dependabot-nuget 0.310.0 → 0.312.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/PullRequestTextGenerator.cs

@@ -1,5 +1,7 @@
 using System.Collections.Immutable;
 
+using NuGet.Versioning;
+
 using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Updater;
 
@@ -7,34 +9,68 @@ namespace NuGetUpdater.Core.Run;
 
 public class PullRequestTextGenerator
 {
+    private const int MaxTitleLength = 70;
+
     public static string GetPullRequestTitle(Job job, ImmutableArray<UpdateOperationBase> updateOperationsPerformed, string? dependencyGroupName)
     {
         // simple version looks like
         //   Update Some.Package to 1.2.3
         // if multiple packages are updated to multiple versions, result looks like:
         //   Update Package.A to 1.0.0, 2.0.0; Package.B to 3.0.0, 4.0.0
-        var dependencySets = updateOperationsPerformed
-            .GroupBy(d => d.DependencyName, StringComparer.OrdinalIgnoreCase)
-            .OrderBy(g => g.Key, StringComparer.OrdinalIgnoreCase)
-            .Select(g => new
-            {
-                Name = g.Key,
-                Versions = g
-                    .Select(d => d.NewVersion)
-                    .OrderBy(v => v)
-                    .ToArray()
-            })
-            .ToArray();
+        var dependencySets = GetDependencySets(updateOperationsPerformed);
         var updatedPartTitles = dependencySets
             .Select(d => $"{d.Name} to {string.Join(", ", d.Versions.Select(v => v.ToString()))}")
             .ToArray();
         var title = $"{job.CommitMessageOptions?.Prefix}Update {string.Join("; ", updatedPartTitles)}";
+
+        // don't let the title get too long
+        if (title.Length > MaxTitleLength && updatedPartTitles.Length >= 3)
+        {
+            title = $"{job.CommitMessageOptions?.Prefix}Update {dependencySets[0].Name} and {dependencySets.Length - 1} other dependencies";
+        }
+
         return title;
     }
 
     public static string GetPullRequestCommitMessage(Job job, ImmutableArray<UpdateOperationBase> updateOperationsPerformed, string? dependencyGroupName)
     {
-        return GetPullRequestTitle(job, updateOperationsPerformed, dependencyGroupName);
+        // updating a single dependency looks like
+        //   Update Some.Package to 1.2.3
+        // if multiple packages are updated, result looks like:
+        //   Update:
+        //   - Package.A to 1.0.0
+        //   - Package.B to 2.0.0
+        var dependencySets = GetDependencySets(updateOperationsPerformed);
+        if (dependencySets.Length == 1)
+        {
+            var depName = dependencySets[0].Name;
+            var depVersions = dependencySets[0].Versions.Select(v => v.ToString());
+            return $"Update {dependencySets[0].Name} to {string.Join(", ", depVersions)}";
+        }
+
+        var updatedParts = dependencySets
+            .Select(d => $"- {d.Name} to {string.Join(", ", d.Versions.Select(v => v.ToString()))}")
+            .ToArray();
+        var message = string.Join("\n", ["Update:", .. updatedParts]);
+        return message;
+    }
+
+    private static (string Name, NuGetVersion[] Versions)[] GetDependencySets(ImmutableArray<UpdateOperationBase> updateOperationsPerformed)
+    {
+        var dependencySets = updateOperationsPerformed
+            .GroupBy(d => d.DependencyName, StringComparer.OrdinalIgnoreCase)
+            .OrderBy(g => g.Key, StringComparer.OrdinalIgnoreCase)
+            .Select(g =>
+            {
+                var name = g.Key;
+                var versions = g
+                    .Select(d => d.NewVersion)
+                    .OrderBy(v => v)
+                    .ToArray();
+                return (name, versions);
+            })
+            .ToArray();
+        return dependencySets;
     }
 
     public static string GetPullRequestBody(Job job, ImmutableArray<UpdateOperationBase> updateOperationsPerformed, string? dependencyGroupName)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -113,7 +113,16 @@ public class RunWorker
         _logger.Info("Discovery JSON content:");
         _logger.Info(JsonSerializer.Serialize(discoveryResult, DiscoveryWorker.SerializerOptions));
 
-        // TODO: report errors
+        if (discoveryResult.Error is not null)
+        {
+            // this is unrecoverable
+            await _apiHandler.RecordUpdateJobError(discoveryResult.Error);
+            return new()
+            {
+                Base64DependencyFiles = [],
+                BaseCommitSha = baseCommitSha,
+            };
+        }
 
         // report dependencies
         var discoveredUpdatedDependencies = GetUpdatedDependencyListFromDiscovery(discoveryResult, repoContentsPath.FullName);
@@ -201,17 +210,30 @@ public class RunWorker
 
             var dependencyInfo = GetDependencyInfo(job, dependency);
             var analysisResult = await _analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
-            // TODO: log analysisResult
+            _logger.Info("Analysis content:");
+            _logger.Info(JsonSerializer.Serialize(analysisResult, AnalyzeWorker.SerializerOptions));
+
+            if (analysisResult.Error is not null)
+            {
+                await _apiHandler.RecordUpdateJobError(analysisResult.Error);
+                continue;
+            }
+
             if (analysisResult.CanUpdate)
             {
                 if (!job.UpdatingAPullRequest)
                 {
-                    var existingPullRequest = job.GetExistingPullRequestForDependency(analysisResult.UpdatedDependencies.First(d => d.Name.Equals(dependency.Name, StringComparison.OrdinalIgnoreCase)));
-                    if (existingPullRequest is not null)
+                    var updatedDependencyFromAnalysis = analysisResult.UpdatedDependencies
+                        .FirstOrDefault(d => d.Name.Equals(dependency.Name, StringComparison.OrdinalIgnoreCase));
+                    if (updatedDependencyFromAnalysis is not null)
                     {
-                        await SendApiMessage(new PullRequestExistsForLatestVersion(dependency.Name, analysisResult.UpdatedVersion));
-                        unhandledPullRequestDependenciesSet.RemoveWhere(handled => handled.Count == 1 && handled.Contains(dependency.Name));
-                        continue;
+                        var existingPullRequest = job.GetExistingPullRequestForDependency(updatedDependencyFromAnalysis);
+                        if (existingPullRequest is not null)
+                        {
+                            await SendApiMessage(new PullRequestExistsForLatestVersion(dependency.Name, analysisResult.UpdatedVersion));
+                            unhandledPullRequestDependenciesSet.RemoveWhere(handled => handled.Count == 1 && handled.Contains(dependency.Name));
+                            continue;
+                        }
                     }
                 }
 
@@ -240,8 +262,11 @@ public class RunWorker
                 };
 
                 var updateResult = await _updaterWorker.RunAsync(repoContentsPath.FullName, updateOperation.ProjectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, isTransitive: dependency.IsTransitive);
-                // TODO: need to report if anything was actually updated
-                if (updateResult.Error is null)
+                if (updateResult.Error is not null)
+                {
+                    await _apiHandler.RecordUpdateJobError(updateResult.Error);
+                }
+                else
                 {
                     actualUpdatedDependencies.Add(updatedDependency);
                 }
@@ -365,10 +390,15 @@ public class RunWorker
 
     private async Task SendApiMessage(MessageBase? message)
     {
+        if (message is null)
+        {
+            return;
+        }
+
+        var report = message.GetReport();
+        _logger.Info(report);
         switch (message)
         {
-            case null:
-                break;
             case JobErrorBase error:
                 await _apiHandler.RecordUpdateJobError(error);
                 break;

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackageReferenceUpdater.cs

@@ -1,5 +1,6 @@
 using System.Collections.Immutable;
 using System.Text.Json;
+using System.Text.RegularExpressions;
 
 using Microsoft.Language.Xml;
 
@@ -526,7 +527,7 @@ internal static class PackageReferenceUpdater
     /// <returns>The updated files.</returns>
     private static async Task<IEnumerable<string>> AddTransitiveDependencyAsync(string repoRootPath, string projectPath, string dependencyName, string newDependencyVersion, ExperimentsManager experimentsManager, ILogger logger)
     {
-        var updatedFiles = new[] { projectPath }; // assume this worked unless...
+        var updatedFiles = new List<string>() { projectPath }; // assume this worked unless...
         var projectDirectory = Path.GetDirectoryName(projectPath)!;
         await MSBuildHelper.HandleGlobalJsonAsync(projectDirectory, repoRootPath, experimentsManager, async () =>
         {
@@ -545,6 +546,17 @@ internal static class PackageReferenceUpdater
                 updatedFiles = [];
             }
 
+            // output might contain a line like this:
+            //   info : PackageReference for package 'Some.Package' added to 'C:\project.csproj' and PackageVersion added to central package management file 'C:\Directory.Packages.props'.
+            // we explicitly want to pull out this:                                                                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
+            // so we can report all files updated on disk
+            var match = Regex.Match(stdout, @"added to central package management file '(?<CentralPackageManagementFilePath>[^']+)'");
+            if (match.Success)
+            {
+                var cpmFilePath = match.Groups["CentralPackageManagementFilePath"].Value;
+                updatedFiles.Add(cpmFilePath);
+            }
+
             return exitCode;
         }, logger, retainMSBuildSdks: true);
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/UpdateOperationBase.cs

@@ -29,8 +29,7 @@ public abstract record UpdateOperationBase
             return string.Empty;
         }
 
-        var separator = "\n    ";
-        var report = $"Performed the following updates:{separator}{string.Join(separator, updateMessages.Select(m => $"- {m}"))}";
+        var report = $"Performed the following updates:\n{string.Join("\n", updateMessages.Select(m => $"- {m}"))}";
         return report;
     }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/DependencyConflictResolver.cs

@@ -465,11 +465,8 @@ public class PackageManager
                             NuGetVersion latestVersion = versions.Where(v => !v.IsPrerelease).Max();
 
                             // Loop from the current version to the latest version, use next patch as a limit (unless there's a limit) so it doesn't look for versions that don't exist
-                            for (NuGetVersion version = currentVersionParent; version <= latestVersion; version = NextPatch(version, versions))
+                            for (NuGetVersion? version = currentVersionParent; version is not null && version <= latestVersion; version = NextPatch(version, versions))
                             {
-                                string parentVersion = version.ToString();
-                                parent.NewVersion = parentVersion;
-
                                 // Check if the parent needs to be updated since the child isn't in the existing package list  and the parent can update to a newer version to remove the dependency
                                 List<PackageToUpdate> dependencyListParentTemp = await GetDependenciesAsync(parent, targetFramework, projectDirectory, logger);
                                 PackageToUpdate parentDependencyTemp = dependencyListParentTemp.FirstOrDefault(p => string.Compare(p.PackageName, package.PackageName, StringComparison.OrdinalIgnoreCase) == 0);
@@ -477,7 +474,7 @@ public class PackageManager
                                 // If the newer package version of the parent has the same version as the parent's previous dependency, update
                                 if (parentDependencyTemp.CurrentVersion == package.CurrentVersion)
                                 {
-                                    parent.NewVersion = parentVersion;
+                                    parent.NewVersion = version.ToString();
                                     parent.CurrentVersion = null;
                                     await UpdateVersion(existingPackages, parent, targetFramework, projectDirectory, logger);
                                     package.IsSpecific = true;
@@ -534,18 +531,10 @@ public class PackageManager
     }
 
     // Method to update a version to the next available version for a package
-    public NuGetVersion NextPatch(NuGetVersion version, IEnumerable<NuGetVersion> allVersions)
+    private static NuGetVersion? NextPatch(NuGetVersion version, IEnumerable<NuGetVersion> allVersions)
     {
-        var versions = allVersions.Where(v => v > version);
-
-        if (!versions.Any())
-        {
-            // If there are no greater versions, return current version
-            return version;
-        }
-
-        // Find smallest version in the versions
-        return versions.Min();
+        var candidateVersions = allVersions.Where(v => v > version).ToArray();
+        return candidateVersions.Min();
     }
 
     // Method to find a compatible version with the child for the parent to update to
@@ -588,18 +577,10 @@ public class PackageManager
         }
 
         // Loop from the current version to the latest version, use next patch as a limit (unless there's a limit) so it doesn't look for versions that don't exist
-        for (NuGetVersion version = CurrentVersion; version <= latestVersion; version = NextPatch(version, versions))
+        for (NuGetVersion? version = CurrentVersion; version is not null && version <= latestVersion; version = NextPatch(version, versions))
         {
             possibleParent.NewVersion = version.ToString();
 
-            NuGetVersion nextPatch = NextPatch(version, versions);
-
-            // If the next patch is the same as the CurrentVersion, then nothing is needed
-            if (nextPatch == version)
-            {
-                return nextPatch;
-            }
-
             // Check if there's compatibility with parent and dependency
             if (await IsCompatibleAsync(possibleParent, possibleDependency, targetFramework, nugetContext.CurrentDirectory, logger))
             {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -1029,11 +1029,23 @@ internal static partial class MSBuildHelper
             new Regex(@"Unable to find package (?<PackageName>[^ ]+)\. No packages exist with this id in source\(s\): (?<PackageSource>.*)$", RegexOptions.Multiline),
             new Regex(@"Unable to find package (?<PackageName>[^ ]+) with version \((?<PackageVersion>[^)]+)\)"),
             new Regex(@"Could not resolve SDK ""(?<PackageName>[^ ]+)""\."),
+            new Regex(@"Failed to fetch results from V2 feed at '.*FindPackagesById\(\)\?id='(?<PackageName>[^']+)'&semVerLevel=2\.0\.0' with following message : Response status code does not indicate success: 404\."),
         };
         var matches = patterns.Select(p => p.Match(output)).Where(m => m.Success);
         if (matches.Any())
         {
-            var packages = matches.Select(m => m.Groups["PackageName"].Value).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
+            var packages = matches.Select(m =>
+                {
+                    var packageName = m.Groups["PackageName"].Value;
+                    if (m.Groups.TryGetValue("PackageVersion", out var versionGroup))
+                    {
+                        packageName = $"{packageName}/{versionGroup.Value}";
+                    }
+
+                    return packageName;
+                })
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToArray();
             throw new DependencyNotFoundException(packages);
         }
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/VersionFinderTests.cs

@@ -1,9 +1,12 @@
 using System.Collections.Immutable;
+using System.Text.Json;
 
 using NuGet.Frameworks;
 using NuGet.Versioning;
 
 using NuGetUpdater.Core.Analyze;
+using NuGetUpdater.Core.Run;
+using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Test.Update;
 using NuGetUpdater.Core.Test.Utilities;
 
@@ -11,7 +14,7 @@ using Xunit;
 
 namespace NuGetUpdater.Core.Test.Analyze;
 
-public class VersionFinderTests
+public class VersionFinderTests : TestBase
 {
     [Fact]
     public void VersionFilter_VersionInIgnoredVersions_ReturnsFalse()
@@ -223,4 +226,74 @@ public class VersionFinderTests
         var expected = new[] { "2.0.0" };
         AssertEx.Equal(expected, actual);
     }
+
+    [Fact]
+    public async Task FeedReturnsBadJson()
+    {
+        // arrange
+        using var http = TestHttpServer.CreateTestStringServer(url =>
+        {
+            var uri = new Uri(url, UriKind.Absolute);
+            var baseUrl = $"{uri.Scheme}://{uri.Host}:{uri.Port}";
+            return uri.PathAndQuery switch
+            {
+                // initial and search query are good, update should be possible...
+                "/index.json" => (200, $$"""
+                    {
+                        "version": "3.0.0",
+                        "resources": [
+                            {
+                                "@id": "{{baseUrl}}/download",
+                                "@type": "PackageBaseAddress/3.0.0"
+                            },
+                            {
+                                "@id": "{{baseUrl}}/query",
+                                "@type": "SearchQueryService"
+                            },
+                            {
+                                "@id": "{{baseUrl}}/registrations",
+                                "@type": "RegistrationsBaseUrl"
+                            }
+                        ]
+                    }
+                    """),
+                _ => (200, "") // empty string instead of expected JSON object
+            };
+        });
+        var feedUrl = $"{http.BaseUrl.TrimEnd('/')}/index.json";
+        using var tempDir = await TemporaryDirectory.CreateWithContentsAsync(
+            ("NuGet.Config", $"""
+                <configuration>
+                  <packageSources>
+                    <clear />
+                    <add key="private_feed" value="{feedUrl}" allowInsecureConnections="true" />
+                  </packageSources>
+                </configuration>
+                """)
+        );
+
+        // act
+        var tfm = NuGetFramework.Parse("net9.0");
+        var dependencyInfo = new DependencyInfo
+        {
+            Name = "Some.Dependency",
+            Version = "1.0.0",
+            IsVulnerable = false,
+            IgnoredVersions = [],
+            Vulnerabilities = [],
+        };
+        var logger = new TestLogger();
+        var nugetContext = new NuGetContext(tempDir.DirectoryPath);
+        var exception = await Assert.ThrowsAsync<BadResponseException>(async () =>
+        {
+            await VersionFinder.GetVersionsAsync([tfm], dependencyInfo, nugetContext, logger, CancellationToken.None);
+        });
+        var error = JobErrorBase.ErrorFromException(exception, "TEST-JOB-ID", tempDir.DirectoryPath);
+
+        // assert
+        var expected = new PrivateSourceBadResponse([feedUrl]);
+        var expectedJson = JsonSerializer.Serialize(expected, RunWorker.SerializerOptions);
+        var actualJson = JsonSerializer.Serialize(error, RunWorker.SerializerOptions);
+        Assert.Equal(expectedJson, actualJson);
+    }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Clone/CloneWorkerTests.cs

@@ -111,7 +111,7 @@ public class CloneWorkerTests
 
         // assert
         Assert.Equal(1, result);
-        var expectedParseErrorObject = testApiHandler.ReceivedMessages.Single(m => m.Type == typeof(UnknownError));
+        var expectedParseErrorObject = testApiHandler.ReceivedMessages.First(m => m.Type == typeof(UnknownError));
         var unknownError = (UnknownError)expectedParseErrorObject.Object;
         Assert.Equal("JsonException", unknownError.Details["error-class"]);
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.Project.cs

@@ -832,10 +832,8 @@ public partial class DiscoveryWorkerTests
                         {
                             FilePath = "myproj.csproj",
                             Dependencies = [
-                                new("Some.Package", "1.2.3.4", DependencyType.PackageReference, TargetFrameworks: ["net7.0"], IsDirect: true),
-                                new("Some.Package", "1.2.3.4", DependencyType.PackageReference, TargetFrameworks: ["net8.0"], IsDirect: true),
-                                new("Transitive.Dependency", "5.6.7.8", DependencyType.Unknown, TargetFrameworks: ["net7.0"], IsTransitive: true),
-                                new("Transitive.Dependency", "5.6.7.8", DependencyType.Unknown, TargetFrameworks: ["net8.0"], IsTransitive: true),
+                                new("Some.Package", "1.2.3.4", DependencyType.PackageReference, TargetFrameworks: ["net7.0", "net8.0"], IsDirect: true),
+                                new("Transitive.Dependency", "5.6.7.8", DependencyType.Unknown, TargetFrameworks: ["net7.0", "net8.0"], IsTransitive: true),
                             ],
                             Properties = [
                                 new("TargetFrameworks", "net7.0;net8.0", "myproj.csproj"),
@@ -1191,11 +1189,7 @@ public partial class DiscoveryWorkerTests
                         {
                             FilePath = "project.csproj",
                             Dependencies = [
-                                new("Some.Package", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net8.0-android"], IsDirect: true),
-                                new("Some.Package", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net8.0-ios"], IsDirect: true),
-                                new("Some.Package", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net8.0-maccatalyst"], IsDirect: true),
-                                new("Some.Package", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net8.0-macos"], IsDirect: true),
-                                new("Some.Package", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net8.0-windows"], IsDirect: true),
+                                new("Some.Package", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net8.0-android", "net8.0-ios", "net8.0-maccatalyst", "net8.0-macos", "net8.0-windows"], IsDirect: true),
                             ],
                             Properties = [
                                 new("TargetFrameworks", "net8.0-ios;net8.0-android;net8.0-macos;net8.0-maccatalyst;net8.0-windows", @"src/project.csproj"),

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs

@@ -27,7 +27,7 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
         {
             // this package ships with the SDK and is automatically added for F# projects but should be manually added here to make the test consistent
             // only direct package discovery finds this, though
-            expectedDependencies.Add(new Dependency("FSharp.Core", "9.0.100", DependencyType.PackageReference, TargetFrameworks: ["net8.0"], IsDirect: true));
+            expectedDependencies.Add(new Dependency("FSharp.Core", MockNuGetPackage.FSharpCorePackageVersion.Value, DependencyType.PackageReference, TargetFrameworks: ["net8.0"], IsDirect: true));
         }
 
         var experimentsManager = new ExperimentsManager() { UseDirectDiscovery = useDirectDiscovery };
@@ -673,8 +673,7 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
                         FilePath = "src/project.csproj",
                         TargetFrameworks = ["net7.0", "net8.0"],
                         Dependencies = [
-                            new("Some.Package", "9.0.1", DependencyType.PackageReference, TargetFrameworks: ["net7.0"], IsDirect: true),
-                            new("Some.Package", "9.0.1", DependencyType.PackageReference, TargetFrameworks: ["net8.0"], IsDirect: true),
+                            new("Some.Package", "9.0.1", DependencyType.PackageReference, TargetFrameworks: ["net7.0", "net8.0"], IsDirect: true),
                         ],
                         Properties = [
                             new("TargetFrameworks", "net7.0;net8.0", "src/project.csproj")
@@ -1559,7 +1558,7 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
             {
                 Path = "",
                 Projects = [],
-                Error = new DependencyNotFound("Transitive.Dependency"),
+                Error = new DependencyNotFound("Transitive.Dependency/>= 4.5.6"),
             }
         );
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/SdkProjectDiscoveryTests.cs

@@ -1,4 +1,5 @@
 using System.Collections.Immutable;
+using System.Text;
 
 using NuGetUpdater.Core.Discover;
 using NuGetUpdater.Core.Test.Update;
@@ -297,8 +298,7 @@ public class SdkProjectDiscoveryTests : DiscoveryWorkerTestBase
                     FilePath = "library.csproj",
                     Dependencies =
                     [
-                        new("Some.Dependency", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net7.0"], IsDirect: true),
-                        new("Some.Dependency", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net8.0"], IsDirect: true),
+                        new("Some.Dependency", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net7.0", "net8.0"], IsDirect: true),
                     ],
                     ImportedFiles = [],
                     Properties =
@@ -524,6 +524,62 @@ public class SdkProjectDiscoveryTests : DiscoveryWorkerTestBase
         );
     }
 
+    [Fact]
+    public async Task TransitiveDependenciesWithoutAssembliesAreReported()
+    {
+        await TestDiscoverAsync(
+            packages:
+            [
+                MockNuGetPackage.CreateSimplePackage("Some.Dependency", "1.2.3", "net9.0", [(null, [("Transitive.Dependency", "4.5.6")])]),
+                new MockNuGetPackage(
+                    "Transitive.Dependency",
+                    "4.5.6",
+                    Files: [
+                        ("build/Transitive.Dependency.targets", Encoding.UTF8.GetBytes("<Project />"))
+                    ],
+                    DependencyGroups: [(null, [("Super.Transitive.Dependency", "7.8.9")])]
+                ),
+                MockNuGetPackage.CreateSimplePackage("Super.Transitive.Dependency", "7.8.9", "net9.0"),
+            ],
+            startingDirectory: "src",
+            projectPath: "src/library.csproj",
+            files:
+            [
+                ("src/library.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net9.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Dependency" Version="1.2.3" />
+                      </ItemGroup>
+                    </Project>
+                    """)
+            ],
+            expectedProjects:
+            [
+                new()
+                {
+                    FilePath = "library.csproj",
+                    Dependencies =
+                    [
+                        new("Some.Dependency", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net9.0"], IsDirect: true),
+                        new("Transitive.Dependency", "4.5.6", DependencyType.Unknown, TargetFrameworks: ["net9.0"], IsTransitive: true),
+                        new("Super.Transitive.Dependency", "7.8.9", DependencyType.Unknown, TargetFrameworks: ["net9.0"], IsTransitive: true),
+                    ],
+                    ImportedFiles = [],
+                    Properties =
+                    [
+                        new("TargetFramework", "net9.0", "src/library.csproj"),
+                    ],
+                    TargetFrameworks = ["net9.0"],
+                    ReferencedProjectPaths = [],
+                    AdditionalFiles = [],
+                },
+            ]
+        );
+    }
+
     private static async Task TestDiscoverAsync(string startingDirectory, string projectPath, TestFile[] files, ImmutableArray<ExpectedSdkProjectDiscoveryResult> expectedProjects, MockNuGetPackage[]? packages = null)
     {
         using var testDirectory = await TemporaryDirectory.CreateWithContentsAsync(files);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/MockNuGetPackage.cs

@@ -346,6 +346,15 @@ namespace NuGetUpdater.Core.Test
             }
         });
 
+        public static readonly Lazy<string> FSharpCorePackageVersion = new(() =>
+        {
+            var fsharpPropsPath = Path.Combine(Path.GetDirectoryName(BundledVersionsPropsPath.Value)!, "FSharp", "Microsoft.FSharp.Core.NetSdk.props");
+            var fsharpPropsDocument = XDocument.Load(fsharpPropsPath);
+            var fsharpCoreVersionElement = fsharpPropsDocument.XPathSelectElement("//*[name()='FSCorePackageVersion']")!;
+            var fsharpCoreVersion = fsharpCoreVersionElement.Value;
+            return fsharpCoreVersion;
+        });
+
         private static readonly Dictionary<string, MockNuGetPackage> WellKnownPackages = new();
         public static MockNuGetPackage WellKnownReferencePackage(string packageName, string targetFramework, (string Path, byte[] Content)[]? files = null)
         {
@@ -370,7 +379,7 @@ namespace NuGetUpdater.Core.Test
                 }
 
                 string expectedVersion = matchingFrameworkElement.Attribute("TargetingPackVersion")!.Value;
-                return new(
+                WellKnownPackages[key] = new MockNuGetPackage(
                     $"{packageName}.Ref",
                     expectedVersion,
                     AdditionalMetadata:
@@ -440,6 +449,33 @@ namespace NuGetUpdater.Core.Test
             return WellKnownPackages[key];
         }
 
+        public static MockNuGetPackage WellKnownWindowsSdkRefPackage(string windowsSdkVersion)
+        {
+            var packageName = "Microsoft.Windows.SDK.NET.Ref";
+            var key = $"{packageName}/{windowsSdkVersion}";
+            if (!WellKnownPackages.ContainsKey(key))
+            {
+                var propsDocument = XDocument.Load(BundledVersionsPropsPath.Value);
+                var sdkTpmElement = propsDocument.XPathSelectElement($"/Project/ItemGroup/WindowsSdkSupportedTargetPlatformVersion[@Include='{windowsSdkVersion}']")!;
+                var packageVersion = sdkTpmElement.Attribute("WindowsSdkPackageVersion")!.Value!;
+                var package = new MockNuGetPackage(packageName, packageVersion, Files: [
+                    ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
+                        <FileList Name="Windows SDK .NET 6.0">
+                          <!-- contents omitted -->
+                        </FileList>
+                        """)),
+                    ("data/RuntimeList.xml", Encoding.UTF8.GetBytes("""
+                        <FileList Name="Windows SDK .NET 6.0" TargetFrameworkIdentifier=".NETCoreApp" TargetFrameworkVersion="6.0" FrameworkName="Microsoft.Windows.SDK.NET.Ref">
+                          <!-- contents omitted -->
+                        </FileList>
+                        """))
+                ]);
+                WellKnownPackages[key] = package;
+            }
+
+            return WellKnownPackages[key];
+        }
+
         public static MockNuGetPackage[] CommonPackages { get; } =
         [
             CreateSimplePackage("NETStandard.Library", "2.0.3", "netstandard2.0"),
@@ -456,7 +492,6 @@ namespace NuGetUpdater.Core.Test
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net7.0"),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net8.0"),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net9.0"),
-            WellKnownHostPackage("Microsoft.NETCore.App", "net8.0"),
         ];
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/NuGetUpdater.Core.Test.csproj

@@ -13,7 +13,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
-    <PackageReference Include="xunit" />
+    <PackageReference Include="xunit.v3" />
     <PackageReference Include="xunit.runner.visualstudio" />
   </ItemGroup>