dependabot-nuget 0.315.0 → 0.316.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/CreateSecurityUpdatePullRequestHandler.cs

@@ -0,0 +1,169 @@
+using NuGet.Versioning;
+
+using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Updater;
+
+namespace NuGetUpdater.Core.Run.UpdateHandlers;
+
+internal class CreateSecurityUpdatePullRequestHandler : IUpdateHandler
+{
+    public static IUpdateHandler Instance { get; } = new CreateSecurityUpdatePullRequestHandler();
+
+    public string TagName => "create_security_pr";
+
+    public bool CanHandle(Job job)
+    {
+        // only use this handler if we're creating a new security PR with an explicit list of dependencies
+        if (job.UpdatingAPullRequest)
+        {
+            return false;
+        }
+
+        if (job.Dependencies.Length == 0)
+        {
+            return false;
+        }
+
+        return job.SecurityUpdatesOnly;
+    }
+
+    public async Task HandleAsync(Job job, DirectoryInfo repoContentsPath, string baseCommitSha, IDiscoveryWorker discoveryWorker, IAnalyzeWorker analyzeWorker, IUpdaterWorker updaterWorker, IApiHandler apiHandler, ExperimentsManager experimentsManager, ILogger logger)
+    {
+        var jobDependencies = job.Dependencies.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        foreach (var directory in job.GetAllDirectories())
+        {
+            var discoveryResult = await discoveryWorker.RunAsync(repoContentsPath.FullName, directory);
+            logger.ReportDiscovery(discoveryResult);
+            if (discoveryResult.Error is not null)
+            {
+                await apiHandler.RecordUpdateJobError(discoveryResult.Error);
+                return;
+            }
+
+            var updatedDependencyList = RunWorker.GetUpdatedDependencyListFromDiscovery(discoveryResult);
+            await apiHandler.UpdateDependencyList(updatedDependencyList);
+            await this.ReportUpdaterStarted(apiHandler);
+
+            var updateOperationsPerformed = new List<UpdateOperationBase>();
+            var updatedDependencies = new List<ReportedDependency>();
+            var updateOperationsToPerform = RunWorker.GetUpdateOperations(discoveryResult).ToArray();
+            var groupedUpdateOperationsToPerform = updateOperationsToPerform
+                .GroupBy(o => o.Dependency.Name, StringComparer.OrdinalIgnoreCase)
+                .Where(g => jobDependencies.Contains(g.Key))
+                .ToDictionary(g => g.Key, g => g.ToArray(), StringComparer.OrdinalIgnoreCase);
+
+            if (groupedUpdateOperationsToPerform.Count == 0)
+            {
+                await apiHandler.RecordUpdateJobError(new SecurityUpdateDependencyNotFound());
+                continue;
+            }
+
+            logger.Info($"Updating dependencies: {string.Join(", ", groupedUpdateOperationsToPerform.Select(g => g.Key).Distinct().OrderBy(d => d, StringComparer.OrdinalIgnoreCase))}");
+
+            var tracker = new ModifiedFilesTracker(repoContentsPath);
+            await tracker.StartTrackingAsync(discoveryResult);
+            foreach (var dependencyGroupToUpdate in groupedUpdateOperationsToPerform)
+            {
+                var dependencyName = dependencyGroupToUpdate.Key;
+                var vulnerableDependenciesToUpdate = dependencyGroupToUpdate.Value
+                    .Select(o => (o.ProjectPath, o.Dependency, RunWorker.GetDependencyInfo(job, o.Dependency)))
+                    .Where(set => set.Item3.IsVulnerable)
+                    .ToArray();
+                if (vulnerableDependenciesToUpdate.Length == 0)
+                {
+                    await apiHandler.RecordUpdateJobError(new SecurityUpdateNotNeeded(dependencyName));
+                    continue;
+                }
+
+                foreach (var (projectPath, dependency, dependencyInfo) in vulnerableDependenciesToUpdate)
+                {
+                    var analysisResult = await analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
+                    if (analysisResult.Error is not null)
+                    {
+                        logger.Error($"Error analyzing {dependency.Name} in {projectPath}: {analysisResult.Error.GetReport()}");
+                        await apiHandler.RecordUpdateJobError(analysisResult.Error);
+                        return;
+                    }
+
+                    if (!analysisResult.CanUpdate)
+                    {
+                        logger.Info($"No updatable version found for {dependency.Name} in {projectPath}.");
+                        await apiHandler.RecordUpdateJobError(new SecurityUpdateNotFound(dependency.Name, dependency.Version!));
+                        continue;
+                    }
+
+                    if (dependencyInfo.IgnoredVersions.Any(ignored => ignored.IsSatisfiedBy(NuGetVersion.Parse(analysisResult.UpdatedVersion))) ||
+                        job.IsDependencyIgnored(dependency.Name, dependency.Version!))
+                    {
+                        logger.Error($"Cannot update {dependency.Name} for {projectPath} because all versions are ignored.");
+                        await apiHandler.RecordUpdateJobError(new SecurityUpdateIgnored(dependencyName));
+                        continue;
+                    }
+
+                    logger.Info($"Attempting update of {dependency.Name} from {dependency.Version} to {analysisResult.UpdatedVersion} for {projectPath}.");
+                    var projectDiscovery = discoveryResult.GetProjectDiscoveryFromPath(projectPath);
+                    var updaterResult = await updaterWorker.RunAsync(repoContentsPath.FullName, projectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, dependency.IsTransitive);
+                    if (updaterResult.Error is not null)
+                    {
+                        logger.Error($"Error updating {dependency.Name} in {projectPath}: {updaterResult.Error.GetReport()}");
+                        await apiHandler.RecordUpdateJobError(updaterResult.Error);
+                        continue;
+                    }
+
+                    if (updaterResult.UpdateOperations.Length == 0)
+                    {
+                        // nothing was done, but we may have already handled it
+                        var alreadyHandled = updatedDependencies.Where(updated => updated.Name == dependencyName && updated.Version == analysisResult.UpdatedVersion).Any();
+                        if (!alreadyHandled)
+                        {
+                            logger.Error($"Update of {dependency.Name} in {projectPath} not possible.");
+                            await apiHandler.RecordUpdateJobError(new SecurityUpdateNotPossible(dependencyName, analysisResult.UpdatedVersion, analysisResult.UpdatedVersion, []));
+                            return;
+                        }
+                    }
+
+                    var patchedUpdateOperations = RunWorker.PatchInOldVersions(updaterResult.UpdateOperations, projectDiscovery);
+                    var updatedDependenciesForThis = patchedUpdateOperations
+                        .Select(o => o.ToReportedDependency(projectPath, updatedDependencyList.Dependencies, analysisResult.UpdatedDependencies))
+                        .ToArray();
+
+                    updatedDependencies.AddRange(updatedDependenciesForThis);
+                    updateOperationsPerformed.AddRange(patchedUpdateOperations);
+                    foreach (var o in patchedUpdateOperations)
+                    {
+                        logger.Info($"Update operation performed: {o.GetReport()}");
+                    }
+                }
+            }
+
+            var updatedDependencyFiles = await tracker.StopTrackingAsync();
+            var rawDependencies = updatedDependencies.Select(d => new Dependency(d.Name, d.Version, DependencyType.Unknown)).ToArray();
+            if (rawDependencies.Length > 0)
+            {
+                var existingPullRequest = job.GetExistingPullRequestForDependencies(rawDependencies, considerVersions: true);
+                if (existingPullRequest is not null)
+                {
+                    await apiHandler.RecordUpdateJobError(new PullRequestExistsForSecurityUpdate(rawDependencies));
+                    continue;
+                }
+            }
+
+            if (updatedDependencyFiles.Length > 0)
+            {
+                var commitMessage = PullRequestTextGenerator.GetPullRequestCommitMessage(job, [.. updateOperationsPerformed], null);
+                var prTitle = PullRequestTextGenerator.GetPullRequestTitle(job, [.. updateOperationsPerformed], null);
+                var prBody = PullRequestTextGenerator.GetPullRequestBody(job, [.. updateOperationsPerformed], null);
+                await apiHandler.CreatePullRequest(new CreatePullRequest()
+                {
+                    Dependencies = [.. updatedDependencies],
+                    UpdatedDependencyFiles = [.. updatedDependencyFiles],
+                    BaseCommitSha = baseCommitSha,
+                    CommitMessage = commitMessage,
+                    PrTitle = prTitle,
+                    PrBody = prBody,
+                    DependencyGroup = null,
+                });
+            }
+        }
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/GroupUpdateAllVersionsHandler.cs

@@ -0,0 +1,271 @@
+using System.Collections.Immutable;
+
+using NuGet.Versioning;
+
+using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Updater;
+
+namespace NuGetUpdater.Core.Run.UpdateHandlers;
+
+internal class GroupUpdateAllVersionsHandler : IUpdateHandler
+{
+    public static IUpdateHandler Instance { get; } = new GroupUpdateAllVersionsHandler();
+
+    public string TagName => "group_update_all_versions";
+
+    public bool CanHandle(Job job)
+    {
+        if (job.UpdatingAPullRequest)
+        {
+            return false;
+        }
+
+        if (job.SecurityUpdatesOnly)
+        {
+            if (job.Dependencies.Length > 1)
+            {
+                return true;
+            }
+
+            if (job.DependencyGroups.Any(g => g.IsSecurity()))
+            {
+                return true;
+            }
+
+            return false;
+        }
+
+        return true;
+    }
+
+    public async Task HandleAsync(Job job, DirectoryInfo repoContentsPath, string baseCommitSha, IDiscoveryWorker discoveryWorker, IAnalyzeWorker analyzeWorker, IUpdaterWorker updaterWorker, IApiHandler apiHandler, ExperimentsManager experimentsManager, ILogger logger)
+    {
+        // group update, do all directories and merge
+        // ungrouped update, do each dir separate
+        await this.ReportUpdaterStarted(apiHandler);
+        if (job.DependencyGroups.Length > 0)
+        {
+            await RunGroupedDependencyUpdates(job, repoContentsPath, baseCommitSha, discoveryWorker, analyzeWorker, updaterWorker, apiHandler, experimentsManager, logger);
+        }
+        else
+        {
+            await RunUngroupedDependencyUpdates(job, repoContentsPath, baseCommitSha, discoveryWorker, analyzeWorker, updaterWorker, apiHandler, experimentsManager, logger);
+        }
+    }
+
+    private async Task RunGroupedDependencyUpdates(Job job, DirectoryInfo repoContentsPath, string baseCommitSha, IDiscoveryWorker discoveryWorker, IAnalyzeWorker analyzeWorker, IUpdaterWorker updaterWorker, IApiHandler apiHandler, ExperimentsManager experimentsManager, ILogger logger)
+    {
+        foreach (var group in job.DependencyGroups)
+        {
+            logger.Info($"Starting update for group {group.Name}");
+            var groupMatcher = group.GetGroupMatcher();
+            var updateOperationsPerformed = new List<UpdateOperationBase>();
+            var updatedDependencies = new List<ReportedDependency>();
+            var allUpdatedDependencyFiles = ImmutableArray.Create<DependencyFile>();
+            foreach (var directory in job.GetAllDirectories())
+            {
+                var discoveryResult = await discoveryWorker.RunAsync(repoContentsPath.FullName, directory);
+                logger.ReportDiscovery(discoveryResult);
+                if (discoveryResult.Error is not null)
+                {
+                    await apiHandler.RecordUpdateJobError(discoveryResult.Error);
+                    return;
+                }
+
+                var tracker = new ModifiedFilesTracker(repoContentsPath);
+                await tracker.StartTrackingAsync(discoveryResult);
+
+                var updatedDependencyList = RunWorker.GetUpdatedDependencyListFromDiscovery(discoveryResult);
+                await apiHandler.UpdateDependencyList(updatedDependencyList);
+
+                var updateOperationsToPerform = RunWorker.GetUpdateOperations(discoveryResult).ToArray();
+                foreach (var (projectPath, dependency) in updateOperationsToPerform)
+                {
+                    if (!job.IsUpdatePermitted(dependency))
+                    {
+                        continue;
+                    }
+
+                    if (!groupMatcher.IsMatch(dependency.Name))
+                    {
+                        continue;
+                    }
+
+                    if (job.IsDependencyIgnored(dependency.Name, dependency.Version!))
+                    {
+                        logger.Info($"Skipping ignored dependency {dependency.Name}/{dependency.Version}.");
+                        continue;
+                    }
+
+                    var dependencyInfo = RunWorker.GetDependencyInfo(job, dependency);
+                    var analysisResult = await analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
+                    if (analysisResult.Error is not null)
+                    {
+                        logger.Error($"Error analyzing {dependency.Name} in {projectPath}: {analysisResult.Error.GetReport()}");
+                        await apiHandler.RecordUpdateJobError(analysisResult.Error);
+                        return;
+                    }
+
+                    if (!analysisResult.CanUpdate)
+                    {
+                        logger.Info($"No updatable version found for {dependency.Name} in {projectPath}.");
+                        continue;
+                    }
+
+                    if (dependencyInfo.IgnoredVersions.Any(ignored => ignored.IsSatisfiedBy(NuGetVersion.Parse(analysisResult.UpdatedVersion))))
+                    {
+                        logger.Info($"Cannot update {dependency.Name} for {projectPath} because all versions are ignored.");
+                        continue;
+                    }
+
+                    var projectDiscovery = discoveryResult.GetProjectDiscoveryFromPath(projectPath);
+                    var updaterResult = await updaterWorker.RunAsync(repoContentsPath.FullName, projectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, dependency.IsTransitive);
+                    if (updaterResult.Error is not null)
+                    {
+                        logger.Error($"Error updating {dependency.Name} in {projectPath}: {updaterResult.Error.GetReport()}");
+                        await apiHandler.RecordUpdateJobError(updaterResult.Error);
+                        continue;
+                    }
+
+                    if (updaterResult.UpdateOperations.Length == 0)
+                    {
+                        continue;
+                    }
+
+                    var patchedUpdateOperations = RunWorker.PatchInOldVersions(updaterResult.UpdateOperations, projectDiscovery);
+                    var updatedDependenciesForThis = patchedUpdateOperations
+                        .Select(o => o.ToReportedDependency(projectPath, updatedDependencyList.Dependencies, analysisResult.UpdatedDependencies))
+                        .ToArray();
+
+                    updatedDependencies.AddRange(updatedDependenciesForThis);
+                    updateOperationsPerformed.AddRange(patchedUpdateOperations);
+                    foreach (var o in patchedUpdateOperations)
+                    {
+                        logger.Info($"Update operation performed: {o.GetReport()}");
+                    }
+                }
+
+                var updatedDependencyFiles = await tracker.StopTrackingAsync();
+                allUpdatedDependencyFiles = ModifiedFilesTracker.MergeUpdatedFileSet(allUpdatedDependencyFiles, updatedDependencyFiles);
+            }
+
+            if (updateOperationsPerformed.Count > 0)
+            {
+                var commitMessage = PullRequestTextGenerator.GetPullRequestCommitMessage(job, [.. updateOperationsPerformed], group.Name);
+                var prTitle = PullRequestTextGenerator.GetPullRequestTitle(job, [.. updateOperationsPerformed], group.Name);
+                var prBody = PullRequestTextGenerator.GetPullRequestBody(job, [.. updateOperationsPerformed], group.Name);
+                await apiHandler.CreatePullRequest(new CreatePullRequest()
+                {
+                    Dependencies = [.. updatedDependencies],
+                    UpdatedDependencyFiles = [.. allUpdatedDependencyFiles],
+                    BaseCommitSha = baseCommitSha,
+                    CommitMessage = commitMessage,
+                    PrTitle = prTitle,
+                    PrBody = prBody,
+                    DependencyGroup = group.Name,
+                });
+            }
+        }
+    }
+
+    private async Task RunUngroupedDependencyUpdates(Job job, DirectoryInfo repoContentsPath, string baseCommitSha, IDiscoveryWorker discoveryWorker, IAnalyzeWorker analyzeWorker, IUpdaterWorker updaterWorker, IApiHandler apiHandler, ExperimentsManager experimentsManager, ILogger logger)
+    {
+        foreach (var directory in job.GetAllDirectories())
+        {
+            var discoveryResult = await discoveryWorker.RunAsync(repoContentsPath.FullName, directory);
+            logger.ReportDiscovery(discoveryResult);
+            if (discoveryResult.Error is not null)
+            {
+                await apiHandler.RecordUpdateJobError(discoveryResult.Error);
+                return;
+            }
+
+            var tracker = new ModifiedFilesTracker(repoContentsPath);
+            await tracker.StartTrackingAsync(discoveryResult);
+
+            var updatedDependencyList = RunWorker.GetUpdatedDependencyListFromDiscovery(discoveryResult);
+            await apiHandler.UpdateDependencyList(updatedDependencyList);
+
+            var updateOperationsPerformed = new List<UpdateOperationBase>();
+            var updatedDependencies = new List<ReportedDependency>();
+            var updateOperationsToPerform = RunWorker.GetUpdateOperations(discoveryResult).ToArray();
+            foreach (var (projectPath, dependency) in updateOperationsToPerform)
+            {
+                if (!job.IsUpdatePermitted(dependency))
+                {
+                    continue;
+                }
+
+                if (job.IsDependencyIgnored(dependency.Name, dependency.Version!))
+                {
+                    logger.Info($"Skipping ignored dependency {dependency.Name}/{dependency.Version}.");
+                    continue;
+                }
+
+                var dependencyInfo = RunWorker.GetDependencyInfo(job, dependency);
+                var analysisResult = await analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
+                if (analysisResult.Error is not null)
+                {
+                    logger.Error($"Error analyzing {dependency.Name} in {projectPath}: {analysisResult.Error.GetReport()}");
+                    await apiHandler.RecordUpdateJobError(analysisResult.Error);
+                    return;
+                }
+
+                if (!analysisResult.CanUpdate)
+                {
+                    logger.Info($"No updatable version found for {dependency.Name} in {projectPath}.");
+                    continue;
+                }
+
+                if (dependencyInfo.IgnoredVersions.Any(ignored => ignored.IsSatisfiedBy(NuGetVersion.Parse(analysisResult.UpdatedVersion))))
+                {
+                    logger.Info($"Cannot update {dependency.Name} for {projectPath} because all versions are ignored.");
+                    continue;
+                }
+
+                var projectDiscovery = discoveryResult.GetProjectDiscoveryFromPath(projectPath);
+                var updaterResult = await updaterWorker.RunAsync(repoContentsPath.FullName, projectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, dependency.IsTransitive);
+                if (updaterResult.Error is not null)
+                {
+                    await apiHandler.RecordUpdateJobError(updaterResult.Error);
+                    continue;
+                }
+
+                if (updaterResult.UpdateOperations.Length == 0)
+                {
+                    continue;
+                }
+
+                var patchedUpdateOperations = RunWorker.PatchInOldVersions(updaterResult.UpdateOperations, projectDiscovery);
+                var updatedDependenciesForThis = patchedUpdateOperations
+                    .Select(o => o.ToReportedDependency(projectPath, updatedDependencyList.Dependencies, analysisResult.UpdatedDependencies))
+                    .ToArray();
+
+                updatedDependencies.AddRange(updatedDependenciesForThis);
+                updateOperationsPerformed.AddRange(patchedUpdateOperations);
+                foreach (var o in patchedUpdateOperations)
+                {
+                    logger.Info($"Update operation performed: {o.GetReport()}");
+                }
+            }
+
+            var updatedDependencyFiles = await tracker.StopTrackingAsync();
+            if (updateOperationsPerformed.Count > 0)
+            {
+                var commitMessage = PullRequestTextGenerator.GetPullRequestCommitMessage(job, [.. updateOperationsPerformed], null);
+                var prTitle = PullRequestTextGenerator.GetPullRequestTitle(job, [.. updateOperationsPerformed], null);
+                var prBody = PullRequestTextGenerator.GetPullRequestBody(job, [.. updateOperationsPerformed], null);
+                await apiHandler.CreatePullRequest(new CreatePullRequest()
+                {
+                    Dependencies = [.. updatedDependencies],
+                    UpdatedDependencyFiles = [.. updatedDependencyFiles],
+                    BaseCommitSha = baseCommitSha,
+                    CommitMessage = commitMessage,
+                    PrTitle = prTitle,
+                    PrBody = prBody,
+                    DependencyGroup = null,
+                });
+            }
+        }
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/IUpdateHandler.cs

@@ -0,0 +1,22 @@
+using NuGetUpdater.Core.Run.ApiModel;
+
+namespace NuGetUpdater.Core.Run.UpdateHandlers;
+
+public interface IUpdateHandler
+{
+    string TagName { get; }
+    bool CanHandle(Job job);
+    Task HandleAsync(Job job, DirectoryInfo repoContentsPath, string baseCommitSha, IDiscoveryWorker discoveryWorker, IAnalyzeWorker analyzeWorker, IUpdaterWorker updaterWorker, IApiHandler apiHandler, ExperimentsManager experimentsManager, ILogger logger);
+}
+
+public static class IUpdateHandlerExtensions
+{
+    public static Task ReportUpdaterStarted(this IUpdateHandler updateHandler, IApiHandler apiHandler) => apiHandler.IncrementMetric(new IncrementMetric()
+    {
+        Metric = "updater.started",
+        Tags = new()
+        {
+            ["operation"] = updateHandler.TagName,
+        }
+    });
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/RefreshGroupUpdatePullRequestHandler.cs

@@ -0,0 +1,192 @@
+using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Updater;
+
+namespace NuGetUpdater.Core.Run.UpdateHandlers;
+
+internal class RefreshGroupUpdatePullRequestHandler : IUpdateHandler
+{
+    public static IUpdateHandler Instance { get; } = new RefreshGroupUpdatePullRequestHandler();
+
+    public string TagName => "update_version_group_pr";
+
+    public bool CanHandle(Job job)
+    {
+        if (job.Dependencies.Length == 0)
+        {
+            return false;
+        }
+
+        if (job.DependencyGroupToRefresh is null)
+        {
+            return false;
+        }
+
+        if (job.GetAllDirectories().Length > 1)
+        {
+            return true;
+        }
+
+        if (job.SecurityUpdatesOnly)
+        {
+            if (job.Dependencies.Length > 1)
+            {
+                return true;
+            }
+
+            if (job.DependencyGroups.Any(g => g.IsSecurity()))
+            {
+                return true;
+            }
+
+            return false;
+        }
+
+        return job.UpdatingAPullRequest;
+    }
+
+    public async Task HandleAsync(Job job, DirectoryInfo repoContentsPath, string baseCommitSha, IDiscoveryWorker discoveryWorker, IAnalyzeWorker analyzeWorker, IUpdaterWorker updaterWorker, IApiHandler apiHandler, ExperimentsManager experimentsManager, ILogger logger)
+    {
+        if (job.DependencyGroupToRefresh is null)
+        {
+            throw new InvalidOperationException($"{nameof(job.DependencyGroupToRefresh)} must be non-null.");
+        }
+
+        var group = job.DependencyGroups.FirstOrDefault(g => g.Name == job.DependencyGroupToRefresh);
+        if (group is null)
+        {
+            throw new InvalidOperationException($"Dependency group {job.DependencyGroupToRefresh} not found.");
+        }
+
+        logger.Info($"Starting update for group {group.Name}");
+
+        var groupMatcher = group.GetGroupMatcher();
+        var jobDependencies = job.Dependencies.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        foreach (var directory in job.GetAllDirectories())
+        {
+            var discoveryResult = await discoveryWorker.RunAsync(repoContentsPath.FullName, directory);
+            logger.ReportDiscovery(discoveryResult);
+            if (discoveryResult.Error is not null)
+            {
+                await apiHandler.RecordUpdateJobError(discoveryResult.Error);
+                return;
+            }
+
+            var updatedDependencyList = RunWorker.GetUpdatedDependencyListFromDiscovery(discoveryResult);
+            await apiHandler.UpdateDependencyList(updatedDependencyList);
+            await this.ReportUpdaterStarted(apiHandler);
+
+            var updateOperationsPerformed = new List<UpdateOperationBase>();
+            var updatedDependencies = new List<ReportedDependency>();
+            var updateOperationsToPerform = RunWorker.GetUpdateOperations(discoveryResult).ToArray();
+            var groupedUpdateOperationsToPerform = updateOperationsToPerform
+                .GroupBy(o => o.Dependency.Name, StringComparer.OrdinalIgnoreCase)
+                .Where(g => jobDependencies.Contains(g.Key))
+                .Where(g => groupMatcher.IsMatch(g.Key))
+                .ToDictionary(g => g.Key, g => g.ToArray(), StringComparer.OrdinalIgnoreCase);
+            logger.Info($"Updating dependencies: {string.Join(", ", groupedUpdateOperationsToPerform.Select(g => g.Key).Distinct().OrderBy(d => d, StringComparer.OrdinalIgnoreCase))}");
+
+            var tracker = new ModifiedFilesTracker(repoContentsPath);
+            await tracker.StartTrackingAsync(discoveryResult);
+            foreach (var dependencyGroupToUpdate in groupedUpdateOperationsToPerform)
+            {
+                var dependencyName = dependencyGroupToUpdate.Key;
+                var relevantDependenciesToUpdate = dependencyGroupToUpdate.Value
+                    .Select(o => (o.ProjectPath, o.Dependency, RunWorker.GetDependencyInfo(job, o.Dependency)))
+                    .Where(set => !job.IsDependencyIgnored(set.Dependency.Name, set.Dependency.Version!))
+                    .ToArray();
+
+                foreach (var (projectPath, dependency, dependencyInfo) in relevantDependenciesToUpdate)
+                {
+                    var analysisResult = await analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
+                    if (analysisResult.Error is not null)
+                    {
+                        logger.Error($"Error analyzing {dependency.Name} in {projectPath}: {analysisResult.Error.GetReport()}");
+                        await apiHandler.RecordUpdateJobError(analysisResult.Error);
+                        return;
+                    }
+
+                    if (!analysisResult.CanUpdate)
+                    {
+                        logger.Info($"No updatable version found for {dependency.Name} in {projectPath}.");
+                        continue;
+                    }
+
+                    logger.Info($"Attempting update of {dependency.Name} from {dependency.Version} to {analysisResult.UpdatedVersion} for {projectPath}.");
+                    var projectDiscovery = discoveryResult.GetProjectDiscoveryFromPath(projectPath);
+                    var updaterResult = await updaterWorker.RunAsync(repoContentsPath.FullName, projectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, dependency.IsTransitive);
+                    if (updaterResult.Error is not null)
+                    {
+                        logger.Error($"Error updating {dependency.Name} in {projectPath}: {updaterResult.Error.GetReport()}");
+                        await apiHandler.RecordUpdateJobError(updaterResult.Error);
+                        continue;
+                    }
+
+                    if (updaterResult.UpdateOperations.Length == 0)
+                    {
+                        logger.Info($"Performed no updates for {dependency.Name} in {projectPath}, but no error reported.");
+                        continue;
+                    }
+
+                    var patchedUpdateOperations = RunWorker.PatchInOldVersions(updaterResult.UpdateOperations, projectDiscovery);
+                    var updatedDependenciesForThis = patchedUpdateOperations
+                        .Select(o => o.ToReportedDependency(projectPath, updatedDependencyList.Dependencies, analysisResult.UpdatedDependencies))
+                        .ToArray();
+
+                    updatedDependencies.AddRange(updatedDependenciesForThis);
+                    updateOperationsPerformed.AddRange(patchedUpdateOperations);
+                    foreach (var o in patchedUpdateOperations)
+                    {
+                        logger.Info($"Update operation performed: {o.GetReport()}");
+                    }
+                }
+            }
+
+            var updatedDependencyFiles = await tracker.StopTrackingAsync();
+            var rawDependencies = updatedDependencies.Select(d => new Dependency(d.Name, d.Version, DependencyType.Unknown)).ToArray();
+            if (rawDependencies.Length == 0)
+            {
+                await apiHandler.ClosePullRequest(ClosePullRequest.WithUpdateNoLongerPossible(job));
+                continue;
+            }
+
+            var commitMessage = PullRequestTextGenerator.GetPullRequestCommitMessage(job, [.. updateOperationsPerformed], null);
+            var prTitle = PullRequestTextGenerator.GetPullRequestTitle(job, [.. updateOperationsPerformed], null);
+            var prBody = PullRequestTextGenerator.GetPullRequestBody(job, [.. updateOperationsPerformed], null);
+            var existingPullRequest = job.GetExistingPullRequestForDependencies(rawDependencies, considerVersions: true);
+            if (existingPullRequest is not null)
+            {
+                await apiHandler.UpdatePullRequest(new UpdatePullRequest()
+                {
+                    DependencyNames = [.. jobDependencies.OrderBy(n => n, StringComparer.OrdinalIgnoreCase)],
+                    DependencyGroup = group.Name,
+                    UpdatedDependencyFiles = [.. updatedDependencyFiles],
+                    BaseCommitSha = baseCommitSha,
+                    CommitMessage = commitMessage,
+                    PrTitle = prTitle,
+                    PrBody = prBody,
+                });
+                continue;
+            }
+            else
+            {
+                var existingPrButDifferent = job.GetExistingPullRequestForDependencies(rawDependencies, considerVersions: false);
+                if (existingPrButDifferent is not null)
+                {
+                    await apiHandler.ClosePullRequest(ClosePullRequest.WithDependenciesChanged(job));
+                }
+
+                await apiHandler.CreatePullRequest(new CreatePullRequest()
+                {
+                    Dependencies = [.. updatedDependencies],
+                    UpdatedDependencyFiles = [.. updatedDependencyFiles],
+                    BaseCommitSha = baseCommitSha,
+                    CommitMessage = commitMessage,
+                    PrTitle = prTitle,
+                    PrBody = prBody,
+                    DependencyGroup = group.Name,
+                });
+                continue;
+            }
+        }
+    }
+}