dependabot-nuget 0.321.1 → 0.321.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b3a9595c500e6254f99f1cef75b2f819b7ea3736d2dc4083c7007371203c6fd5
-  data.tar.gz: be1476e3b56bfa67e803fb9d70eb4ec82113af256995d0e44d7fd5dd0335331b
+  metadata.gz: 832ab457e727f6583a33319b04bc49b5142d33aae4f95873137c580f838b5abf
+  data.tar.gz: 0dca08fa4a87530852652d0264c13e4bd79024561cb3e3fe397551c12fa1b921
 SHA512:
-  metadata.gz: ee2d1cc30d23f9f141f9e3da92f23d4e241ffac6870a0c54b4cc065ca1bf9226ed553ebf7a8f371bc6b36e616c5abfc49d44c182be6538f1611594572c30ae5a
-  data.tar.gz: 5233059c5c248a2f54b39ca1f8819f96ddc7b4d81701135a98403f7965000aeffbd8407680d582bf7449bb543df38568f21cb45d1a895f2d220177cdea1b5b0b
+  metadata.gz: 756d833b0d1616230f5ce980d1410ae8ea9883ab441837847a18eda7c41180032d20ae84cbc986231d293a2bf1e846b81f93fb8b40fd8419edcfd51e5bfd276e
+  data.tar.gz: 1acab8370fe0a8b0bd8719613e783c1c2e1d5cc7f7a22355ce1e80d10eb242c0545df65d6cbaba3964cd551345d02c0e43a7c94b7da76d6a10ccdd1c354ab3c4

data/helpers/lib/NuGetUpdater/DotNetPackageCorrelation/Model/PackageMapper.cs

@@ -46,6 +46,15 @@ public class PackageMapper
         return null;
     }
 
+    public bool IsSdkReplacementPackage(string packageName)
+    {
+        var isSdkReplacementPackage = RuntimePackages.Runtimes.Any(r =>
+        {
+            return r.Value.Packages.Any(p => packageName.Equals(p.Key, StringComparison.Ordinal));
+        });
+        return isSdkReplacementPackage;
+    }
+
     private SemVersion? GetRuntimeVersionFromPackage(string packageName, SemVersion packageVersion)
     {
         // TODO: linear search is slow

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyDiscoveryTargetingPacks.props

@@ -6,5 +6,7 @@
     because that's irrelevant to dependency discovery.
     -->
     <NoWarn>$(NoWarn);MSB3644</NoWarn>
+    <!-- A package downgrade warning shouldn't be lifted to an error because that would prevent discovery. -->
+    <NoWarn>$(NoWarn);NU1605</NoWarn>
   </PropertyGroup>
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencySolver/IDependencySolver.cs

@@ -0,0 +1,8 @@
+using System.Collections.Immutable;
+
+namespace NuGetUpdater.Core.DependencySolver;
+
+public interface IDependencySolver
+{
+    Task<ImmutableArray<Dependency>?> SolveAsync(ImmutableArray<Dependency> existingTopLevelDependencies, ImmutableArray<Dependency> desiredDependencies, string targetFramework);
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencySolver/MSBuildDependencySolver.cs

@@ -0,0 +1,32 @@
+using System.Collections.Immutable;
+
+namespace NuGetUpdater.Core.DependencySolver;
+
+public class MSBuildDependencySolver : IDependencySolver
+{
+    private readonly DirectoryInfo _repoContentsPath;
+    private readonly FileInfo _projectPath;
+    private readonly ExperimentsManager _experimentsManager;
+    private readonly ILogger _logger;
+
+    public MSBuildDependencySolver(DirectoryInfo repoContentsPath, FileInfo projectPath, ExperimentsManager experimentsManager, ILogger logger)
+    {
+        _repoContentsPath = repoContentsPath;
+        _projectPath = projectPath;
+        _experimentsManager = experimentsManager;
+        _logger = logger;
+    }
+
+    public async Task<ImmutableArray<Dependency>?> SolveAsync(ImmutableArray<Dependency> existingTopLevelDependencies, ImmutableArray<Dependency> desiredDependencies, string targetFramework)
+    {
+        var result = await MSBuildHelper.ResolveDependencyConflicts(
+            _repoContentsPath.FullName,
+            _projectPath.FullName,
+            targetFramework,
+            existingTopLevelDependencies,
+            desiredDependencies,
+            _experimentsManager,
+            _logger);
+        return result;
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/ProjectDiscoveryResult.cs

@@ -15,4 +15,5 @@ public record ProjectDiscoveryResult : IDiscoveryResultWithDependencies
     public ImmutableArray<string> ReferencedProjectPaths { get; init; } = [];
     public required ImmutableArray<string> ImportedFiles { get; init; }
     public required ImmutableArray<string> AdditionalFiles { get; init; }
+    public bool CentralPackageTransitivePinningEnabled { get; init; } = false;
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -526,7 +526,8 @@ internal static class SdkProjectDiscovery
                 .ToImmutableArray();
 
             // others
-            var properties = resolvedProperties[projectPath]
+            var projectProperties = resolvedProperties[projectPath];
+            var properties = projectProperties
                 .Where(pkvp => projectPropertyNames.Contains(pkvp.Key))
                 .Select(pkvp => new Property(pkvp.Key, pkvp.Value, Path.GetRelativePath(repoRootPath, projectPath).NormalizePathToUnix()))
                 .OrderBy(p => p.Name)
@@ -547,6 +548,13 @@ internal static class SdkProjectDiscovery
                 .Select(p => p.NormalizePathToUnix())
                 .OrderBy(p => p)
                 .ToImmutableArray();
+            var useCpmTransitivePinning =
+                projectProperties.TryGetValue("ManagePackageVersionsCentrally", out var useCpmString) &&
+                bool.TryParse(useCpmString, out var useCpm) &&
+                useCpm &&
+                projectProperties.TryGetValue("CentralPackageTransitivePinningEnabled", out var useTransitivePinningString) &&
+                bool.TryParse(useTransitivePinningString, out var useTransitivePinning) &&
+                useTransitivePinning;
 
             var projectDiscoveryResult = new ProjectDiscoveryResult()
             {
@@ -557,6 +565,7 @@ internal static class SdkProjectDiscovery
                 ReferencedProjectPaths = referenced,
                 ImportedFiles = imported,
                 AdditionalFiles = additional,
+                CentralPackageTransitivePinningEnabled = useCpmTransitivePinning,
             };
             projectDiscoveryResults.Add(projectDiscoveryResult);
         }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/WorkspaceDiscoveryResult.cs

@@ -15,4 +15,10 @@ public sealed record WorkspaceDiscoveryResult : NativeResult
         var projectDiscovery = Projects.FirstOrDefault(p => System.IO.Path.Join(Path, p.FilePath).FullyNormalizedRootedPath().Equals(repoPath, StringComparison.OrdinalIgnoreCase));
         return projectDiscovery;
     }
+
+    public ProjectDiscoveryResult? GetProjectDiscoveryFromFullPath(DirectoryInfo repoContentsPath, FileInfo projectPath)
+    {
+        var projectDiscovery = Projects.FirstOrDefault(p => System.IO.Path.Join(repoContentsPath.FullName, Path, p.FilePath).FullyNormalizedRootedPath().Equals(projectPath.FullName.FullyNormalizedRootedPath(), StringComparison.OrdinalIgnoreCase));
+        return projectDiscovery;
+    }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/ExperimentsManager.cs

@@ -12,6 +12,7 @@ public record ExperimentsManager
     public bool UseLegacyDependencySolver { get; init; } = false;
     public bool UseLegacyUpdateHandler { get; init; } = false;
     public bool UseDirectDiscovery { get; init; } = false;
+    public bool UseNewFileUpdater { get; init; } = false;
 
     public Dictionary<string, object> ToDictionary()
     {
@@ -22,6 +23,7 @@ public record ExperimentsManager
             ["nuget_legacy_dependency_solver"] = UseLegacyDependencySolver,
             ["nuget_use_legacy_update_handler"] = UseLegacyUpdateHandler,
             ["nuget_use_direct_discovery"] = UseDirectDiscovery,
+            ["nuget_use_new_file_updater"] = UseNewFileUpdater,
         };
     }
 
@@ -34,6 +36,7 @@ public record ExperimentsManager
             UseLegacyDependencySolver = IsEnabled(experiments, "nuget_legacy_dependency_solver"),
             UseLegacyUpdateHandler = IsEnabled(experiments, "nuget_use_legacy_update_handler"),
             UseDirectDiscovery = IsEnabled(experiments, "nuget_use_direct_discovery"),
+            UseNewFileUpdater = IsEnabled(experiments, "nuget_use_new_file_updater"),
         };
     }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/DotNetToolsJsonUpdater.cs

@@ -2,7 +2,7 @@ namespace NuGetUpdater.Core;
 
 internal static class DotNetToolsJsonUpdater
 {
-    public static async Task UpdateDependencyAsync(
+    public static async Task<string?> UpdateDependencyAsync(
         string repoRootPath,
         string workspacePath,
         string dependencyName,
@@ -13,7 +13,7 @@ internal static class DotNetToolsJsonUpdater
         if (!MSBuildHelper.TryGetDotNetToolsJsonPath(repoRootPath, workspacePath, out var dotnetToolsJsonPath))
         {
             logger.Info("  No dotnet-tools.json file found.");
-            return;
+            return null;
         }
 
         var dotnetToolsJsonFile = DotNetToolsJsonBuildFile.Open(repoRootPath, dotnetToolsJsonPath, logger);
@@ -24,7 +24,7 @@ internal static class DotNetToolsJsonUpdater
         if (!containsDependency)
         {
             logger.Info($"    Dependency [{dependencyName}] not found.");
-            return;
+            return null;
         }
 
         var tool = dotnetToolsJsonFile.Tools
@@ -40,7 +40,10 @@ internal static class DotNetToolsJsonUpdater
             if (await dotnetToolsJsonFile.SaveAsync())
             {
                 logger.Info($"    Saved [{dotnetToolsJsonFile.RelativePath}].");
+                return dotnetToolsJsonFile.Path;
             }
         }
+
+        return null;
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/FileWriters/FileWriterWorker.cs

@@ -0,0 +1,326 @@
+using System.Collections.Immutable;
+
+using NuGet.Versioning;
+
+using NuGetUpdater.Core.DependencySolver;
+using NuGetUpdater.Core.Discover;
+using NuGetUpdater.Core.Utilities;
+
+namespace NuGetUpdater.Core.Updater.FileWriters;
+
+public class FileWriterWorker
+{
+    private readonly IDiscoveryWorker _discoveryWorker;
+    private readonly IDependencySolver _dependencySolver;
+    private readonly IFileWriter _fileWriter;
+    private readonly ILogger _logger;
+
+    public FileWriterWorker(IDiscoveryWorker discoveryWorker, IDependencySolver dependencySolver, IFileWriter fileWriter, ILogger logger)
+    {
+        _discoveryWorker = discoveryWorker;
+        _dependencySolver = dependencySolver;
+        _fileWriter = fileWriter;
+        _logger = logger;
+    }
+
+    public async Task<ImmutableArray<UpdateOperationBase>> RunAsync(
+        DirectoryInfo repoContentsPath,
+        FileInfo projectPath,
+        string dependencyName,
+        NuGetVersion oldDependencyVersion,
+        NuGetVersion newDependencyVersion
+    )
+    {
+        var updateOperations = new List<UpdateOperationBase>();
+        var projectDirectory = Path.GetDirectoryName(projectPath.FullName)!;
+        var projectDirectoryRelativeToRepoRoot = Path.GetRelativePath(repoContentsPath.FullName, projectDirectory).FullyNormalizedRootedPath();
+
+        // first try non-project updates
+        var updatedDotNetToolsPath = await DotNetToolsJsonUpdater.UpdateDependencyAsync(
+            repoContentsPath.FullName,
+            projectDirectory,
+            dependencyName,
+            oldDependencyVersion.ToString(),
+            newDependencyVersion.ToString(),
+            _logger
+        );
+        if (updatedDotNetToolsPath is not null)
+        {
+            updateOperations.Add(new DirectUpdate()
+            {
+                DependencyName = dependencyName,
+                OldVersion = oldDependencyVersion,
+                NewVersion = newDependencyVersion,
+                UpdatedFiles = [Path.GetRelativePath(repoContentsPath.FullName, updatedDotNetToolsPath).FullyNormalizedRootedPath()]
+            });
+        }
+
+        var updatedGlobalJsonPath = await GlobalJsonUpdater.UpdateDependencyAsync(
+            repoContentsPath.FullName,
+            projectDirectory,
+            dependencyName,
+            oldDependencyVersion.ToString(),
+            newDependencyVersion.ToString(),
+            _logger
+        );
+        if (updatedGlobalJsonPath is not null)
+        {
+            updateOperations.Add(new DirectUpdate()
+            {
+                DependencyName = dependencyName,
+                OldVersion = oldDependencyVersion,
+                NewVersion = newDependencyVersion,
+                UpdatedFiles = [Path.GetRelativePath(repoContentsPath.FullName, updatedGlobalJsonPath).FullyNormalizedRootedPath()]
+            });
+        }
+
+        // then try packages.config updates
+        var additionalFiles = ProjectHelper.GetAllAdditionalFilesFromProject(projectPath.FullName, ProjectHelper.PathFormat.Full);
+        var packagesConfigFullPath = additionalFiles.Where(p => Path.GetFileName(p).Equals(ProjectHelper.PackagesConfigFileName, StringComparison.OrdinalIgnoreCase)).FirstOrDefault();
+        if (packagesConfigFullPath is not null)
+        {
+            var packagesConfigOperations = await PackagesConfigUpdater.UpdateDependencyAsync(
+                repoContentsPath.FullName,
+                projectPath.FullName,
+                dependencyName,
+                oldDependencyVersion.ToString(),
+                newDependencyVersion.ToString(),
+                packagesConfigFullPath,
+                _logger
+            );
+            var packagesConfigOperationsWithNormalizedPaths = packagesConfigOperations
+                .Select(op => op with { UpdatedFiles = [.. op.UpdatedFiles.Select(f => Path.GetRelativePath(repoContentsPath.FullName, f).FullyNormalizedRootedPath())] })
+                .ToArray();
+            updateOperations.AddRange(packagesConfigOperationsWithNormalizedPaths);
+        }
+
+        // then try project updates
+        var initialDiscoveryResult = await _discoveryWorker.RunAsync(repoContentsPath.FullName, projectDirectoryRelativeToRepoRoot);
+        var initialProjectDiscovery = initialDiscoveryResult.GetProjectDiscoveryFromFullPath(repoContentsPath, projectPath);
+        if (initialProjectDiscovery is null)
+        {
+            _logger.Info($"Unable to find project discovery for project {projectPath}.");
+            return [.. updateOperations];
+        }
+
+        var initialRequestedDependency = initialProjectDiscovery.Dependencies
+            .FirstOrDefault(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase));
+        if (initialRequestedDependency is null || initialRequestedDependency.Version is null)
+        {
+            _logger.Info($"Dependency {dependencyName} not found in initial project discovery.");
+            return [.. updateOperations];
+        }
+
+        var initialDependencyVersion = NuGetVersion.Parse(initialRequestedDependency.Version);
+        if (initialDependencyVersion >= newDependencyVersion)
+        {
+            _logger.Info($"Dependency {dependencyName} is already at version {initialDependencyVersion}, no update needed.");
+            return [.. updateOperations];
+        }
+
+        var initialTopLevelDependencies = initialProjectDiscovery.Dependencies
+            .Where(d => !d.IsTransitive)
+            .ToImmutableArray();
+        var newDependency = new Dependency(dependencyName, newDependencyVersion.ToString(), DependencyType.Unknown);
+        var desiredDependencies = initialTopLevelDependencies.Any(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase))
+            ? initialTopLevelDependencies.Select(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase) ? newDependency : d).ToImmutableArray()
+            : initialTopLevelDependencies.Concat([newDependency]).ToImmutableArray();
+
+        foreach (var targetFramework in initialProjectDiscovery.TargetFrameworks)
+        {
+            var resolvedDependencies = await _dependencySolver.SolveAsync(initialTopLevelDependencies, desiredDependencies, targetFramework);
+            if (resolvedDependencies is null)
+            {
+                _logger.Warn($"Unable to solve dependency conflicts for target framework {targetFramework}.");
+                continue;
+            }
+
+            var resolvedRequestedDependency = resolvedDependencies.Value
+                .SingleOrDefault(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase));
+            if (resolvedRequestedDependency is null || resolvedRequestedDependency.Version is null)
+            {
+                _logger.Warn($"Dependency resolution failed to include {dependencyName}.");
+                continue;
+            }
+
+            var resolvedRequestedDependencyVersion = NuGetVersion.Parse(resolvedRequestedDependency.Version);
+            if (resolvedRequestedDependencyVersion != newDependencyVersion)
+            {
+                _logger.Warn($"Requested dependency resolution to include {dependencyName}/{newDependencyVersion} but it was instead resolved to {resolvedRequestedDependencyVersion}.");
+                continue;
+            }
+
+            // process all projects bottom up
+            var orderedProjectDiscovery = GetProjectDiscoveryEvaluationOrder(repoContentsPath, initialDiscoveryResult, projectPath, _logger);
+
+            // track original contents
+            var originalFileContents = await GetOriginalFileContentsAsync(repoContentsPath, new DirectoryInfo(projectDirectory), orderedProjectDiscovery);
+
+            var allUpdatedFiles = new List<string>();
+            foreach (var projectDiscovery in orderedProjectDiscovery)
+            {
+                var projectFullPath = Path.Join(repoContentsPath.FullName, initialDiscoveryResult.Path, projectDiscovery.FilePath).FullyNormalizedRootedPath();
+                var updatedFiles = await TryPerformFileWritesAsync(repoContentsPath, new FileInfo(projectFullPath), projectDiscovery, resolvedDependencies.Value);
+                allUpdatedFiles.AddRange(updatedFiles);
+            }
+
+            if (allUpdatedFiles.Count == 0)
+            {
+                _logger.Warn("Failed to write new dependency versions.");
+                await RestoreOriginalFileContentsAsync(originalFileContents);
+                continue;
+            }
+
+            // this final call to discover has the benefit of also updating the lock file if it exists
+            var finalDiscoveryResult = await _discoveryWorker.RunAsync(repoContentsPath.FullName, projectDirectoryRelativeToRepoRoot);
+            var finalProjectDiscovery = finalDiscoveryResult.GetProjectDiscoveryFromFullPath(repoContentsPath, projectPath);
+            if (finalProjectDiscovery is null)
+            {
+                _logger.Warn($"Unable to find final project discovery for project {projectPath}.");
+                await RestoreOriginalFileContentsAsync(originalFileContents);
+                continue;
+            }
+
+            var finalRequestedDependency = finalProjectDiscovery.Dependencies
+                .FirstOrDefault(d => d.Name.Equals(dependencyName, StringComparison.OrdinalIgnoreCase));
+            if (finalRequestedDependency is null || finalRequestedDependency.Version is null)
+            {
+                _logger.Warn($"Dependency {dependencyName} not found in final project discovery.");
+                await RestoreOriginalFileContentsAsync(originalFileContents);
+                continue;
+            }
+
+            var resolvedVersion = NuGetVersion.Parse(finalRequestedDependency.Version);
+            if (resolvedVersion != newDependencyVersion)
+            {
+                _logger.Warn($"Final dependency version for {dependencyName} is {resolvedVersion}, expected {newDependencyVersion}.");
+                await RestoreOriginalFileContentsAsync(originalFileContents);
+                continue;
+            }
+
+            var computedUpdateOperations = await PackageReferenceUpdater.ComputeUpdateOperations(
+                repoContentsPath.FullName,
+                projectPath.FullName,
+                targetFramework,
+                initialTopLevelDependencies,
+                desiredDependencies,
+                resolvedDependencies.Value,
+                new ExperimentsManager() { UseDirectDiscovery = true },
+                _logger);
+            var filteredUpdateOperations = computedUpdateOperations
+                .Where(op =>
+                {
+                    var initialDependency = initialProjectDiscovery.Dependencies.FirstOrDefault(d => d.Name.Equals(op.DependencyName, StringComparison.OrdinalIgnoreCase));
+                    return initialDependency is not null
+                        && initialDependency.Version is not null
+                        && NuGetVersion.Parse(initialDependency.Version) < op.NewVersion;
+                })
+                .ToImmutableArray();
+            var computedOperationsWithUpdatedFiles = filteredUpdateOperations
+                .Select(op => op with { UpdatedFiles = [.. allUpdatedFiles] })
+                .ToImmutableArray();
+            updateOperations.AddRange(computedOperationsWithUpdatedFiles);
+        }
+
+        var normalizedUpdateOperations = UpdateOperationBase.NormalizeUpdateOperationCollection(repoContentsPath.FullName, updateOperations);
+        return normalizedUpdateOperations;
+    }
+
+    internal static async Task<Dictionary<string, string>> GetOriginalFileContentsAsync(DirectoryInfo repoContentsPath, DirectoryInfo initialStartingDirectory, IEnumerable<ProjectDiscoveryResult> projectDiscoveryResults)
+    {
+        var filesAndContents = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var projectDiscoveryResult in projectDiscoveryResults)
+        {
+            var fullProjectPath = Path.Join(initialStartingDirectory.FullName, projectDiscoveryResult.FilePath).FullyNormalizedRootedPath();
+            var projectContents = await File.ReadAllTextAsync(fullProjectPath);
+            filesAndContents[fullProjectPath] = projectContents;
+
+            foreach (var file in projectDiscoveryResult.ImportedFiles.Concat(projectDiscoveryResult.AdditionalFiles))
+            {
+                var filePath = Path.Join(Path.GetDirectoryName(fullProjectPath)!, file).FullyNormalizedRootedPath();
+                var fileContents = await File.ReadAllTextAsync(filePath);
+                filesAndContents[filePath] = fileContents;
+            }
+        }
+
+        return filesAndContents;
+    }
+
+    internal static async Task RestoreOriginalFileContentsAsync(Dictionary<string, string> originalFilesAndContents)
+    {
+        foreach (var (path, contents) in originalFilesAndContents)
+        {
+            await File.WriteAllTextAsync(path, contents);
+        }
+    }
+
+    internal static ImmutableArray<ProjectDiscoveryResult> GetProjectDiscoveryEvaluationOrder(DirectoryInfo repoContentsPath, WorkspaceDiscoveryResult discoveryResult, FileInfo projectPath, ILogger logger)
+    {
+        var visitedProjectPaths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var projectsToProcess = new Queue<ProjectDiscoveryResult>();
+        var startingProjectDiscovery = discoveryResult.GetProjectDiscoveryFromFullPath(repoContentsPath, projectPath);
+        if (startingProjectDiscovery is null)
+        {
+            logger.Warn($"Unable to find project discovery for project {projectPath.FullName} in discovery result.");
+            return [];
+        }
+
+        projectsToProcess.Enqueue(startingProjectDiscovery);
+
+        var reversedProjectDiscoveryOrder = new List<ProjectDiscoveryResult>();
+        while (projectsToProcess.TryDequeue(out var projectDiscovery))
+        {
+            var projectFullPath = Path.Join(repoContentsPath.FullName, discoveryResult.Path, projectDiscovery.FilePath).FullyNormalizedRootedPath();
+            if (visitedProjectPaths.Add(projectFullPath))
+            {
+                reversedProjectDiscoveryOrder.Add(projectDiscovery);
+                foreach (var referencedProjectPath in projectDiscovery.ReferencedProjectPaths)
+                {
+                    var referencedProjectFullPath = Path.Join(repoContentsPath.FullName, discoveryResult.Path, referencedProjectPath).FullyNormalizedRootedPath();
+                    var referencedProjectDiscovery = discoveryResult.GetProjectDiscoveryFromFullPath(repoContentsPath, new FileInfo(referencedProjectFullPath));
+                    if (referencedProjectDiscovery is not null)
+                    {
+                        projectsToProcess.Enqueue(referencedProjectDiscovery);
+                    }
+                }
+            }
+        }
+
+        var projectDiscoveryOrder = ((IEnumerable<ProjectDiscoveryResult>)reversedProjectDiscoveryOrder)
+            .Reverse()
+            .ToImmutableArray();
+        return projectDiscoveryOrder;
+    }
+
+    private async Task<ImmutableArray<string>> TryPerformFileWritesAsync(DirectoryInfo repoContentsPath, FileInfo projectPath, ProjectDiscoveryResult projectDiscovery, ImmutableArray<Dependency> requiredPackageVersions)
+    {
+        var originalFileContents = await GetOriginalFileContentsAsync(repoContentsPath, projectPath.Directory!, [projectDiscovery]);
+        var relativeFilePaths = originalFileContents.Keys
+            .Select(p => Path.GetRelativePath(repoContentsPath.FullName, p).FullyNormalizedRootedPath())
+            .ToImmutableArray();
+
+        // try update
+        var addPackageReferenceElementForPinnedPackages = !projectDiscovery.CentralPackageTransitivePinningEnabled;
+        var success = await _fileWriter.UpdatePackageVersionsAsync(repoContentsPath, [.. relativeFilePaths], projectDiscovery.Dependencies, requiredPackageVersions, addPackageReferenceElementForPinnedPackages);
+        var updatedFiles = new List<string>();
+        foreach (var (filePath, originalContents) in originalFileContents)
+        {
+            var currentContents = await File.ReadAllTextAsync(filePath);
+            var currentContentsNormalized = currentContents.Replace("\r", "");
+            var originalContentsNormalized = originalContents.Replace("\r", "");
+            if (currentContentsNormalized != originalContentsNormalized)
+            {
+                var relativeUpdatedPath = Path.GetRelativePath(repoContentsPath.FullName, filePath).FullyNormalizedRootedPath();
+                updatedFiles.Add(relativeUpdatedPath);
+            }
+        }
+
+        if (!success)
+        {
+            await RestoreOriginalFileContentsAsync(originalFileContents);
+        }
+
+        var sortedUpdatedFiles = updatedFiles.OrderBy(p => p, StringComparer.Ordinal);
+        return [.. sortedUpdatedFiles];
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/FileWriters/IFileWriter.cs

@@ -0,0 +1,14 @@
+using System.Collections.Immutable;
+
+namespace NuGetUpdater.Core.Updater.FileWriters;
+
+public interface IFileWriter
+{
+    Task<bool> UpdatePackageVersionsAsync(
+        DirectoryInfo repoContentsPath,
+        ImmutableArray<string> relativeFilePaths,
+        ImmutableArray<Dependency> originalDependencies,
+        ImmutableArray<Dependency> requiredPackageVersions,
+        bool addPackageReferenceElementForPinnedPackages
+    );
+}