dependabot-nuget 0.316.0 → 0.318.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b42ebbf0a6556e3766516b2b59eec508929837779a8f9ca2042a4d4f7d629626
-  data.tar.gz: abb2a60e86d368d9d4a0f09c6311fd7b73f2ac708c1ec73c05d92d1b9409b27d
+  metadata.gz: 59a38e30a99a2cfa01adea0a410d889454db7c97be7403dc961f3a657cef9057
+  data.tar.gz: 9cd7cf460715c6bcd81b7a879eb9e18410e6bb7a5e3312f6c97e491530377d77
 SHA512:
-  metadata.gz: 5b266cf823214164397b8e9ed67e5f238364ab95074f33f5cacec47adac5a6cecf147a39ccdb11701e29d0de0ca675b3dabd4a330d75d8ff81dbf7b660c26807
-  data.tar.gz: fa309cdd55f81b5507329def15d7a7e6c50b7668e8f1f886cc7c0e1498ac8209aab577d6ba617dbe7ecffda79f93be8d696908b692a07415b78c677905bb9fdb
+  metadata.gz: 973628f0b72b612b75538f4428d1a71dd98517aed42f9725353455cfbb80bc9da8b5c92688a83197e3651f01084dcd97859f2bf2921dfdafdf8d26ae3f32280c
+  data.tar.gz: 9a5fc49a9cb8a586cde53c7f472be221712aa11a61349be64feddb42ab174257d7cdffab7954f3f0ccfc78d07a380c75c4f9001902ffbdbbb9a4a6790e0d8c8a

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/DependencyInfo.cs

@@ -1,5 +1,7 @@
 using System.Collections.Immutable;
 
+using NuGetUpdater.Core.Run.ApiModel;
+
 namespace NuGetUpdater.Core.Analyze;
 
 public sealed record DependencyInfo
@@ -9,4 +11,5 @@ public sealed record DependencyInfo
     public required bool IsVulnerable { get; init; }
     public ImmutableArray<Requirement> IgnoredVersions { get; init; }
     public ImmutableArray<SecurityVulnerability> Vulnerabilities { get; init; }
+    public ImmutableArray<ConditionUpdateType> IgnoredUpdateTypes { get; init; } = [];
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/VersionFinder.cs

@@ -10,6 +10,8 @@ using NuGet.Protocol;
 using NuGet.Protocol.Core.Types;
 using NuGet.Versioning;
 
+using NuGetUpdater.Core.Run.ApiModel;
+
 namespace NuGetUpdater.Core.Analyze;
 
 internal static class VersionFinder
@@ -155,12 +157,39 @@ internal static class VersionFinder
             var isIgnoredVersion = dependencyInfo.IgnoredVersions.Any(i => i.IsSatisfiedBy(version));
             var isVulnerableVersion = dependencyInfo.Vulnerabilities.Any(v => v.IsVulnerable(version));
             var isSafeVersion = !safeVersions.Any() || safeVersions.Any(s => s.IsSatisfiedBy(version));
+
+            var isIgnoredByType = false;
+            if (currentVersion is not null)
+            {
+                var isMajorBump = version.Major > currentVersion.Major;
+                var isMinorBump = version.Major == currentVersion.Major && version.Minor > currentVersion.Minor;
+                var isPatchBump = version.Major == currentVersion.Major && version.Minor == currentVersion.Minor && version.Patch > currentVersion.Patch;
+                foreach (var ignoreType in dependencyInfo.IgnoredUpdateTypes)
+                {
+                    switch (ignoreType)
+                    {
+                        case ConditionUpdateType.SemVerPatch:
+                            isIgnoredByType = isIgnoredByType || isPatchBump || isMinorBump || isMajorBump;
+                            break;
+                        case ConditionUpdateType.SemVerMinor:
+                            isIgnoredByType = isIgnoredByType || isMinorBump || isMajorBump;
+                            break;
+                        case ConditionUpdateType.SemVerMajor:
+                            isIgnoredByType = isIgnoredByType || isMajorBump;
+                            break;
+                        default:
+                            break;
+                    }
+                }
+            }
+
             return versionGreaterThanCurrent
                 && rangeSatisfies
                 && prereleaseTypeMatches
                 && !isIgnoredVersion
                 && !isVulnerableVersion
-                && isSafeVersion;
+                && isSafeVersion
+                && !isIgnoredByType;
         };
     }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/FrameworkChecker/FrameworkCompatibilityService.cs

@@ -24,7 +24,7 @@ public class FrameworkCompatibilityService
 
         foreach (var packageFramework in packageFrameworks)
         {
-            if (packageFrameworks == null || packageFramework.IsUnsupported || packageFramework.IsPCL)
+            if (packageFrameworks == null || packageFramework.IsUnsupported)
             {
                 continue;
             }
@@ -79,6 +79,30 @@ public class FrameworkCompatibilityService
             }
         }
 
+        // portable profiles
+        var portableMappings = new DefaultPortableFrameworkMappings();
+        var portableFrameworks = portableMappings.ProfileFrameworks.ToDictionary(p => p.Key, p => p.Value);
+        foreach (var (profileNumber, frameworkRange) in portableMappings.CompatibilityMappings)
+        {
+            var profileFramework = new NuGetFramework(FrameworkConstants.FrameworkIdentifiers.Portable, new Version(0, 0, 0, 0), $"Profile{profileNumber}");
+            var compatibleFrameworks = new HashSet<NuGetFramework>();
+            matrix.Add(profileFramework, compatibleFrameworks);
+
+            foreach (var packageFramework in AllSupportedFrameworks)
+            {
+                if (frameworkRange.Satisfies(packageFramework))
+                {
+                    foreach (var projectFramework in AllSupportedFrameworks)
+                    {
+                        if (CompatibilityProvider.IsCompatible(projectFramework, packageFramework))
+                        {
+                            compatibleFrameworks.Add(projectFramework);
+                        }
+                    }
+                }
+            }
+        }
+
         return matrix;
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/Condition.cs

@@ -11,9 +11,21 @@ public sealed record Condition
     [JsonPropertyName("source")]
     public string? Source { get; init; } = null;
     [JsonPropertyName("update-types")]
-    public string[] UpdateTypes { get; init; } = [];
+    public ConditionUpdateType[]? UpdateTypes { get; init; } = null;
     [JsonPropertyName("updated-at")]
     public DateTime? UpdatedAt { get; init; } = null;
     [JsonPropertyName("version-requirement")]
     public Requirement? VersionRequirement { get; init; } = null;
 }
+
+public enum ConditionUpdateType
+{
+    [JsonStringEnumMemberName("version-update:semver-major")]
+    SemVerMajor,
+
+    [JsonStringEnumMemberName("version-update:semver-minor")]
+    SemVerMinor,
+
+    [JsonStringEnumMemberName("version-update:semver-patch")]
+    SemVerPatch,
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/DependencyGroup.cs

@@ -1,5 +1,6 @@
 using System.Collections.Immutable;
 using System.IO.Enumeration;
+using System.Text.Json;
 
 namespace NuGetUpdater.Core.Run.ApiModel;
 
@@ -32,33 +33,43 @@ public class GroupMatcher
 
     public static GroupMatcher FromRules(Dictionary<string, object> rules)
     {
-        string[] patterns;
-        if (rules.TryGetValue("patterns", out var patternsObject) &&
-            patternsObject is string[] patternsArray)
+        var patterns = GetStringArray(rules, "patterns", ["*"]); // default to matching everything unless explicitly excluded
+        var excludePatterns = GetStringArray(rules, "exclude-patterns", []);
+
+        return new GroupMatcher()
         {
-            patterns = patternsArray;
-        }
-        else
+            Patterns = patterns,
+            ExcludePatterns = excludePatterns,
+        };
+    }
+
+    private static ImmutableArray<string> GetStringArray(Dictionary<string, object> rules, string propertyName, ImmutableArray<string> defaultValue)
+    {
+        if (!rules.TryGetValue(propertyName, out var propertyObject))
         {
-            patterns = ["*"]; // default to matching everything unless excluded below
+            return defaultValue;
         }
 
-        string[] excludePatterns;
-        if (rules.TryGetValue("exclude-patterns", out var excludePatternsObject) &&
-            excludePatternsObject is string[] excludePatternsArray)
+        if (propertyObject is string[] stringArray)
         {
-            excludePatterns = excludePatternsArray;
+            // shortcut for unit tests which directly supply the array
+            return [.. stringArray];
         }
-        else
+
+        var patternsElements = new List<string>();
+        if (propertyObject is JsonElement element &&
+            element.ValueKind == JsonValueKind.Array)
         {
-            excludePatterns = [];
+            foreach (var arrayElement in element.EnumerateArray())
+            {
+                if (arrayElement.ValueKind == JsonValueKind.String)
+                {
+                    patternsElements.Add(arrayElement.GetString()!);
+                }
+            }
         }
 
-        return new GroupMatcher()
-        {
-            Patterns = [.. patterns],
-            ExcludePatterns = [.. excludePatterns],
-        };
+        return [.. patternsElements];
     }
 }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/Job.cs

@@ -100,15 +100,14 @@ public sealed record Job
         return existingPullRequest;
     }
 
-    public bool IsDependencyIgnored(string dependencyName, string dependencyVersion)
+    public bool IsDependencyIgnoredByNameOnly(string dependencyName)
     {
-        var versionsToIgnore = IgnoreConditions
-            .Where(c => FileSystemName.MatchesSimpleExpression(c.DependencyName, dependencyName))
-            .Select(c => c.VersionRequirement ?? Requirement.Parse(">= 0.0.0")) // no range means ignore everything
+        var packageNamesToIgnore = IgnoreConditions
+            .Where(c => (c.UpdateTypes ?? []).Length == 0 && c.VersionRequirement is null) // ignoring by name means there can't be any qualification
+            .Select(c => c.DependencyName)
             .ToArray();
-        var parsedDependencyVersion = NuGetVersion.Parse(dependencyVersion);
-        var isIgnored = versionsToIgnore
-            .Any(r => r.IsSatisfiedBy(parsedDependencyVersion));
+        var isIgnored = packageNamesToIgnore
+            .Any(p => FileSystemName.MatchesSimpleExpression(p, dependencyName));
         return isIgnored;
     }
 
@@ -231,7 +230,6 @@ public class NullAsEmptyStringArrayConverter : JsonConverter<ImmutableArray<stri
 
     public override void Write(Utf8JsonWriter writer, ImmutableArray<string> value, JsonSerializerOptions options)
     {
-        writer.WriteStartArray();
-        writer.WriteEndArray();
+        JsonSerializer.Serialize(writer, value, options);
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/PullRequestTextGenerator.cs

@@ -97,7 +97,12 @@ public class PullRequestTextGenerator
         var fromText = dependencySet.Versions.Length == 1 && dependencySet.Versions[0].OldVersion is not null
             ? $"from {dependencySet.Versions[0].OldVersion} "
             : string.Empty;
-        return $"Bump{bumpSuffix} {dependencySet.Name} {fromText}to {string.Join(", ", dependencySet.Versions.Select(v => v.NewVersion.ToString()))}";
+        var newVersions = dependencySet.Versions
+            .Select(v => v.NewVersion)
+            .Distinct()
+            .OrderBy(v => v)
+            .ToArray();
+        return $"Bump{bumpSuffix} {dependencySet.Name} {fromText}to {string.Join(", ", newVersions.Select(v => v.ToString()))}";
     }
 
     private static DependencySet[] GetDependencySets(ImmutableArray<UpdateOperationBase> updateOperationsPerformed)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -1,5 +1,6 @@
 using System.Collections.Immutable;
 using System.IO;
+using System.IO.Enumeration;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Serialization;
@@ -677,7 +678,12 @@ public class RunWorker
         var dependencyVersion = NuGetVersion.Parse(dependency.Version!);
         var securityAdvisories = job.SecurityAdvisories.Where(s => s.DependencyName.Equals(dependency.Name, StringComparison.OrdinalIgnoreCase)).ToArray();
         var isVulnerable = securityAdvisories.Any(s => (s.AffectedVersions ?? []).Any(v => v.IsSatisfiedBy(dependencyVersion)));
-        var ignoredVersions = GetIgnoredRequirementsForDependency(job, dependency.Name);
+        var ignoredVersions = job.IgnoreConditions
+            .Where(c => FileSystemName.MatchesSimpleExpression(c.DependencyName, dependency.Name))
+            .Select(c => c.VersionRequirement)
+            .Where(r => r is not null)
+            .Cast<Requirement>()
+            .ToImmutableArray();
         var vulnerabilities = securityAdvisories.Select(s => new SecurityVulnerability()
         {
             DependencyName = dependency.Name,
@@ -685,6 +691,11 @@ public class RunWorker
             VulnerableVersions = s.AffectedVersions ?? [],
             SafeVersions = s.SafeVersions.ToImmutableArray(),
         }).ToImmutableArray();
+        var ignoredUpdateTypes = job.IgnoreConditions
+            .Where(c => FileSystemName.MatchesSimpleExpression(c.DependencyName, dependency.Name))
+            .SelectMany(c => c.UpdateTypes ?? [])
+            .Distinct()
+            .ToImmutableArray();
         var dependencyInfo = new DependencyInfo()
         {
             Name = dependency.Name,
@@ -692,6 +703,7 @@ public class RunWorker
             IsVulnerable = isVulnerable,
             IgnoredVersions = ignoredVersions,
             Vulnerabilities = vulnerabilities,
+            IgnoredUpdateTypes = ignoredUpdateTypes,
         };
         return dependencyInfo;
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/CreateSecurityUpdatePullRequestHandler.cs

@@ -65,13 +65,29 @@ internal class CreateSecurityUpdatePullRequestHandler : IUpdateHandler
             foreach (var dependencyGroupToUpdate in groupedUpdateOperationsToPerform)
             {
                 var dependencyName = dependencyGroupToUpdate.Key;
-                var vulnerableDependenciesToUpdate = dependencyGroupToUpdate.Value
+                var vulnerableCandidateDependenciesToUpdate = dependencyGroupToUpdate.Value
                     .Select(o => (o.ProjectPath, o.Dependency, RunWorker.GetDependencyInfo(job, o.Dependency)))
                     .Where(set => set.Item3.IsVulnerable)
                     .ToArray();
+                var vulnerableDependenciesToUpdate = vulnerableCandidateDependenciesToUpdate
+                    .Where(o => !job.IsDependencyIgnoredByNameOnly(o.Dependency.Name))
+                    .ToArray();
                 if (vulnerableDependenciesToUpdate.Length == 0)
                 {
-                    await apiHandler.RecordUpdateJobError(new SecurityUpdateNotNeeded(dependencyName));
+                    // no update possible, check backwards to see if it's because of ignore conditions
+                    var ignoredUpdates = vulnerableCandidateDependenciesToUpdate
+                        .Where(set => set.Dependency.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase))
+                        .ToArray();
+                    if (ignoredUpdates.Length > 0)
+                    {
+                        logger.Error($"Cannot update {dependencyName} because all versions are ignored.");
+                        await apiHandler.RecordUpdateJobError(new SecurityUpdateIgnored(dependencyName));
+                    }
+                    else
+                    {
+                        await apiHandler.RecordUpdateJobError(new SecurityUpdateNotNeeded(dependencyName));
+                    }
+
                     continue;
                 }
 
@@ -92,14 +108,6 @@ internal class CreateSecurityUpdatePullRequestHandler : IUpdateHandler
                         continue;
                     }
 
-                    if (dependencyInfo.IgnoredVersions.Any(ignored => ignored.IsSatisfiedBy(NuGetVersion.Parse(analysisResult.UpdatedVersion))) ||
-                        job.IsDependencyIgnored(dependency.Name, dependency.Version!))
-                    {
-                        logger.Error($"Cannot update {dependency.Name} for {projectPath} because all versions are ignored.");
-                        await apiHandler.RecordUpdateJobError(new SecurityUpdateIgnored(dependencyName));
-                        continue;
-                    }
-
                     logger.Info($"Attempting update of {dependency.Name} from {dependency.Version} to {analysisResult.UpdatedVersion} for {projectPath}.");
                     var projectDiscovery = discoveryResult.GetProjectDiscoveryFromPath(projectPath);
                     var updaterResult = await updaterWorker.RunAsync(repoContentsPath.FullName, projectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, dependency.IsTransitive);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/GroupUpdateAllVersionsHandler.cs

@@ -57,6 +57,13 @@ internal class GroupUpdateAllVersionsHandler : IUpdateHandler
     {
         foreach (var group in job.DependencyGroups)
         {
+            var existingGroupPr = job.ExistingGroupPullRequests.FirstOrDefault(pr => pr.DependencyGroupName == group.Name);
+            if (existingGroupPr is not null)
+            {
+                logger.Info($"Existing pull request found for group {group.Name}.  Skipping pull request creation.");
+                continue;
+            }
+
             logger.Info($"Starting update for group {group.Name}");
             var groupMatcher = group.GetGroupMatcher();
             var updateOperationsPerformed = new List<UpdateOperationBase>();
@@ -91,9 +98,9 @@ internal class GroupUpdateAllVersionsHandler : IUpdateHandler
                         continue;
                     }
 
-                    if (job.IsDependencyIgnored(dependency.Name, dependency.Version!))
+                    if (job.IsDependencyIgnoredByNameOnly(dependency.Name))
                     {
-                        logger.Info($"Skipping ignored dependency {dependency.Name}/{dependency.Version}.");
+                        logger.Info($"Skipping ignored dependency {dependency.Name}.");
                         continue;
                     }
 
@@ -112,12 +119,6 @@ internal class GroupUpdateAllVersionsHandler : IUpdateHandler
                         continue;
                     }
 
-                    if (dependencyInfo.IgnoredVersions.Any(ignored => ignored.IsSatisfiedBy(NuGetVersion.Parse(analysisResult.UpdatedVersion))))
-                    {
-                        logger.Info($"Cannot update {dependency.Name} for {projectPath} because all versions are ignored.");
-                        continue;
-                    }
-
                     var projectDiscovery = discoveryResult.GetProjectDiscoveryFromPath(projectPath);
                     var updaterResult = await updaterWorker.RunAsync(repoContentsPath.FullName, projectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, dependency.IsTransitive);
                     if (updaterResult.Error is not null)
@@ -196,9 +197,9 @@ internal class GroupUpdateAllVersionsHandler : IUpdateHandler
                     continue;
                 }
 
-                if (job.IsDependencyIgnored(dependency.Name, dependency.Version!))
+                if (job.IsDependencyIgnoredByNameOnly(dependency.Name))
                 {
-                    logger.Info($"Skipping ignored dependency {dependency.Name}/{dependency.Version}.");
+                    logger.Info($"Skipping ignored dependency {dependency.Name}.");
                     continue;
                 }
 
@@ -217,12 +218,6 @@ internal class GroupUpdateAllVersionsHandler : IUpdateHandler
                     continue;
                 }
 
-                if (dependencyInfo.IgnoredVersions.Any(ignored => ignored.IsSatisfiedBy(NuGetVersion.Parse(analysisResult.UpdatedVersion))))
-                {
-                    logger.Info($"Cannot update {dependency.Name} for {projectPath} because all versions are ignored.");
-                    continue;
-                }
-
                 var projectDiscovery = discoveryResult.GetProjectDiscoveryFromPath(projectPath);
                 var updaterResult = await updaterWorker.RunAsync(repoContentsPath.FullName, projectPath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, dependency.IsTransitive);
                 if (updaterResult.Error is not null)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/RefreshGroupUpdatePullRequestHandler.cs

@@ -91,8 +91,8 @@ internal class RefreshGroupUpdatePullRequestHandler : IUpdateHandler
             {
                 var dependencyName = dependencyGroupToUpdate.Key;
                 var relevantDependenciesToUpdate = dependencyGroupToUpdate.Value
+                    .Where(o => !job.IsDependencyIgnoredByNameOnly(o.Dependency.Name))
                     .Select(o => (o.ProjectPath, o.Dependency, RunWorker.GetDependencyInfo(job, o.Dependency)))
-                    .Where(set => !job.IsDependencyIgnored(set.Dependency.Name, set.Dependency.Version!))
                     .ToArray();
 
                 foreach (var (projectPath, dependency, dependencyInfo) in relevantDependenciesToUpdate)
@@ -145,7 +145,9 @@ internal class RefreshGroupUpdatePullRequestHandler : IUpdateHandler
             var rawDependencies = updatedDependencies.Select(d => new Dependency(d.Name, d.Version, DependencyType.Unknown)).ToArray();
             if (rawDependencies.Length == 0)
             {
-                await apiHandler.ClosePullRequest(ClosePullRequest.WithUpdateNoLongerPossible(job));
+                var close = ClosePullRequest.WithUpdateNoLongerPossible(job);
+                logger.Info(close.GetReport());
+                await apiHandler.ClosePullRequest(close);
                 continue;
             }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/RefreshSecurityUpdatePullRequestHandler.cs

@@ -35,6 +35,7 @@ internal class RefreshSecurityUpdatePullRequestHandler : IUpdateHandler
             logger.ReportDiscovery(discoveryResult);
             if (discoveryResult.Error is not null)
             {
+                logger.Error($"Reporting error: {discoveryResult.Error.GetReport()}");
                 await apiHandler.RecordUpdateJobError(discoveryResult.Error);
                 return;
             }
@@ -55,7 +56,9 @@ internal class RefreshSecurityUpdatePullRequestHandler : IUpdateHandler
 
             if (groupedUpdateOperationsToPerform.Count == 0)
             {
-                await apiHandler.ClosePullRequest(ClosePullRequest.WithDependenciesRemoved(job));
+                var close = ClosePullRequest.WithDependenciesRemoved(job);
+                logger.Info(close.GetReport());
+                await apiHandler.ClosePullRequest(close);
                 continue;
             }
 
@@ -65,7 +68,9 @@ internal class RefreshSecurityUpdatePullRequestHandler : IUpdateHandler
                 .ToImmutableArray();
             if (missingDependencies.Length > 0)
             {
-                await apiHandler.ClosePullRequest(ClosePullRequest.WithDependencyRemoved(job));
+                var close = ClosePullRequest.WithDependencyRemoved(job);
+                logger.Info(close.GetReport());
+                await apiHandler.ClosePullRequest(close);
                 continue;
             }
 
@@ -75,14 +80,16 @@ internal class RefreshSecurityUpdatePullRequestHandler : IUpdateHandler
             {
                 var dependencyName = dependencyGroupToUpdate.Key;
                 var vulnerableDependenciesToUpdate = dependencyGroupToUpdate.Value
+                    .Where(o => !job.IsDependencyIgnoredByNameOnly(o.Dependency.Name))
                     .Select(o => (o.ProjectPath, o.Dependency, RunWorker.GetDependencyInfo(job, o.Dependency)))
-                    .Where(set => !job.IsDependencyIgnored(set.Dependency.Name, set.Dependency.Version!))
                     .Where(set => set.Item3.IsVulnerable)
                     .ToArray();
 
                 if (vulnerableDependenciesToUpdate.Length < dependencyGroupToUpdate.Value.Length)
                 {
-                    await apiHandler.ClosePullRequest(ClosePullRequest.WithUpToDate(job));
+                    var close = ClosePullRequest.WithUpToDate(job);
+                    logger.Info(close.GetReport());
+                    await apiHandler.ClosePullRequest(close);
                     return;
                 }
 
@@ -99,8 +106,7 @@ internal class RefreshSecurityUpdatePullRequestHandler : IUpdateHandler
                     if (!analysisResult.CanUpdate)
                     {
                         logger.Info($"No updatable version found for {dependency.Name} in {projectPath}.");
-                        await apiHandler.ClosePullRequest(ClosePullRequest.WithUpdateNoLongerPossible(job));
-                        return;
+                        continue;
                     }
 
                     logger.Info($"Attempting update of {dependency.Name} from {dependency.Version} to {analysisResult.UpdatedVersion} for {projectPath}.");
@@ -115,13 +121,8 @@ internal class RefreshSecurityUpdatePullRequestHandler : IUpdateHandler
 
                     if (updaterResult.UpdateOperations.Length == 0)
                     {
-                        // nothing was done, but we may have already handled it
-                        var alreadyHandled = updatedDependencies.Where(updated => updated.Name == dependencyName && updated.Version == analysisResult.UpdatedVersion).Any();
-                        if (!alreadyHandled)
-                        {
-                            await apiHandler.ClosePullRequest(ClosePullRequest.WithUpdateNoLongerPossible(job));
-                            return;
-                        }
+                        logger.Info($"No update operations performed for {dependency.Name}/{dependency.Version} in project {projectPath}.");
+                        continue;
                     }
 
                     var patchedUpdateOperations = RunWorker.PatchInOldVersions(updaterResult.UpdateOperations, projectDiscovery);
@@ -138,6 +139,21 @@ internal class RefreshSecurityUpdatePullRequestHandler : IUpdateHandler
                 }
             }
 
+            // ensure we did something
+            var updatesNotPerformed = jobDependencies
+                .Except(updatedDependencies.Select(d => d.Name), StringComparer.OrdinalIgnoreCase)
+                .Distinct()
+                .OrderBy(d => d, StringComparer.OrdinalIgnoreCase)
+                .ToArray();
+
+            if (updatesNotPerformed.Length > 0)
+            {
+                logger.Info($"No updates performed for: {string.Join(", ", updatesNotPerformed)}");
+                await apiHandler.ClosePullRequest(ClosePullRequest.WithUpdateNoLongerPossible(job));
+                continue;
+            }
+
+            // update or create
             var updatedDependencyFiles = await tracker.StopTrackingAsync();
             var rawDependencies = updatedDependencies.Select(d => new Dependency(d.Name, d.Version, DependencyType.Unknown)).ToArray();
             if (rawDependencies.Length > 0)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/RefreshVersionUpdatePullRequestHandler.cs

@@ -53,7 +53,9 @@ internal class RefreshVersionUpdatePullRequestHandler : IUpdateHandler
 
             if (relevantUpdateOperationsToPerform.Count == 0)
             {
-                await apiHandler.ClosePullRequest(ClosePullRequest.WithDependenciesRemoved(job));
+                var close = ClosePullRequest.WithDependenciesRemoved(job);
+                logger.Info(close.GetReport());
+                await apiHandler.ClosePullRequest(close);
                 continue;
             }
 
@@ -63,7 +65,9 @@ internal class RefreshVersionUpdatePullRequestHandler : IUpdateHandler
                 .ToImmutableArray();
             if (missingDependencies.Length > 0)
             {
-                await apiHandler.ClosePullRequest(ClosePullRequest.WithDependencyRemoved(job));
+                var close = ClosePullRequest.WithDependencyRemoved(job);
+                logger.Info(close.GetReport());
+                await apiHandler.ClosePullRequest(close);
                 continue;
             }
 
@@ -75,8 +79,8 @@ internal class RefreshVersionUpdatePullRequestHandler : IUpdateHandler
             {
                 var dependencyName = dependencyUpdatesToPeform.Key;
                 var dependencyInfosToUpdate = dependencyUpdatesToPeform.Value
+                    .Where(o => !job.IsDependencyIgnoredByNameOnly(o.Dependency.Name))
                     .Select(o => (o.ProjectPath, o.Dependency, RunWorker.GetDependencyInfo(job, o.Dependency)))
-                    .Where(set => !job.IsDependencyIgnored(set.Dependency.Name, set.Dependency.Version!))
                     .ToArray();
 
                 foreach (var (projectPath, dependency, dependencyInfo) in dependencyInfosToUpdate)
@@ -92,8 +96,7 @@ internal class RefreshVersionUpdatePullRequestHandler : IUpdateHandler
                     if (!analysisResult.CanUpdate)
                     {
                         logger.Info($"No updatable version found for {dependency.Name} in {projectPath}.");
-                        await apiHandler.ClosePullRequest(ClosePullRequest.WithUpdateNoLongerPossible(job));
-                        return;
+                        continue;
                     }
 
                     logger.Info($"Attempting update of {dependency.Name} from {dependency.Version} to {analysisResult.UpdatedVersion} for {projectPath}.");
@@ -108,8 +111,8 @@ internal class RefreshVersionUpdatePullRequestHandler : IUpdateHandler
 
                     if (updaterResult.UpdateOperations.Length == 0)
                     {
-                        await apiHandler.ClosePullRequest(ClosePullRequest.WithUpdateNoLongerPossible(job));
-                        return;
+                        logger.Info($"No update operations performed for {dependency.Name}/{dependency.Version} in project {projectPath}.");
+                        continue;
                     }
 
                     var patchedUpdateOperations = RunWorker.PatchInOldVersions(updaterResult.UpdateOperations, projectDiscovery);
@@ -126,6 +129,21 @@ internal class RefreshVersionUpdatePullRequestHandler : IUpdateHandler
                 }
             }
 
+            // ensure we did something
+            var updatesNotPerformed = jobDependencies
+                .Except(updatedDependencies.Select(d => d.Name), StringComparer.OrdinalIgnoreCase)
+                .Distinct()
+                .OrderBy(d => d, StringComparer.OrdinalIgnoreCase)
+                .ToArray();
+
+            if (updatesNotPerformed.Length > 0)
+            {
+                logger.Info($"No updates performed for: {string.Join(", ", updatesNotPerformed)}");
+                await apiHandler.ClosePullRequest(ClosePullRequest.WithUpdateNoLongerPossible(job));
+                continue;
+            }
+
+            // update or create
             var updatedDependencyFiles = await tracker.StopTrackingAsync();
             var rawDependencies = updatedDependencies.Select(d => new Dependency(d.Name, d.Version, DependencyType.Unknown)).ToArray();
             if (rawDependencies.Length > 0)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackageReferenceUpdater.cs

@@ -201,6 +201,7 @@ internal static class PackageReferenceUpdater
     )
     {
         var topLevelNames = topLevelDependencies.Select(d => d.Name).ToHashSet(StringComparer.OrdinalIgnoreCase);
+        var topLevelVersionStrings = topLevelDependencies.ToDictionary(d => d.Name, d => d.Version!, StringComparer.OrdinalIgnoreCase);
         var requestedVersions = requestedUpdates.ToDictionary(d => d.Name, d => NuGetVersion.Parse(d.Version!), StringComparer.OrdinalIgnoreCase);
         var resolvedVersions = resolvedDependencies
             .Select(d => (d.Name, NuGetVersion.TryParse(d.Version, out var version), version))
@@ -248,16 +249,22 @@ internal static class PackageReferenceUpdater
                         }
                     }
 
-                    if (rootPackageName is not null)
+                    if (rootPackageName is not null && resolvedVersions.TryGetValue(rootPackageName, out var rootPackageVersion))
                     {
-                        updateOperations.Add(new ParentUpdate()
+                        // from a few lines up we've already confirmed that `rootPackageName` was a top-level dependency
+                        var rootPackageVersionString = topLevelVersionStrings[rootPackageName];
+                        if (NuGetVersion.TryParse(rootPackageVersionString, out var resolvedRootPackageVersion)
+                            && rootPackageVersion > resolvedRootPackageVersion)
                         {
-                            DependencyName = requestedDependencyName,
-                            NewVersion = requestedVersions[requestedDependencyName],
-                            UpdatedFiles = [],
-                            ParentDependencyName = rootPackageName,
-                            ParentNewVersion = packageVersions[rootPackageName],
-                        });
+                            updateOperations.Add(new ParentUpdate()
+                            {
+                                DependencyName = requestedDependencyName,
+                                NewVersion = requestedVersions[requestedDependencyName],
+                                UpdatedFiles = [],
+                                ParentDependencyName = rootPackageName,
+                                ParentNewVersion = packageVersions[rootPackageName],
+                            });
+                        }
                     }
                     break;
                 case (true, false):