dependabot-nuget 0.378.0 → 0.379.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5dc9026764d19eb60cee009792a8649f12625f3e5d9691653cab374dd54475f2
-  data.tar.gz: 7f7122a374ba245a1ed4a12ceb2688f26d2f0d5fab48f9419f352d37daf5ff61
+  metadata.gz: 6a30c97332d1fca64d5fc48d192b55802ef9000a40aa3eb283b165c347ebe64d
+  data.tar.gz: 63eaedf049ff81f75b1e4c0cdc2ea42601d0a01a3f68fab8b8577ecc8f2d4b8e
 SHA512:
-  metadata.gz: ec48dd6709dec2c379ea172d0cbf11c90e0be5055af38ce46da976b5adb834224e6973c80a7dd989235826d8d8aaf1505f24ccd86c4ee628e6007c63ee80188c
-  data.tar.gz: 2e7473ea553408e050f3686d380537c279859408b2db4fc5aa15cf9c5e81e2404551498d1f1547bf2e6713aac8548f3bb1c09c6c7bb3ee5f82ae4a8556742635
+  metadata.gz: 5522815d4c5abbe6cd19a15a62eddd9d81b25e15b4facbe4ca6ffd01246ece451ce6887f3289bbd30139877a565c5edc56eb20c187ae69e69d2970911ef0a614
+  data.tar.gz: 052c7aa235636a4eab5db8b7149ee81ee7cc576e8dff81049e3345ca4774ac68ad04f30b23c8d0bbbf29d5bdc9cd27b8b1f50bcdd3a27e59f8778f387bec0060

data/helpers/lib/NuGetUpdater/Directory.Packages.props

@@ -27,6 +27,7 @@
     <PackageVersion Include="OpenTelemetry" Version="1.15.3" />
     <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.15.3" />
     <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
+    <PackageVersion Include="packageurl-dotnet" Version="2.0.0" />
     <PackageVersion Include="Semver" Version="3.0.0" />
     <PackageVersion Include="System.CommandLine" Version="2.0.3" />
     <PackageVersion Include="System.ComponentModel.Composition" Version="10.0.3" />

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/CloneCommand.cs

@@ -8,33 +8,24 @@ namespace NuGetUpdater.Cli.Commands;
 
 internal static class CloneCommand
 {
-    internal static readonly Option<FileInfo> JobPathOption = new("--job-path") { Required = true };
-    internal static readonly Option<DirectoryInfo> RepoContentsPathOption = new("--repo-contents-path") { Required = true };
-    internal static readonly Option<Uri> ApiUrlOption = new("--api-url")
-    {
-        Required = true,
-        CustomParser = (argumentResult) => Uri.TryCreate(argumentResult.Tokens.Single().Value, UriKind.Absolute, out var uri) ? uri : throw new ArgumentException("Invalid API URL format.")
-    };
-    internal static readonly Option<string> JobIdOption = new("--job-id") { Required = true };
-
     internal static Command GetCommand(Action<int> setExitCode)
     {
         var command = new Command("clone", "Clones a repository in preparation for a dependabot job.")
         {
-            JobPathOption,
-            RepoContentsPathOption,
-            ApiUrlOption,
-            JobIdOption,
+            SharedOptions.JobPathOption,
+            SharedOptions.RepoContentsPathOption,
+            SharedOptions.ApiUrlOption,
+            SharedOptions.JobIdOption,
         };
 
         command.TreatUnmatchedTokensAsErrors = true;
 
         command.SetAction(async (parseResult, cancellationToken) =>
         {
-            var jobPath = parseResult.GetValue(JobPathOption);
-            var repoContentsPath = parseResult.GetValue(RepoContentsPathOption);
-            var apiUrl = parseResult.GetValue(ApiUrlOption);
-            var jobId = parseResult.GetValue(JobIdOption);
+            var jobPath = parseResult.GetValue(SharedOptions.JobPathOption);
+            var repoContentsPath = parseResult.GetValue(SharedOptions.RepoContentsPathOption);
+            var apiUrl = parseResult.GetValue(SharedOptions.ApiUrlOption);
+            var jobId = parseResult.GetValue(SharedOptions.JobIdOption);
 
             var apiHandler = new HttpApiHandler(apiUrl!.ToString(), jobId!);
             var logger = new OpenTelemetryLogger();

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/GraphCommand.cs

@@ -0,0 +1,47 @@
+using System.CommandLine;
+
+using NuGetUpdater.Core;
+using NuGetUpdater.Core.Discover;
+using NuGetUpdater.Core.Graph;
+using NuGetUpdater.Core.Run;
+
+namespace NuGetUpdater.Cli.Commands;
+
+internal static class GraphCommand
+{
+    internal static Command GetCommand(Action<int> setExitCode)
+    {
+        Command command = new("graph", "Generates a dependency graph for a repository.")
+        {
+            SharedOptions.JobPathOption,
+            SharedOptions.RepoContentsPathOption,
+            SharedOptions.CaseInsensitiveRepoContentsPathOption,
+            SharedOptions.ApiUrlOption,
+            SharedOptions.JobIdOption,
+            SharedOptions.BaseCommitShaOption
+        };
+
+        command.TreatUnmatchedTokensAsErrors = true;
+
+        command.SetAction(async (parseResult, cancellationToken) =>
+        {
+            var jobPath = parseResult.GetValue(SharedOptions.JobPathOption);
+            var repoContentsPath = parseResult.GetValue(SharedOptions.RepoContentsPathOption);
+            var caseInsensitiveRepoContentsPath = parseResult.GetValue(SharedOptions.CaseInsensitiveRepoContentsPathOption);
+            var apiUrl = parseResult.GetValue(SharedOptions.ApiUrlOption);
+            var jobId = parseResult.GetValue(SharedOptions.JobIdOption);
+            var baseCommitSha = parseResult.GetValue(SharedOptions.BaseCommitShaOption);
+
+            var apiHandler = new HttpApiHandler(apiUrl!.ToString(), jobId!);
+            var (experimentsManager, _errorResult) = await ExperimentsManager.FromJobFileAsync(jobId!, jobPath!.FullName);
+            var logger = new OpenTelemetryLogger();
+            var discoverWorker = new DiscoveryWorker(jobId!, experimentsManager, logger);
+            var worker = new GraphWorker(jobId!, apiHandler, discoverWorker, logger);
+            var result = await worker.RunAsync(jobPath!, repoContentsPath!, caseInsensitiveRepoContentsPath, baseCommitSha!);
+            setExitCode(result);
+            return 0;
+        });
+
+        return command;
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/RunCommand.cs

@@ -9,39 +9,28 @@ namespace NuGetUpdater.Cli.Commands;
 
 internal static class RunCommand
 {
-    internal static readonly Option<FileInfo> JobPathOption = new("--job-path") { Required = true };
-    internal static readonly Option<DirectoryInfo> RepoContentsPathOption = new("--repo-contents-path") { Required = true };
-    internal static readonly Option<DirectoryInfo?> CaseInsensitiveRepoContentsPathOption = new("--case-insensitive-repo-contents-path") { Required = false };
-    internal static readonly Option<Uri> ApiUrlOption = new("--api-url")
-    {
-        Required = true,
-        CustomParser = (argumentResult) => Uri.TryCreate(argumentResult.Tokens.Single().Value, UriKind.Absolute, out var uri) ? uri : throw new ArgumentException("Invalid API URL format.")
-    };
-    internal static readonly Option<string> JobIdOption = new("--job-id") { Required = true };
-    internal static readonly Option<string> BaseCommitShaOption = new("--base-commit-sha") { Required = true };
-
     internal static Command GetCommand(Action<int> setExitCode)
     {
         Command command = new("run", "Runs a full dependabot job.")
         {
-            JobPathOption,
-            RepoContentsPathOption,
-            CaseInsensitiveRepoContentsPathOption,
-            ApiUrlOption,
-            JobIdOption,
-            BaseCommitShaOption
+            SharedOptions.JobPathOption,
+            SharedOptions.RepoContentsPathOption,
+            SharedOptions.CaseInsensitiveRepoContentsPathOption,
+            SharedOptions.ApiUrlOption,
+            SharedOptions.JobIdOption,
+            SharedOptions.BaseCommitShaOption
         };
 
         command.TreatUnmatchedTokensAsErrors = true;
 
         command.SetAction(async (parseResult, cancellationToken) =>
         {
-            var jobPath = parseResult.GetValue(JobPathOption);
-            var repoContentsPath = parseResult.GetValue(RepoContentsPathOption);
-            var caseInsensitiveRepoContentsPath = parseResult.GetValue(CaseInsensitiveRepoContentsPathOption);
-            var apiUrl = parseResult.GetValue(ApiUrlOption);
-            var jobId = parseResult.GetValue(JobIdOption);
-            var baseCommitSha = parseResult.GetValue(BaseCommitShaOption);
+            var jobPath = parseResult.GetValue(SharedOptions.JobPathOption);
+            var repoContentsPath = parseResult.GetValue(SharedOptions.RepoContentsPathOption);
+            var caseInsensitiveRepoContentsPath = parseResult.GetValue(SharedOptions.CaseInsensitiveRepoContentsPathOption);
+            var apiUrl = parseResult.GetValue(SharedOptions.ApiUrlOption);
+            var jobId = parseResult.GetValue(SharedOptions.JobIdOption);
+            var baseCommitSha = parseResult.GetValue(SharedOptions.BaseCommitShaOption);
 
             var apiHandler = new HttpApiHandler(apiUrl!.ToString(), jobId!);
             var (experimentsManager, _errorResult) = await ExperimentsManager.FromJobFileAsync(jobId!, jobPath!.FullName);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Commands/SharedOptions.cs

@@ -0,0 +1,17 @@
+using System.CommandLine;
+
+namespace NuGetUpdater.Cli.Commands;
+
+internal static class SharedOptions
+{
+    internal static readonly Option<FileInfo> JobPathOption = new("--job-path") { Required = true };
+    internal static readonly Option<DirectoryInfo> RepoContentsPathOption = new("--repo-contents-path") { Required = true };
+    internal static readonly Option<DirectoryInfo?> CaseInsensitiveRepoContentsPathOption = new("--case-insensitive-repo-contents-path") { Required = false };
+    internal static readonly Option<Uri> ApiUrlOption = new("--api-url")
+    {
+        Required = true,
+        CustomParser = (argumentResult) => Uri.TryCreate(argumentResult.Tokens.Single().Value, UriKind.Absolute, out var uri) ? uri : throw new ArgumentException("Invalid API URL format.")
+    };
+    internal static readonly Option<string> JobIdOption = new("--job-id") { Required = true };
+    internal static readonly Option<string> BaseCommitShaOption = new("--base-commit-sha") { Required = true };
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli/Program.cs

@@ -20,6 +20,7 @@ internal sealed class Program
         {
             CloneCommand.GetCommand(setExitCode),
             RunCommand.GetCommand(setExitCode),
+            GraphCommand.GetCommand(setExitCode),
         };
         command.TreatUnmatchedTokensAsErrors = true;
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTestHelper.cs

@@ -0,0 +1,84 @@
+using System.Text;
+using System.Text.Json;
+
+using NuGetUpdater.Core.Run;
+using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Test;
+using NuGetUpdater.Core.Test.Update;
+
+using Xunit;
+
+namespace NuGetUpdater.Cli.Test;
+
+using TestFile = (string Path, string Content);
+
+internal static class EntryPointTestHelper
+{
+    internal static async Task RunAsync(
+        string commandName,
+        TestFile[] files,
+        Job job,
+        string[] expectedUrls,
+        MockNuGetPackage[]? packages = null,
+        string? repoContentsPath = null,
+        int expectedExitCode = 0)
+    {
+        using var tempDirectory = new TemporaryDirectory();
+
+        // write test files
+        foreach (var testFile in files)
+        {
+            var fullPath = Path.Join(tempDirectory.DirectoryPath, testFile.Path);
+            var directory = Path.GetDirectoryName(fullPath)!;
+            Directory.CreateDirectory(directory);
+            await File.WriteAllTextAsync(fullPath, testFile.Content);
+        }
+
+        // write job file
+        var jobPath = Path.Combine(tempDirectory.DirectoryPath, "job.json");
+        await File.WriteAllTextAsync(jobPath, JsonSerializer.Serialize(new { Job = job }, RunWorker.SerializerOptions));
+
+        // save packages
+        await UpdateWorkerTestBase.MockNuGetPackagesInDirectory(packages, tempDirectory.DirectoryPath);
+
+        var actualUrls = new List<string>();
+        using var http = TestHttpServer.CreateTestStringServer((method, url) =>
+        {
+            actualUrls.Add($"{method} {new Uri(url).PathAndQuery}");
+            return (200, "ok");
+        });
+        var args = new List<string>()
+        {
+            commandName,
+            "--job-path",
+            jobPath,
+            "--repo-contents-path",
+            repoContentsPath ?? tempDirectory.DirectoryPath,
+            "--api-url",
+            http.BaseUrl,
+            "--job-id",
+            "TEST-ID",
+            "--base-commit-sha",
+            "BASE-COMMIT-SHA"
+        };
+
+        var output = new StringBuilder();
+        // redirect stdout
+        var originalOut = Console.Out;
+        Console.SetOut(new StringWriter(output));
+        int result = -1;
+        try
+        {
+            result = await Program.Main(args.ToArray());
+        }
+        catch
+        {
+            // restore stdout
+            Console.SetOut(originalOut);
+            throw;
+        }
+
+        Assert.True(result == expectedExitCode, $"Expected exit code {expectedExitCode} but got {result}.\nSTDOUT:\n" + output.ToString());
+        Assert.Equal(expectedUrls, actualUrls);
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Graph.cs

@@ -0,0 +1,65 @@
+using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Test;
+
+using Xunit;
+
+namespace NuGetUpdater.Cli.Test;
+
+using TestFile = (string Path, string Content);
+
+public partial class EntryPointTests
+{
+    public class Graph
+    {
+        [Fact]
+        public async Task Graph_Simple()
+        {
+            // verify we can pass command line arguments for graph command
+            await RunAsync(
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0"),
+                ],
+                files:
+                [
+                    ("Directory.Build.props", "<Project />"),
+                    ("Directory.Build.targets", "<Project />"),
+                    ("Directory.Packages.props", """
+                        <Project>
+                          <PropertyGroup>
+                            <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+                          </PropertyGroup>
+                        </Project>
+                        """),
+                    ("src/project.csproj", """
+                        <Project Sdk="Microsoft.NET.Sdk">
+                          <PropertyGroup>
+                            <TargetFramework>net8.0</TargetFramework>
+                          </PropertyGroup>
+                          <ItemGroup>
+                            <PackageReference Include="Some.Package" Version="1.0.0" />
+                          </ItemGroup>
+                        </Project>
+                        """)
+                ],
+                job: new Job()
+                {
+                    Source = new()
+                    {
+                        Provider = "github",
+                        Repo = "test",
+                        Directory = "src",
+                    }
+                },
+                expectedUrls:
+                [
+                    "POST /update_jobs/TEST-ID/create_dependency_submission",
+                    "PATCH /update_jobs/TEST-ID/mark_as_processed",
+                ]
+            );
+        }
+
+        private static Task RunAsync(TestFile[] files, Job job, string[] expectedUrls, MockNuGetPackage[]? packages = null, string? repoContentsPath = null, int expectedExitCode = 0)
+            => EntryPointTestHelper.RunAsync("graph", files, job, expectedUrls, packages, repoContentsPath, expectedExitCode);
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs

@@ -143,65 +143,7 @@ public partial class EntryPointTests
             );
         }
 
-        private static async Task RunAsync(TestFile[] files, Job job, string[] expectedUrls, MockNuGetPackage[]? packages = null, string? repoContentsPath = null, int expectedExitCode = 0)
-        {
-            using var tempDirectory = new TemporaryDirectory();
-
-            // write test files
-            foreach (var testFile in files)
-            {
-                var fullPath = Path.Join(tempDirectory.DirectoryPath, testFile.Path);
-                var directory = Path.GetDirectoryName(fullPath)!;
-                Directory.CreateDirectory(directory);
-                await File.WriteAllTextAsync(fullPath, testFile.Content);
-            }
-
-            // write job file
-            var jobPath = Path.Combine(tempDirectory.DirectoryPath, "job.json");
-            await File.WriteAllTextAsync(jobPath, JsonSerializer.Serialize(new { Job = job }, RunWorker.SerializerOptions));
-
-            // save packages
-            await UpdateWorkerTestBase.MockNuGetPackagesInDirectory(packages, tempDirectory.DirectoryPath);
-
-            var actualUrls = new List<string>();
-            using var http = TestHttpServer.CreateTestStringServer((method, url) =>
-            {
-                actualUrls.Add($"{method} {new Uri(url).PathAndQuery}");
-                return (200, "ok");
-            });
-            var args = new List<string>()
-            {
-                "run",
-                "--job-path",
-                jobPath,
-                "--repo-contents-path",
-                repoContentsPath ?? tempDirectory.DirectoryPath,
-                "--api-url",
-                http.BaseUrl,
-                "--job-id",
-                "TEST-ID",
-                "--base-commit-sha",
-                "BASE-COMMIT-SHA"
-            };
-
-            var output = new StringBuilder();
-            // redirect stdout
-            var originalOut = Console.Out;
-            Console.SetOut(new StringWriter(output));
-            int result = -1;
-            try
-            {
-                result = await Program.Main(args.ToArray());
-            }
-            catch
-            {
-                // restore stdout
-                Console.SetOut(originalOut);
-                throw;
-            }
-
-            Assert.True(result == expectedExitCode, $"Expected exit code {expectedExitCode} but got {result}.\nSTDOUT:\n" + output.ToString());
-            Assert.Equal(expectedUrls, actualUrls);
-        }
+        private static Task RunAsync(TestFile[] files, Job job, string[] expectedUrls, MockNuGetPackage[]? packages = null, string? repoContentsPath = null, int expectedExitCode = 0)
+            => EntryPointTestHelper.RunAsync("run", files, job, expectedUrls, packages, repoContentsPath, expectedExitCode);
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/CompatabilityChecker.cs

@@ -172,15 +172,13 @@ internal static class CompatibilityChecker
 
         foreach (var source in sources)
         {
-            var sourceRepository = Repository.Factory.GetCoreV3(source);
-            var feed = await sourceRepository.GetResourceAsync<FindPackageByIdResource>();
-            if (feed is null)
-            {
-                throw new NotSupportedException($"Failed to get FindPackageByIdResource for {source.SourceUri}");
-            }
-
+            FindPackageByIdResource feed;
             try
             {
+                var sourceRepository = Repository.Factory.GetCoreV3(source);
+                feed = await sourceRepository.GetResourceAsync<FindPackageByIdResource>()
+                    ?? throw new NotSupportedException($"Failed to get FindPackageByIdResource for {source.SourceUri}");
+
                 // a non-compliant v2 API returning 404 can cause this to throw
                 var exists = await feed.DoesPackageExistAsync(
                     package.Id,

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DiscoveryWorker.cs

@@ -16,6 +16,8 @@ using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Updater;
 using NuGetUpdater.Core.Utilities;
 
+using static NuGetUpdater.Core.Utilities.GitSubmoduleParser;
+
 namespace NuGetUpdater.Core.Discover;
 
 public partial class DiscoveryWorker : IDiscoveryWorker
@@ -110,6 +112,33 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         var repoRoot = new DirectoryInfo(repoRootPath);
         projectResults = [.. projectResults.Where(p => PathHelper.IsFileUnderDirectory(repoRoot, new FileInfo(Path.Join(workspacePath, p.FilePath))))];
 
+        // filter out projects that are in submodules
+        var submodulePaths = GetSubmodulePaths(repoRootPath);
+        if (submodulePaths.Length > 0)
+        {
+            projectResults = FilterProjectsInSubmodules(projectResults, initialWorkspacePath, submodulePaths);
+
+            if (dotNetToolsJsonDiscovery is not null)
+            {
+                var fullRelativePath = PathHelper.JoinPath(initialWorkspacePath, dotNetToolsJsonDiscovery.FilePath).NormalizePathToUnix();
+                if (IsPathInSubmodule(fullRelativePath, submodulePaths))
+                {
+                    _logger.Info($"  Excluding file [{dotNetToolsJsonDiscovery.FilePath}] because it is in a submodule.");
+                    dotNetToolsJsonDiscovery = null;
+                }
+            }
+
+            if (globalJsonDiscovery is not null)
+            {
+                var fullRelativePath = PathHelper.JoinPath(initialWorkspacePath, globalJsonDiscovery.FilePath).NormalizePathToUnix();
+                if (IsPathInSubmodule(fullRelativePath, submodulePaths))
+                {
+                    _logger.Info($"  Excluding file [{globalJsonDiscovery.FilePath}] because it is in a submodule.");
+                    globalJsonDiscovery = null;
+                }
+            }
+        }
+
         // if any projectResults are not successful, return a failed result
         if (projectResults.Any(p => p.IsSuccess == false))
         {
@@ -175,7 +204,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         ImmutableArray<string> projects;
         try
         {
-            projects = await ExpandEntryPointsIntoProjectsAsync(entryPoints, _experimentsManager, _logger);
+            projects = await ExpandEntryPointsIntoProjectsAsync(entryPoints, _experimentsManager, _logger, repoRootPath);
         }
         catch (InvalidProjectFileException e)
         {
@@ -223,7 +252,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
             .ToImmutableArray();
     }
 
-    internal async static Task<ImmutableArray<string>> ExpandEntryPointsIntoProjectsAsync(IEnumerable<string> entryPoints, ExperimentsManager experimentsManager, ILogger logger)
+    internal async static Task<ImmutableArray<string>> ExpandEntryPointsIntoProjectsAsync(IEnumerable<string> entryPoints, ExperimentsManager experimentsManager, ILogger logger, string repoRootPath)
     {
         HashSet<string> expandedProjects = new(PathComparer.Instance);
         HashSet<string> seenProjects = new(PathComparer.Instance);
@@ -284,6 +313,24 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         }
 
         var result = expandedProjects.OrderBy(p => p).ToImmutableArray();
+
+        // pre-filter projects that are in submodules to avoid unnecessary restore operations
+        var submodulePaths = GetSubmodulePaths(repoRootPath);
+        if (submodulePaths.Length > 0)
+        {
+            result = [.. result.Where(p =>
+            {
+                var relativePath = Path.GetRelativePath(repoRootPath, p).NormalizePathToUnix();
+                if (IsPathInSubmodule(relativePath, submodulePaths))
+                {
+                    logger.Info($"    Excluding project [{relativePath}] because it is in a submodule.");
+                    return false;
+                }
+
+                return true;
+            })];
+        }
+
         return result;
     }
 
@@ -344,13 +391,20 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         try
         {
             // get all packages.config results first
-            var expandedProjects = await ExpandEntryPointsIntoProjectsAsync(normalizedProjectPaths, _experimentsManager, _logger);
+            var expandedProjects = await ExpandEntryPointsIntoProjectsAsync(normalizedProjectPaths, _experimentsManager, _logger, repoRootPath);
             foreach (var expandedProject in expandedProjects)
             {
                 var packagesConfigResult = await PackagesConfigDiscovery.Discover(repoRootPath, workspacePath, expandedProject, _logger);
                 if (packagesConfigResult is not null)
                 {
                     var relativeProjectPath = Path.GetRelativePath(workspacePath, expandedProject).NormalizePathToUnix();
+                    var dependencyGraph = packagesConfigResult.Dependencies
+                        .Where(d => !string.IsNullOrEmpty(d.Version))
+                        .OrderBy(d => d.Name, StringComparer.OrdinalIgnoreCase)
+                        .ToImmutableDictionary(
+                            d => $"{d.Name}/{d.Version}",
+                            _ => ImmutableArray<string>.Empty,
+                            StringComparer.OrdinalIgnoreCase);
                     results[relativeProjectPath] = new ProjectDiscoveryResult()
                     {
                         FilePath = relativeProjectPath,
@@ -358,6 +412,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                         TargetFrameworks = packagesConfigResult.TargetFrameworks,
                         ImportedFiles = [], // no imported files resolved for packages.config scenarios
                         AdditionalFiles = packagesConfigResult.AdditionalFiles,
+                        DependencyGraph = dependencyGraph,
                     };
                 }
             }
@@ -472,10 +527,57 @@ public partial class DiscoveryWorker : IDiscoveryWorker
             AdditionalFiles = mergedAdditionalFiles,
             PackageManagementKind = (PackageManagementKind)Math.Max((int)result1.PackageManagementKind, (int)result2.PackageManagementKind),
             PackageManagementSpecialFileRelativePath = result1.PackageManagementSpecialFileRelativePath ?? result2.PackageManagementSpecialFileRelativePath,
+            HasNoWarnNU1701 = result1.HasNoWarnNU1701 || result2.HasNoWarnNU1701,
+            DependencyGraph = MergeDependencyGraphs(result1.DependencyGraph, result2.DependencyGraph),
         };
         return mergedResult;
     }
 
+    internal ImmutableArray<ProjectDiscoveryResult> FilterProjectsInSubmodules(
+        ImmutableArray<ProjectDiscoveryResult> projectResults,
+        string workspacePath,
+        ImmutableArray<string> submodulePaths)
+    {
+        var filtered = new List<ProjectDiscoveryResult>();
+        foreach (var project in projectResults)
+        {
+            var fullRelativePath = PathHelper.JoinPath(workspacePath, project.FilePath).NormalizePathToUnix();
+            if (IsPathInSubmodule(fullRelativePath, submodulePaths))
+            {
+                _logger.Info($"  Excluding project [{project.FilePath}] because it is in a submodule.");
+            }
+            else
+            {
+                filtered.Add(project);
+            }
+        }
+
+        return [.. filtered];
+    }
+
+    private static ImmutableDictionary<string, ImmutableArray<string>> MergeDependencyGraphs(
+        ImmutableDictionary<string, ImmutableArray<string>> graph1,
+        ImmutableDictionary<string, ImmutableArray<string>> graph2)
+    {
+        var merged = graph1.ToDictionary(kvp => kvp.Key, kvp => kvp.Value, StringComparer.OrdinalIgnoreCase);
+        foreach (var kvp in graph2)
+        {
+            if (merged.TryGetValue(kvp.Key, out var existing))
+            {
+                merged[kvp.Key] = existing
+                    .Union(kvp.Value, StringComparer.OrdinalIgnoreCase)
+                    .OrderBy(n => n, StringComparer.OrdinalIgnoreCase)
+                    .ToImmutableArray();
+            }
+            else
+            {
+                merged[kvp.Key] = kvp.Value;
+            }
+        }
+
+        return merged.ToImmutableDictionary(StringComparer.OrdinalIgnoreCase);
+    }
+
     internal static async Task WriteResultsAsync(string repoRootPath, string outputPath, WorkspaceDiscoveryResult result)
     {
         var resultPath = Path.IsPathRooted(outputPath)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/ProjectDiscoveryResult.cs

@@ -17,4 +17,8 @@ public record ProjectDiscoveryResult : IDiscoveryResultWithDependencies
     public required ImmutableArray<string> AdditionalFiles { get; init; }
     public required ImmutableArray<Dependency> Dependencies { get; init; }
     public bool HasNoWarnNU1701 { get; init; } = false;
+    /// <summary>
+    /// Maps each package (keyed as "Name/Version") to its direct dependency package names, as extracted from project.assets.json.
+    /// </summary>
+    public ImmutableDictionary<string, ImmutableArray<string>> DependencyGraph { get; init; } = ImmutableDictionary<string, ImmutableArray<string>>.Empty;
 }