dependabot-nuget 0.380.0 → 0.381.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7d1e2d0fc0dbdb9ca5edd820796d80e93ff3508a43ec0a21e25be1ca9a296dcd
-  data.tar.gz: 77f9feddc3e1f6a42a72770aef37989b081b19c4d721b4131b0c575a1cc27ae6
+  metadata.gz: e7b5e7ecbcdfec1745579022fa1120f674bc82f492d1ea4eca4c2dea429558a2
+  data.tar.gz: a41a8ebdd8d8301739d30b922971bd3492be935aec49c6fe09a2f1d97deb6b98
 SHA512:
-  metadata.gz: 2ac9681cf7e3f0e093c8bda609e7706b37bc5d8c2299c8dd8f0be92d16c9c1e8960b9fa1b82f293e4b0ba0a25c40709614fa5cff5c3e1d354aa2b079f611e88a
-  data.tar.gz: bbcf9c27baa289052da2eb6fcfeab8cd2610cfc855eb466a3f3857476a23726969cca288157462174a9bdc616444a061db54813ecbefe5c0d8343dbfcdbcea3e
+  metadata.gz: f669096630ab540383c4e8e4d5de53cc10c85700bfef3171f57fbb30dfade61a17e14fbbb0e9d845d7a83410ce0452d22c4bd32ccaf2eec4c05c14253591d983
+  data.tar.gz: 899acdbff1b55fda3bd97c2b1591c282dcd659b872ce46ef8901b69430bb74e1188c2fb4211e1b6dc402918fe5e497048eaa17442fa553f753a678f5fec5f593

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/GlobalJsonDiscovery.cs

@@ -1,5 +1,7 @@
 using System.Collections.Immutable;
 
+using NuGet.Versioning;
+
 namespace NuGetUpdater.Core.Discover;
 
 internal static class GlobalJsonDiscovery
@@ -16,15 +18,28 @@ internal static class GlobalJsonDiscovery
 
         logger.Info($"  Discovered [{globalJsonFile.RelativePath}] file.");
 
-        var dependencies = BuildFile.GetDependencies(globalJsonFile)
+        var allDependencies = BuildFile.GetDependencies(globalJsonFile)
             .OrderBy(d => d.Name)
             .ToImmutableArray();
 
+        var dependencies = ImmutableArray.CreateBuilder<Dependency>();
+        foreach (var dependency in allDependencies)
+        {
+            if (NuGetVersion.TryParse(dependency.Version, out _))
+            {
+                dependencies.Add(dependency);
+            }
+            else
+            {
+                logger.Warn($"  Dependency '{dependency.Name}' has an unparseable version: '{dependency.Version}' and will be ignored.");
+            }
+        }
+
         return new()
         {
             FilePath = globalJsonFile.RelativePath,
             IsSuccess = !globalJsonFile.FailedToParse,
-            Dependencies = dependencies,
+            Dependencies = dependencies.ToImmutable(),
         };
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -207,6 +207,7 @@ internal static class SdkProjectDiscovery
                 }
 
                 MSBuildHelper.ThrowOnError(stdOut);
+                MSBuildHelper.ThrowOnError(stdErr);
                 if (exitCode != 0)
                 {
                     // log error, but still try to resolve what we can
@@ -831,7 +832,13 @@ internal static class SdkProjectDiscovery
             var tempProjectPath = await MSBuildHelper.CreateTempProjectAsync(tempDirectory, repoRootPath, projectPath, targetFrameworks, topLevelDependencies, logger);
             var tempProjectDirectory = Path.GetDirectoryName(tempProjectPath)!;
             var rediscoveredDependencies = await DiscoverAsync(tempProjectDirectory, tempProjectDirectory, tempProjectPath, experimentsManager, logger);
-            var rediscoveredDependenciesForThisProject = rediscoveredDependencies.Single(); // we started with a single temp project, this will be the only result
+            var tempProjectFileName = Path.GetFileName(tempProjectPath);
+            var rediscoveredDependenciesForThisProject = rediscoveredDependencies.FirstOrDefault(r => PathComparer.Instance.Equals(r.FilePath, tempProjectFileName));
+            if (rediscoveredDependenciesForThisProject is null)
+            {
+                logger.Warn($"Unable to rediscover packages for legacy project {projectPath}; using original package set.");
+                return packagesPerProject;
+            }
 
             // re-build packagesPerProject
             var rebuiltPackagesPerProject = packagesPerProject.ToDictionary(PathComparer.Instance); // shallow copy

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -670,6 +670,7 @@ internal static partial class MSBuildHelper
         ThrowOnUnparseableFile(output);
         ThrowOnMultipleProjectsForPackagesConfig(output);
         ThrowOnCircularDependency(output);
+        ThrowOnInvalidIcuPackage(output);
     }
 
     private static void ThrowOnUnauthenticatedFeed(string stdout)
@@ -821,6 +822,14 @@ internal static partial class MSBuildHelper
         }
     }
 
+    private static void ThrowOnInvalidIcuPackage(string output)
+    {
+        if (output.Contains("Couldn't find a valid ICU package installed on the system."))
+        {
+            throw new Exception("Couldn't find a valid ICU package installed on the system. Likely EOL SDK.");
+        }
+    }
+
     internal static bool TryGetGlobalJsonPath(string repoRootPath, string workspacePath, [NotNullWhen(returnValue: true)] out string? globalJsonPath)
     {
         globalJsonPath = PathHelper.GetFileInDirectoryOrParent(workspacePath, repoRootPath, "global.json", caseSensitive: false);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.GlobalJson.cs

@@ -103,5 +103,36 @@ public partial class DiscoveryWorkerTests
                 }
             );
         }
+
+        [Fact]
+        public async Task FiltersDependenciesWithUnparseableVersions()
+        {
+            await TestDiscoveryAsync(
+                packages: [],
+                workspacePath: "",
+                files: [
+                    ("global.json", """
+                        {
+                          "sdk": {
+                            "version": "2.2.104"
+                          },
+                          "msbuild-sdks": {
+                            "Microsoft.Build.Traversal": "not-a-version"
+                          }
+                        }
+                        """),
+                ],
+                expectedResult: new()
+                {
+                    Path = "",
+                    GlobalJson = new()
+                    {
+                        FilePath = "global.json",
+                        ExpectedDependencyCount = 0,
+                    },
+                    ExpectedProjectCount = 0,
+                }
+            );
+        }
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.PackagesConfig.cs

@@ -271,5 +271,85 @@ public partial class DiscoveryWorkerTests
                 }
             );
         }
+        [Fact]
+        public async Task LegacyProjectWithIncompatibleCPMPackagesDoesNotCrash()
+        {
+            // A legacy packages.config project in a repo with CPM enabled.
+            // The CPM Directory.Packages.props defines a package that only supports net8.0,
+            // which is incompatible with the project's net48 TFM. This previously caused
+            // RebuildPackagesPerProject to crash with "Sequence contains no elements" when
+            // the temp project restore failed and DiscoverAsync returned empty results.
+            await TestDiscoveryAsync(
+                packages:
+                [
+                    MockNuGetPackage.CreateSimplePackage("PackageReferencedThroughLegacyMechanism", "1.0.0", "net48"),
+                    MockNuGetPackage.CreateSimplePackage("PackageOnlyCompatibleWithNet8", "2.0.0", "net8.0"),
+                ],
+                workspacePath: "src",
+                files: [
+                    ("Directory.Build.props", """
+                        <Project>
+                          <ItemGroup>
+                            <PackageReference Include="PackageOnlyCompatibleWithNet8" />
+                          </ItemGroup>
+                        </Project>
+                    """),
+                    ("Directory.Build.targets", "<Project />"),
+                    ("Directory.Packages.props", """
+                        <Project>
+                          <PropertyGroup>
+                            <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+                          </PropertyGroup>
+                          <ItemGroup>
+                            <PackageVersion Include="PackageOnlyCompatibleWithNet8" Version="2.0.0" />
+                          </ItemGroup>
+                        </Project>
+                        """),
+                    ("src/myproj.csproj", """
+                        <Project ToolsVersion="15.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+                          <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+                          <PropertyGroup>
+                            <TargetFrameworkVersion>v4.8</TargetFrameworkVersion>
+                          </PropertyGroup>
+                          <ItemGroup>
+                            <None Include="packages.config" />
+                          </ItemGroup>
+                          <ItemGroup>
+                            <Reference Include="PackageReferencedThroughLegacyMechanism">
+                              <HintPath>packages\PackageReferencedThroughLegacyMechanism.1.0.0\lib\net48\PackageReferencedThroughLegacyMechanism.dll</HintPath>
+                              <Private>True</Private>
+                            </Reference>
+                          </ItemGroup>
+                          <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+                        </Project>
+                        """),
+                    ("src/packages.config", """
+                        <?xml version="1.0" encoding="utf-8"?>
+                        <packages>
+                          <package id="PackageReferencedThroughLegacyMechanism" version="1.0.0" targetFramework="net48" />
+                        </packages>
+                        """),
+                ],
+                expectedResult: new()
+                {
+                    Path = "src",
+                    Projects = [
+                        new()
+                        {
+                            FilePath = "myproj.csproj",
+                            TargetFrameworks = ["net48"],
+                            Dependencies = [
+                                new("PackageReferencedThroughLegacyMechanism", "1.0.0", DependencyType.PackagesConfig, TargetFrameworks: ["net48"]),
+                            ],
+                            ReferencedProjectPaths = [],
+                            ImportedFiles = [],
+                            AdditionalFiles = [
+                                "packages.config"
+                            ],
+                        }
+                    ],
+                }
+            );
+        }
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs

@@ -654,5 +654,13 @@ public class MSBuildHelperTests : TestBase
             // expectedError
             new UnknownError(new Exception("Circular dependency detected"), "TEST-JOB-ID"),
         ];
+
+        yield return
+        [
+            // output
+            "Couldn't find a valid ICU package installed on the system. Set the configuration flag System.Globalization.Invariant to true if you want to run with no globalization support.",
+            // expectedError
+            new UnknownError(new Exception("Couldn't find a valid ICU package installed on the system. Likely EOL SDK."), "TEST-JOB-ID"),
+        ];
     }
 }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.380.0
+  version: 0.381.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.381.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.380.0
+        version: 0.381.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -579,7 +579,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.380.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.381.0
 rdoc_options: []
 require_paths:
 - lib