBody = PullRequestTextGenerator.GetPullRequestBody(job, updateOperationsPerformed, existingPullRequest.Item1),
                 };
             }
             else
@@ -422,16 +429,16 @@ public class RunWorker
         }
         else
         {
-            if (updatedDependencies.Any())
+            if (updatedDependencyNames.Any())
             {
                 return new CreatePullRequest()
                 {
                     Dependencies = updatedDependencies,
                     UpdatedDependencyFiles = updatedFiles,
                     BaseCommitSha = baseCommitSha,
-                    CommitMessage = PullRequestTextGenerator.GetPullRequestCommitMessage(job, updatedDependencies, updatedFiles),
-                    PrTitle = PullRequestTextGenerator.GetPullRequestTitle(job, updatedDependencies, updatedFiles),
-                    PrBody = PullRequestTextGenerator.GetPullRequestBody(job, updatedDependencies, updatedFiles),
+                    CommitMessage = PullRequestTextGenerator.GetPullRequestCommitMessage(job, updateOperationsPerformed, dependencyGroupName: null),
+                    PrTitle = PullRequestTextGenerator.GetPullRequestTitle(job, updateOperationsPerformed, dependencyGroupName: null),
+                    PrBody = PullRequestTextGenerator.GetPullRequestBody(job, updateOperationsPerformed, dependencyGroupName: null),
                 };
             }
         }
@@ -547,9 +554,33 @@ public class RunWorker
                         .ToArray();
                     if (existingPullRequests.Length > 0)
                     {
-                        var existingPrVersion = existingPullRequests[0].Item2.First(d => d.DependencyName.Equals(dependency.Name, StringComparison.OrdinalIgnoreCase)).DependencyVersion;
-                        message = new PullRequestExistsForLatestVersion(dependency.Name, existingPrVersion.ToString());
-                        return false;
+                        // found a matching pr...
+                        if (job.UpdatingAPullRequest)
+                        {
+                            // ...and we've been asked to update it
+                            return true;
+                        }
+                        else
+                        {
+                            // ...but no update requested => don't perform any update and report error
+                            var existingPrVersion = existingPullRequests[0].Item2.First(d => d.DependencyName.Equals(dependency.Name, StringComparison.OrdinalIgnoreCase)).DependencyVersion;
+                            message = new PullRequestExistsForLatestVersion(dependency.Name, existingPrVersion.ToString());
+                            return false;
+                        }
+                    }
+                    else
+                    {
+                        // no matching pr...
+                        if (job.UpdatingAPullRequest)
+                        {
+                            // ...but we've been asked to perform an update => no update possible, nothing to report
+                            return false;
+                        }
+                        else
+                        {
+                            // ...and no update specifically requested => create new
+                            return true;
+                        }
                     }
                 }
                 else
@@ -565,7 +596,7 @@ public class RunWorker
                     }
                 }
 
-                return isVulnerable;
+                return false;
             }
             else
             {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackageReferenceUpdater.cs

@@ -399,7 +399,7 @@ internal static class PackageReferenceUpdater
     }
 
     /// <returns>The updated files.</returns>
-    private static async Task<IEnumerable<string>> UpdateTransitiveDependencyAsync(
+    internal static async Task<IEnumerable<string>> UpdateTransitiveDependencyAsync(
         string repoRootPath,
         string projectPath,
         string dependencyName,
@@ -419,6 +419,17 @@ internal static class PackageReferenceUpdater
         else
         {
             updatedFiles = await AddTransitiveDependencyAsync(repoRootPath, projectPath, dependencyName, newDependencyVersion, experimentsManager, logger);
+
+            // files directly modified on disk by an external tool need to be refreshed in-memory
+            foreach (var updatedFile in updatedFiles)
+            {
+                var matchingBuildFile = buildFiles.FirstOrDefault(bf => PathComparer.Instance.Compare(updatedFile, bf.Path) == 0);
+                if (matchingBuildFile is not null)
+                {
+                    var updatedContents = await File.ReadAllTextAsync(updatedFile);
+                    matchingBuildFile.Update(ProjectBuildFile.Parse(updatedContents));
+                }
+            }
         }
 
         return updatedFiles;
@@ -671,7 +682,7 @@ internal static class PackageReferenceUpdater
     }
 
     /// <returns>The updated files.</returns>
-    private static (UpdateResult, IEnumerable<UpdateOperationBase>) TryUpdateDependencyVersion(
+    internal static (UpdateResult, IEnumerable<UpdateOperationBase>) TryUpdateDependencyVersion(
         ImmutableArray<ProjectBuildFile> buildFiles,
         string dependencyName,
         string? previousDependencyVersion,

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdateOperationBase.cs

@@ -112,14 +112,14 @@ public abstract record UpdateOperationBase
 public record DirectUpdate : UpdateOperationBase
 {
     public override string Type => nameof(DirectUpdate);
-    public override string GetReport() => $"Updated {DependencyName} to {NewVersion} in {string.Join("", UpdatedFiles)}";
+    public override string GetReport() => $"Updated {DependencyName} to {NewVersion} in {string.Join(", ", UpdatedFiles)}";
     public sealed override string ToString() => GetString();
 }
 
 public record PinnedUpdate : UpdateOperationBase
 {
     public override string Type => nameof(PinnedUpdate);
-    public override string GetReport() => $"Pinned {DependencyName} at {NewVersion} in {string.Join("", UpdatedFiles)}";
+    public override string GetReport() => $"Pinned {DependencyName} at {NewVersion} in {string.Join(", ", UpdatedFiles)}";
     public sealed override string ToString() => GetString();
 }
 
@@ -129,7 +129,7 @@ public record ParentUpdate : UpdateOperationBase, IEquatable<UpdateOperationBase
     public required string ParentDependencyName { get; init; }
     public required NuGetVersion ParentNewVersion { get; init; }
 
-    public override string GetReport() => $"Updated {DependencyName} to {NewVersion} indirectly via {ParentDependencyName}/{ParentNewVersion} in {string.Join("", UpdatedFiles)}";
+    public override string GetReport() => $"Updated {DependencyName} to {NewVersion} indirectly via {ParentDependencyName}/{ParentNewVersion} in {string.Join(", ", UpdatedFiles)}";
 
     bool IEquatable<UpdateOperationBase>.Equals(UpdateOperationBase? other)
     {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdaterWorker.cs

@@ -66,7 +66,7 @@ public class UpdaterWorker : IUpdaterWorker
 
     public async Task<UpdateOperationResult> RunAsync(string repoRootPath, string workspacePath, string dependencyName, string previousDependencyVersion, string newDependencyVersion, bool isTransitive)
     {
-        MSBuildHelper.RegisterMSBuild(Environment.CurrentDirectory, repoRootPath);
+        MSBuildHelper.RegisterMSBuild(Environment.CurrentDirectory, repoRootPath, _logger);
 
         if (!Path.IsPathRooted(workspacePath) || !File.Exists(workspacePath))
         {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -33,7 +33,7 @@ internal static partial class MSBuildHelper
 
     public static string GetFileFromRuntimeDirectory(string fileName) => Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location)!, fileName);
 
-    public static void RegisterMSBuild(string currentDirectory, string rootDirectory)
+    public static void RegisterMSBuild(string currentDirectory, string rootDirectory, ILogger logger)
     {
         // Ensure MSBuild types are registered before calling a method that loads the types
         if (!IsMSBuildRegistered)
@@ -45,7 +45,7 @@ internal static partial class MSBuildHelper
                 MSBuildPath = defaultInstance.MSBuildPath;
                 MSBuildLocator.RegisterInstance(defaultInstance);
                 return Task.FromResult(0);
-            }).Wait();
+            }, logger).Wait();
         }
     }
 
@@ -54,11 +54,10 @@ internal static partial class MSBuildHelper
         string rootDirectory,
         ExperimentsManager experimentsManager,
         Func<Task<T>> action,
-        ILogger? logger = null,
+        ILogger logger,
         bool retainMSBuildSdks = false
     )
     {
-        logger ??= new ConsoleLogger();
         if (experimentsManager.InstallDotnetSdks)
         {
             logger.Info($"{nameof(ExperimentsManager.InstallDotnetSdks)} == true; retaining `global.json` contents.");
@@ -820,7 +819,7 @@ internal static partial class MSBuildHelper
                 experimentsManager
             );
             return (exitCode, stdOut, stdErr);
-        });
+        }, logger);
         ThrowOnError(stdOut);
         if (exitCode != 0)
         {
@@ -969,6 +968,7 @@ internal static partial class MSBuildHelper
         ThrowOnMissingPackages(output);
         ThrowOnUpdateNotPossible(output);
         ThrowOnRateLimitExceeded(output);
+        ThrowOnServiceUnavailable(output);
     }
 
     private static void ThrowOnUnauthenticatedFeed(string stdout)
@@ -999,6 +999,19 @@ internal static partial class MSBuildHelper
         }
     }
 
+    private static void ThrowOnServiceUnavailable(string stdout)
+    {
+        var serviceUnavailableMessageSnippets = new string[]
+        {
+            "503 (Service Unavailable)",
+            "Response status code does not indicate success: 503",
+        };
+        if (serviceUnavailableMessageSnippets.Any(stdout.Contains))
+        {
+            throw new HttpRequestException(message: stdout, inner: null, statusCode: System.Net.HttpStatusCode.ServiceUnavailable);
+        }
+    }
+
     private static void ThrowOnMissingFile(string output)
     {
         var missingFile = GetMissingFile(output);
@@ -1071,6 +1084,7 @@ internal static partial class MSBuildHelper
         TryGetGlobalJsonPath(repoRootPath, projectPath, out var globalJsonPath);
         var safeGlobalJsonName = $"{globalJsonPath}{Guid.NewGuid()}";
         HashSet<string> targetFrameworks = new(StringComparer.OrdinalIgnoreCase);
+        var repoRootDirectoryInfo = new DirectoryInfo(repoRootPath);
 
         try
         {
@@ -1099,12 +1113,23 @@ internal static partial class MSBuildHelper
             // load the project even if it imports a file that doesn't exist (e.g. a file that's generated at restore
             // or build time).
             using var projectCollection = new ProjectCollection(); // do this in a one-off instance and don't pollute the global collection
-            Project project = Project.FromFile(projectPath, new ProjectOptions
+            var project = Project.FromFile(projectPath, new ProjectOptions
             {
                 LoadSettings = ProjectLoadSettings.IgnoreMissingImports,
                 ProjectCollection = projectCollection,
             });
-            buildFileList.AddRange(project.Imports.Select(i => i.ImportedProject.FullPath.NormalizePathToUnix()));
+            var allImportedPaths = project.Imports.Select(i => i.ImportedProject.FullPath.NormalizePathToUnix()).ToArray();
+            var importedPathsInRepo = allImportedPaths.Where(p => PathHelper.IsFileUnderDirectory(repoRootDirectoryInfo, new FileInfo(p))).ToArray();
+            var projectDir = Path.GetDirectoryName(projectPath)!;
+            var intermediateDir = new DirectoryInfo(Path.Combine(projectDir, project.GetPropertyValue("BaseIntermediateOutputPath")));
+            var outputDir = new DirectoryInfo(Path.Combine(projectDir, project.GetPropertyValue("BaseOutputPath")));
+            var nonTransitivePathsInRepo = importedPathsInRepo.Where(p =>
+            {
+                var fi = new FileInfo(p);
+                return !PathHelper.IsFileUnderDirectory(intermediateDir, fi)
+                    && !PathHelper.IsFileUnderDirectory(outputDir, fi);
+            }).ToArray();
+            buildFileList.AddRange(nonTransitivePathsInRepo.Select(p => p.NormalizePathToUnix()));
 
             // use the MSBuild-evaluated value so we don't have to try to manually parse XML
             IEnumerable<ProjectProperty> targetFrameworkProperties = project.Properties.Where(p => p.Name.Equals("TargetFramework", StringComparison.OrdinalIgnoreCase)).ToList();
@@ -1153,11 +1178,7 @@ internal static partial class MSBuildHelper
             }
         }
 
-        var repoRootPathPrefix = repoRootPath.NormalizePathToUnix() + "/";
-        var buildFiles = buildFileList
-            .Where(f => f.StartsWith(repoRootPathPrefix, StringComparison.OrdinalIgnoreCase))
-            .Distinct();
-        var result = buildFiles
+        var result = buildFileList
             .Where(File.Exists)
             .Select(path => ProjectBuildFile.Open(repoRootPath, path))
             .ToImmutableArray();

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/OpenTelemetryLogger.cs

@@ -0,0 +1,54 @@
+using System.Globalization;
+
+using Microsoft.Extensions.Logging;
+
+using OpenTelemetry;
+using OpenTelemetry.Logs;
+
+namespace NuGetUpdater.Core
+{
+    public class OpenTelemetryLogger : ILogger, IDisposable
+    {
+        private readonly ILoggerFactory _loggerFactory;
+        private readonly Microsoft.Extensions.Logging.ILogger _logger;
+
+        public OpenTelemetryLogger()
+        {
+            _loggerFactory = LoggerFactory.Create(builder =>
+            {
+                builder.AddOpenTelemetry(logging =>
+                {
+                    logging.AddProcessor(new SimpleLogRecordExportProcessor(new CustomConsoleExporter()));
+                    logging.AddOtlpExporter();
+                });
+            });
+
+            _logger = _loggerFactory.CreateLogger<OpenTelemetryLogger>();
+        }
+
+        public void LogRaw(string message)
+        {
+            _logger.LogInformation(message);
+        }
+
+        public void Dispose()
+        {
+            _loggerFactory?.Dispose();
+        }
+    }
+
+    // We do this because the exporter that comes from AddConsoleExporter() prepends "LogRecord.Timestamp" in front of strings 
+    internal class CustomConsoleExporter : BaseExporter<LogRecord>
+    {
+        public override ExportResult Export(in Batch<LogRecord> batch)
+        {
+            foreach (var logRecord in batch)
+            {
+                Console.WriteLine(logRecord.Body ?? string.Empty);
+            }
+
+            return ExportResult.Success;
+        }
+    }
+
+}