dependabot-nuget 0.356.0 → 0.358.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56027ed62ebd863237630c55bc289bd083c5606979410af2925657c88dcbcf75
-  data.tar.gz: bb8377eb0d13add9bc1c6b8240c1d832ac5b2d641b817f19feaa6762b81cb90b
+  metadata.gz: 1f734a157182687168706919b25626d787c053b98ce66d83d58752fd77215a6e
+  data.tar.gz: 651030c7a22e6743b54a594f93b41973d4ffd288d95145b07e744b87885e0375
 SHA512:
-  metadata.gz: 85d78b0b4d3535e570193ea3e19b8ffec884377d46eb1400ad5d6ac2f69d69fd9e9ab883f2f185360f40506500212bcdc4cf9044a2317a4359bee2e4b7942662
-  data.tar.gz: e51b2ff7c2cba64483a1f941c2707b4d2d8dfc7dee7221b1c13aa6cce4766e3b30816858711a7812a0a99e55d4e2a7abd7fb207af4ac2231030a3b4be388f255
+  metadata.gz: 05df81e52c4479ffaba35307989abab53fe28209d4cdd29277ab835a5f24224b6655a0d29f2d2f76a285a64af8b54bd6866cde673b38b7f125a3af1440ff94d2
+  data.tar.gz: 8652832c636b18da24146671415f1e4f582e8998329f8d2e16c523a97c3d1e59b64db2065548b13aae0fe73a383b8817dd97111959a121901d012e8c07312712

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -5,15 +5,14 @@ using System.Xml.XPath;
 
 using Microsoft.Build.Logging.StructuredLogger;
 
-using NuGet;
 using NuGet.Frameworks;
-using NuGet.Versioning;
 
 using NuGetUpdater.Core.Utilities;
 
 using Semver;
 
 using LoggerProperty = Microsoft.Build.Logging.StructuredLogger.Property;
+using ThreadingTask = System.Threading.Tasks.Task;
 
 namespace NuGetUpdater.Core.Discover;
 
@@ -21,7 +20,8 @@ internal static class SdkProjectDiscovery
 {
     private static readonly HashSet<string> TopLevelPackageItemNames = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
     {
-        "PackageReference"
+        "PackageReference",
+        "GlobalPackageReference",
     };
 
     private static readonly HashSet<string> PackageVersionItemNames = new HashSet<string>(StringComparer.Ordinal)
@@ -84,8 +84,8 @@ internal static class SdkProjectDiscovery
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject = new(PathComparer.Instance);
         //    projectPath                tfm        packageName  packageVersion
 
-        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject = new(PathComparer.Instance);
-        //    projectPath                tfm, packageNames
+        Dictionary<string, Dictionary<string, HashSet<string>>> implicitlyIgnoredPackages = new(PathComparer.Instance);
+        //    projectPath                tfm  packageNames
 
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> explicitPackageVersionsPerProject = new(PathComparer.Instance);
         //    projectPath,               tfm,       packageName, packageVersion
@@ -222,7 +222,7 @@ internal static class SdkProjectDiscovery
                             }
                             break;
                         case NamedNode namedNode when namedNode is AddItem or RemoveItem:
-                            ProcessResolvedPackageReference(namedNode, packagesPerProject, topLevelPackagesPerProject, explicitPackageVersionsPerProject, packageReferenceElementCounts);
+                            ProcessResolvedPackageReference(namedNode, packagesPerProject, implicitlyIgnoredPackages, explicitPackageVersionsPerProject, packageReferenceElementCounts);
 
                             if (namedNode is AddItem addItem)
                             {
@@ -409,12 +409,13 @@ internal static class SdkProjectDiscovery
             packagesPerProject,
             explicitPackageVersionsPerProject,
             packagesReplacedBySdkPerProject,
-            topLevelPackagesPerProject,
+            implicitlyIgnoredPackages,
             resolvedProperties,
             packageDependencies,
             referencedProjects,
             importedFiles,
-            additionalFiles
+            additionalFiles,
+            logger
         );
         return projectDiscoveryResults;
     }
@@ -425,18 +426,20 @@ internal static class SdkProjectDiscovery
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject,
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packageVersionsPerProject,
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesReplacedBySdkPerProject,
-        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject,
+        Dictionary<string, Dictionary<string, HashSet<string>>> implicitlyIgnoredPackagesPerProject,
         Dictionary<string, Dictionary<string, string>> resolvedProperties,
         Dictionary<string, Dictionary<string, HashSet<string>>> packageDependencies,
         Dictionary<string, HashSet<string>> referencedProjects,
         Dictionary<string, HashSet<string>> importedFiles,
-        Dictionary<string, HashSet<string>> additionalFiles
+        Dictionary<string, HashSet<string>> additionalFiles,
+        ILogger logger
     )
     {
         var projectDiscoveryResults = new List<ProjectDiscoveryResult>();
         foreach (var projectPath in packagesPerProject.Keys.OrderBy(p => p))
         {
             // gather some project-level information
+            var implicitlyIgnoredPackagesByTfm = implicitlyIgnoredPackagesPerProject.GetValueOrDefault(projectPath, new(StringComparer.OrdinalIgnoreCase));
             var packagesByTfm = packagesPerProject[projectPath];
             if (packagesReplacedBySdkPerProject.TryGetValue(projectPath, out var packagesReplacedBySdk))
             {
@@ -470,10 +473,6 @@ internal static class SdkProjectDiscovery
             var localPropertyDefinitionElements = doc.Root!.XPathSelectElements("/Project/PropertyGroup/*");
             var projectPropertyNames = localPropertyDefinitionElements.Select(e => e.Name.LocalName).ToHashSet(StringComparer.OrdinalIgnoreCase);
             var projectRelativePath = Path.GetRelativePath(workspacePath, projectPath);
-            var topLevelPackageNames = topLevelPackagesPerProject
-                .GetOrAdd(projectPath, () => new(StringComparer.OrdinalIgnoreCase))
-                .SelectMany(kvp => kvp.Value)
-                .ToHashSet(StringComparer.OrdinalIgnoreCase);
 
             var propertiesForProject = resolvedProperties.GetOrAdd(projectPath, () => new(StringComparer.OrdinalIgnoreCase));
             var assetsJson = new Lazy<JsonElement?>(() =>
@@ -488,6 +487,33 @@ internal static class SdkProjectDiscovery
                 return null;
             });
 
+            // track imported files
+            var imported = importedFiles.GetOrAdd(projectPath, () => new(PathComparer.Instance))
+                .Select(p => Path.GetRelativePath(projectFullDirectory, p))
+                .Select(p => p.NormalizePathToUnix())
+                .OrderBy(p => p)
+                .ToImmutableArray();
+
+            // track packages imported directly by the project and its imports
+            var directlyReferencedPackagesPerFile = new Dictionary<string, HashSet<string>>(StringComparer.OrdinalIgnoreCase);
+            async ThreadingTask EnsurePackagesForFileAsync(string fullFilePath)
+            {
+                if (!directlyReferencedPackagesPerFile.ContainsKey(fullFilePath))
+                {
+                    var packages = await DirectlyReferencedPackagesFromFilePath(fullFilePath, logger);
+                    directlyReferencedPackagesPerFile[fullFilePath] = packages;
+                }
+            }
+            await EnsurePackagesForFileAsync(projectPath);
+            foreach (var importedPath in imported)
+            {
+                var fullImportedPath = Path.Combine(projectFullDirectory, importedPath);
+                await EnsurePackagesForFileAsync(fullImportedPath);
+            }
+            var directlyReferencedPackages = directlyReferencedPackagesPerFile.Values
+                .SelectMany(p => p)
+                .ToHashSet(StringComparer.OrdinalIgnoreCase);
+
             // create dependencies
             var tfms = packagesByTfm.Keys.OrderBy(tfm => tfm).ToImmutableArray();
             var groupedDependencies = new Dictionary<string, Dependency>(StringComparer.OrdinalIgnoreCase);
@@ -495,6 +521,7 @@ internal static class SdkProjectDiscovery
             {
                 var parsedTfm = NuGetFramework.Parse(tfm);
                 var packages = packagesByTfm[tfm];
+                var implicitlyIgnoredPackages = implicitlyIgnoredPackagesByTfm.GetValueOrDefault(tfm, new(StringComparer.OrdinalIgnoreCase));
 
                 // augment with any packages that might not have reported assemblies
                 var assetsPackageVersions = new Lazy<Dictionary<string, string>>(() =>
@@ -547,7 +574,7 @@ internal static class SdkProjectDiscovery
                 {
                     var packageName = package.Key;
                     var packageVersion = package.Value;
-                    var isTopLevel = topLevelPackageNames.Contains(packageName);
+                    var isTopLevel = directlyReferencedPackages.Contains(packageName) && !implicitlyIgnoredPackages.Contains(packageName);
                     var dependencyType = isTopLevel ? DependencyType.PackageReference : DependencyType.Unknown;
                     var combinedTfms = new HashSet<string>([tfm], StringComparer.OrdinalIgnoreCase);
                     if (groupedDependencies.TryGetValue(packageName, out var existingDependency) &&
@@ -580,11 +607,6 @@ internal static class SdkProjectDiscovery
                 .Select(p => Path.GetRelativePath(projectFullDirectory, p).NormalizePathToUnix())
                 .OrderBy(p => p)
                 .ToImmutableArray();
-            var imported = importedFiles.GetOrAdd(projectPath, () => new(PathComparer.Instance))
-                .Select(p => Path.GetRelativePath(projectFullDirectory, p))
-                .Select(p => p.NormalizePathToUnix())
-                .OrderBy(p => p)
-                .ToImmutableArray();
             var additionalFromLocation = ProjectHelper.GetAdditionalFilesFromProjectLocation(projectPath, ProjectHelper.PathFormat.Full);
             var additional = additionalFiles.GetOrAdd(projectPath, () => new(PathComparer.Instance))
                 .Concat(additionalFromLocation)
@@ -616,6 +638,31 @@ internal static class SdkProjectDiscovery
         return projectDiscoveryResults.ToImmutableArray();
     }
 
+    private static async Task<HashSet<string>> DirectlyReferencedPackagesFromFilePath(string fullFilePath, ILogger logger)
+    {
+        try
+        {
+            var content = await File.ReadAllTextAsync(fullFilePath);
+            var doc = XDocument.Parse(content);
+            var packages = doc.Descendants()
+                .Where(e => TopLevelPackageItemNames.Contains(e.Name.LocalName))
+                .SelectMany(e =>
+                {
+                    var includesText = e.Attribute("Include")?.Value ?? string.Empty;
+                    var updateText = e.Attribute("Update")?.Value ?? string.Empty;
+                    return includesText.Split([';'], StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+                        .Concat(updateText.Split([';'], StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries));
+                })
+                .ToHashSet(StringComparer.OrdinalIgnoreCase);
+            return packages;
+        }
+        catch
+        {
+            logger.Warn($"Unable to determine directly referenced packages from file {fullFilePath}");
+            return [];
+        }
+    }
+
     private static async Task<Dictionary<string, Dictionary<string, Dictionary<string, string>>>> RebuildPackagesPerProject(
         string repoRootPath,
         string projectPath,
@@ -673,7 +720,7 @@ internal static class SdkProjectDiscovery
     private static void ProcessResolvedPackageReference(
         NamedNode node,
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject, // projectPath -> tfm -> (packageName, packageVersion)
-        Dictionary<string, Dictionary<string, HashSet<string>>> topLevelPackagesPerProject, // projectPath -> tfm -> packageName
+        Dictionary<string, Dictionary<string, HashSet<string>>> implicitlyIgnoredPackagesPerProject, // projectPath -> tfm -> packageNames
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packageVersionsPerProject, // projectPath -> tfm -> (packageName, packageVersion)
         Dictionary<string, int> packageReferenceElementCounts // projectPath -> count of `<PackageReference>` elements
     )
@@ -694,21 +741,9 @@ internal static class SdkProjectDiscovery
                         continue;
                     }
 
-                    // count instances of `<PackageReference>`
-                    //var packageReferenceElements = packageReferenceElementCounts.GetOrAdd(projectEvaluation.ProjectFile, () => 0);
-                    //packageReferenceElementCounts[projectEvaluation.ProjectFile] = packageReferenceElements + 1;
-
                     var tfm = GetTargetFrameworkFromProjectEvaluation(projectEvaluation);
                     if (tfm is not null)
                     {
-                        var topLevelPackages = topLevelPackagesPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
-                        var topLevelPackagesPerTfm = topLevelPackages.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
-
-                        if (doRemoveOperation)
-                        {
-                            topLevelPackagesPerTfm.Remove(packageName);
-                        }
-
                         if (doAddOperation)
                         {
                             var isImplicitlyDefined = GetChildMetadataBooleanValue(child, "IsImplicitlyDefined");
@@ -716,10 +751,12 @@ internal static class SdkProjectDiscovery
                             {
                                 // packages with `IsImplicitlyDefined="true"` aren't to be treated as top-level packages and shouldn't be candidates for regular update operations
                                 // they should still appear in the discovery list, though, so security jobs can update them as necessary
+                                var implicitlyIgnoredPerTfm = implicitlyIgnoredPackagesPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(StringComparer.OrdinalIgnoreCase));
+                                var implicitlyIgnoredPackages = implicitlyIgnoredPerTfm.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
+                                implicitlyIgnoredPackages.Add(packageName);
                                 continue;
                             }
 
-                            topLevelPackagesPerTfm.Add(packageName);
                             var packageVersion = GetChildMetadataValue(child, "Version");
                             if (packageVersion is not null)
                             {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs

@@ -27,7 +27,7 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
         {
             // this package ships with the SDK and is automatically added for F# projects but should be manually added here to make the test consistent
             // only direct package discovery finds this, though
-            expectedDependencies.Add(new Dependency("FSharp.Core", MockNuGetPackage.FSharpCorePackageVersion.Value, DependencyType.PackageReference, TargetFrameworks: ["net8.0"], IsDirect: true));
+            expectedDependencies.Add(new Dependency("FSharp.Core", MockNuGetPackage.FSharpCorePackageVersion.Value, DependencyType.Unknown, TargetFrameworks: ["net8.0"], IsDirect: false, IsTransitive: true));
         }
 
         await TestDiscoveryAsync(
@@ -618,6 +618,179 @@ public partial class DiscoveryWorkerTests : DiscoveryWorkerTestBase
         );
     }
 
+    [Fact]
+    public async Task SdkPackagesAreReportedAppropriately()
+    {
+        // msbuild sdk has <PackageReference> element that should be reported as a transitive dependency
+        await TestDiscoveryAsync(
+            packages: [
+                MockNuGetPackage.CreateSimplePackage("Transitive.Package", "2.0.0", "net9.0"),
+                MockNuGetPackage.CreateMSBuildSdkPackage("TestSdk", "1.0.0",
+                    sdkPropsContent: """
+                        <Project>
+                          <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+                        </Project>
+                        """,
+                    sdkTargetsContent: """
+                        <Project>
+                          <ItemGroup>
+                            <PackageReference Include="Transitive.Package" Version="2.0.0" />
+                          </ItemGroup>
+                          <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+                        </Project>
+                        """
+                    )
+            ],
+            workspacePath: "src",
+            files: [
+                ("src/project.csproj", """
+                    <Project Sdk="TestSdk">
+                      <PropertyGroup>
+                        <TargetFramework>net9.0</TargetFramework>
+                      </PropertyGroup>
+                    </Project>
+                    """),
+                ("Directory.Build.props", "<Project />"),
+                ("Directory.Build.targets", "<Project />"),
+                ("Directory.Packages.props", """
+                    <Project>
+                      <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+                      </PropertyGroup>
+                    </Project>
+                    """),
+                ("global.json", """
+                    {
+                      "msbuild-sdks": {
+                        "TestSdk": "1.0.0"
+                      }
+                    }
+                    """),
+            ],
+            expectedResult: new()
+            {
+                Path = "src",
+                Projects = [
+                    new()
+                    {
+                        FilePath = "project.csproj",
+                        TargetFrameworks = ["net9.0"],
+                        Dependencies = [
+                            new("Transitive.Package", "2.0.0", DependencyType.Unknown, TargetFrameworks: ["net9.0"], IsDirect: false, IsTransitive: true),
+                        ],
+                        Properties = [
+                            new("TargetFramework", "net9.0", "src/project.csproj")
+                        ],
+                        ReferencedProjectPaths = [],
+                        ImportedFiles = [
+                            "../Directory.Build.props",
+                            "../Directory.Build.targets",
+                            "../Directory.Packages.props",
+                        ],
+                        AdditionalFiles = [],
+                    }
+                ],
+                GlobalJson = new()
+                {
+                    FilePath = "../global.json",
+                    Dependencies = [
+                        new("TestSdk", "1.0.0", DependencyType.MSBuildSdk),
+                    ]
+                },
+            }
+        );
+    }
+
+    [Fact]
+    public async Task SdkPackagesThatAreUpdatedAreReportedAsTopLevel()
+    {
+        // msbuild sdk has <PackageReference> element that should be reported as a transitive dependency
+        // HOWEVER a later statement in the files updates the package version, so it's now considered top level
+        await TestDiscoveryAsync(
+            packages: [
+                MockNuGetPackage.CreateSimplePackage("Transitive.Package", "2.0.0", "net9.0"),
+                MockNuGetPackage.CreateMSBuildSdkPackage("TestSdk", "1.0.0",
+                    sdkPropsContent: """
+                        <Project>
+                          <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+                        </Project>
+                        """,
+                    sdkTargetsContent: """
+                        <Project>
+                          <ItemGroup>
+                            <PackageReference Include="Transitive.Package" Version="1.0.0" />
+                          </ItemGroup>
+                          <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+                        </Project>
+                        """
+                    )
+            ],
+            workspacePath: "src",
+            files: [
+                ("src/project.csproj", """
+                    <Project Sdk="TestSdk">
+                      <PropertyGroup>
+                        <TargetFramework>net9.0</TargetFramework>
+                      </PropertyGroup>
+                    </Project>
+                    """),
+                ("Directory.Build.props", "<Project />"),
+                ("Directory.Build.targets", """
+                    <Project>
+                      <ItemGroup>
+                        <PackageReference Update="Transitive.Package" Version="2.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("Directory.Packages.props", """
+                    <Project>
+                      <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+                      </PropertyGroup>
+                    </Project>
+                    """),
+                ("global.json", """
+                    {
+                      "msbuild-sdks": {
+                        "TestSdk": "1.0.0"
+                      }
+                    }
+                    """),
+            ],
+            expectedResult: new()
+            {
+                Path = "src",
+                Projects = [
+                    new()
+                    {
+                        FilePath = "project.csproj",
+                        TargetFrameworks = ["net9.0"],
+                        Dependencies = [
+                            new("Transitive.Package", "2.0.0", DependencyType.PackageReference, TargetFrameworks: ["net9.0"], IsDirect: true),
+                        ],
+                        Properties = [
+                            new("TargetFramework", "net9.0", "src/project.csproj")
+                        ],
+                        ReferencedProjectPaths = [],
+                        ImportedFiles = [
+                            "../Directory.Build.props",
+                            "../Directory.Build.targets",
+                            "../Directory.Packages.props",
+                        ],
+                        AdditionalFiles = [],
+                    }
+                ],
+                GlobalJson = new()
+                {
+                    FilePath = "../global.json",
+                    Dependencies = [
+                        new("TestSdk", "1.0.0", DependencyType.MSBuildSdk),
+                    ]
+                },
+            }
+        );
+    }
+
     [Fact]
     public async Task TestRepo_Sln()
     {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.356.0
+  version: 0.358.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.356.0
+        version: 0.358.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.356.0
+        version: 0.358.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -553,7 +553,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.356.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.358.0
 rdoc_options: []
 require_paths:
 - lib
@@ -568,7 +568,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.3.0
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Provides Dependabot support for .NET (NuGet)
 test_files: []