dependabot-nuget 0.334.0 → 0.336.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5bc345f5a8be77b0f05bc15e1b0a59d0d3ccff75e11d29a6947bd43fa29e51a
-  data.tar.gz: adc18fffb9a39e742ddacfa761693070290b0b0679fa9c2ca5193694e02d9f47
+  metadata.gz: ae7e221b443446fad04c540ccf1c387e23140d8f15713009f3c6cdca041ad3c8
+  data.tar.gz: 5bf10dd5fe3cece122ff6036c1bd3edec248bd3d7577cbb755f0a66b7bba1cf1
 SHA512:
-  metadata.gz: f7e0a0f0bc859b36a0ddc02bb1e77418c56108cfe1993665598742f74fc2191f574ad7063b73b09a579864b13921db088509423ebb93bb3716a2cce5e95c3c5b
-  data.tar.gz: c39e5e3021996dad4a12616f79beb0493e47fa81baa75e23aaf192d9acfc0dc067720137184b22088d0ea7e7e2e35108f8ba50717e4393b9a21f2547b21485c7
+  metadata.gz: 78e85cc21c5104c4437c43b3b8a2c5d365a3e57a84e88959daf909e3b76dc98cacdd4da2c0558f28609f05ebd5b7c97975e78546f6a2974056545fef47620411
+  data.tar.gz: a53e743e86f5b4830a19d58c610f40a3686bdf5d80b05a2d2eab062710a677ec09a8f9eaa2683667370b7d2e6f510983bfb89806adf5c79a3c3c0ae450e1fb58

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -635,6 +635,14 @@ internal static class SdkProjectDiscovery
 
                         if (doAddOperation)
                         {
+                            var isImplicitlyDefined = GetChildMetadataBooleanValue(child, "IsImplicitlyDefined");
+                            if (isImplicitlyDefined)
+                            {
+                                // packages with `IsImplicitlyDefined="true"` aren't to be treated as top-level packages and shouldn't be candidates for regular update operations
+                                // they should still appear in the discovery list, though, so security jobs can update them as necessary
+                                continue;
+                            }
+
                             topLevelPackagesPerTfm.Add(packageName);
                             var packageVersion = GetChildMetadataValue(child, "Version");
                             if (packageVersion is not null)
@@ -727,6 +735,13 @@ internal static class SdkProjectDiscovery
         return metadataValue;
     }
 
+    private static bool GetChildMetadataBooleanValue(TreeNode node, string metadataItemName)
+    {
+        var metadataString = GetChildMetadataValue(node, metadataItemName);
+        var metadataBooleanValue = bool.TryParse(metadataString, out var parsedMetadataValue) && parsedMetadataValue;
+        return metadataBooleanValue;
+    }
+
     private static ProjectEvaluation? GetNearestProjectEvaluation(BaseNode node)
     {
         // we need to find the containing project evaluation

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTestBase.cs

@@ -20,15 +20,17 @@ public class DiscoveryWorkerTestBase : TestBase
         ExpectedWorkspaceDiscoveryResult expectedResult,
         MockNuGetPackage[]? packages = null,
         bool includeCommonPackages = true,
-        ExperimentsManager? experimentsManager = null)
+        ExperimentsManager? experimentsManager = null,
+        string? repoContentsPath = null)
     {
         experimentsManager ??= new ExperimentsManager();
         var actualResult = await RunDiscoveryAsync(files, async directoryPath =>
         {
             await UpdateWorkerTestBase.MockNuGetPackagesInDirectory(packages, directoryPath, includeCommonPackages: includeCommonPackages);
 
+            repoContentsPath ??= directoryPath;
             var worker = new DiscoveryWorker("TEST-JOB-ID", experimentsManager, new TestLogger());
-            var result = await worker.RunWithErrorHandlingAsync(directoryPath, workspacePath);
+            var result = await worker.RunWithErrorHandlingAsync(repoContentsPath, workspacePath);
             return result;
         });
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs

@@ -1462,4 +1462,53 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
             }
         );
     }
+
+    [Fact]
+    public async Task ImplicitlyDefinedPackagesAreMarkedAsIndirect()
+    {
+        // packages auto-added by the SDK have extra metadata IsImplicitlyDefined=true, but for the sake of a unit test we can fake it
+        await TestDiscoveryAsync(
+            packages: [
+                MockNuGetPackage.CreateSimplePackage("Package.A", "1.0.0", "net9.0"),
+                MockNuGetPackage.CreateSimplePackage("Package.B", "2.0.0", "net9.0"),
+            ],
+            workspacePath: "src",
+            files: [
+                ("src/project.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net9.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Package.A" Version="1.0.0" />
+
+                        <!-- this package fakes the IsImplicitlyDefined metadata to appear like it came from the SDK -->
+                        <PackageReference Include="Package.B" Version="2.0.0" IsImplicitlyDefined="true" />
+                      </ItemGroup>
+                    </Project>
+                    """)
+            ],
+            expectedResult: new()
+            {
+                Path = "src",
+                Projects = [
+                    new()
+                    {
+                        FilePath = "project.csproj",
+                        TargetFrameworks = ["net9.0"],
+                        Dependencies = [
+                            new("Package.A", "1.0.0", DependencyType.PackageReference, TargetFrameworks: ["net9.0"], IsDirect: true),
+                            new("Package.B", "2.0.0", DependencyType.Unknown, TargetFrameworks: ["net9.0"], IsDirect: false, IsTransitive: true),
+                        ],
+                        Properties = [
+                            new("TargetFramework", "net9.0", "src/project.csproj"),
+                        ],
+                        ReferencedProjectPaths = [],
+                        ImportedFiles = [],
+                        AdditionalFiles = [],
+                    }
+                ]
+            }
+        );
+    }
 }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.334.0
+  version: 0.336.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.334.0
+        version: 0.336.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.334.0
+        version: 0.336.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -113,56 +113,56 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.67'
+        version: '1.80'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.67'
+        version: '1.80'
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.22'
+        version: '1.26'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.22'
+        version: '1.26'
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.29'
+        version: '3.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.29'
+        version: '3.7'
 - !ruby/object:Gem::Dependency
   name: rubocop-sorbet
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.8'
+        version: '0.10'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.8'
+        version: '0.10'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -551,7 +551,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.334.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.336.0
 rdoc_options: []
 require_paths:
 - lib