dependabot-nuget 0.386.0 → 0.388.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 45cedfbbb662d26d428348a93cf693a26bbff6d402feaf0f1a068a328e384d9e
-  data.tar.gz: 69578367499f994702f926128e1297e8b3b38fcc43a3bb5236606a515be19de8
+  metadata.gz: ab3a09f44990043a0aea2f247f1319e0f47f3d82a5dc185062cf5f524256e24c
+  data.tar.gz: 785af3809b07b9e07628389cfe491b8bfa1509f7a438cd512b25b78650bab691
 SHA512:
-  metadata.gz: 0f8197f31e75f02c01b6edfea9ec6d760062046b53971aa24816480e939db3fe14f5b64c045f1c90f51054007e8beefe9fcf5ba6f3efc46c2ec70b3715aca195
-  data.tar.gz: d425d717e8d673a7b64a559c6e65a1ef9bacfee8c3de37719eac3406af8d869e0be7157a835b5b6078b71db0aa173518ec52ad86e35a95eddf942f803b449d1f
+  metadata.gz: e426620a0669b8c692d7de4d556a7f39bfc58d833168bbad8ba6f24b359e53d793240d3e0cdeb2ef74f83b89f4c1f2820a068532147379c49a3feddaa4a7139d
+  data.tar.gz: 35adfa4d731c4cc3c72279531b44bf5ce00eb5c06bf0e83c263ed1509c276ec742d3932718d0e01f800bd702233b419d43f97a36ba6b3d0fd38fc7382c754b95

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/SpecialImportsConditionPatcher.cs

@@ -8,7 +8,7 @@ namespace NuGetUpdater.Core.Updater
 {
     internal class SpecialImportsConditionPatcher : IDisposable
     {
-        private readonly List<string?> _capturedConditions = new List<string?>();
+        private readonly List<IXmlElementSyntax> _capturedElements = [];
         private readonly XmlFilePreAndPostProcessor _processor;
 
         // These files only ship with a full Visual Studio install
@@ -60,20 +60,48 @@ namespace NuGetUpdater.Core.Updater
                 preProcessor: (i, n) =>
                 {
                     var element = (IXmlElementSyntax)n;
-                    _capturedConditions.Add(element.GetAttributeValue("Condition"));
+                    _capturedElements.Add(element);
                     return (XmlNodeSyntax)element.RemoveAttributeByName("Condition").WithAttribute("Condition", "false");
                 },
                 postProcessor: (i, n) =>
                 {
                     var element = (IXmlElementSyntax)n;
-                    var newElement = element.RemoveAttributeByName("Condition");
-                    var capturedCondition = _capturedConditions[i];
-                    if (capturedCondition is not null)
+                    var originalElement = _capturedElements[i];
+
+                    // copy over attribute values from the potentially updated element EXCEPT for `Condition="false"`
+                    var updatedAttributeValues = element.Attributes.ToDictionary(e => e.Name, e => e.Value);
+                    var originalRestoredElement = originalElement;
+                    foreach (var (attributeName, attributeValue) in updatedAttributeValues)
+                    {
+                        if (attributeName == "Condition" && attributeValue == "false")
+                        {
+                            // this was the attribute we manually patched so it shouldn't be copied over
+                            // note that if the update operation change the Condition value, then we _will_ copy it over, which is what we want
+                            continue;
+                        }
+
+                        var oldAttribute = originalRestoredElement.GetAttribute(attributeName);
+                        if (oldAttribute is null)
+                        {
+                            // the attribute was added by an operation and just needs to be added
+                            originalRestoredElement = originalRestoredElement.WithAttribute(attributeName, attributeValue);
+                        }
+                        else
+                        {
+                            // the attribute was updated by an operation and needs to be maintained
+                            var updatedAttribute = oldAttribute.WithValue(updatedAttributeValues[attributeName]);
+                            originalRestoredElement = originalRestoredElement.ReplaceAttribute(oldAttribute, updatedAttribute);
+                        }
+                    }
+
+                    // remove attributes not present in the updated element
+                    var attributeNamesToRemove = originalRestoredElement.Attributes.Select(a => a.Name).Except(updatedAttributeValues.Keys);
+                    foreach (var attributeNameToRemove in attributeNamesToRemove)
                     {
-                        newElement = newElement.WithAttribute("Condition", capturedCondition);
+                        originalRestoredElement = originalRestoredElement.RemoveAttributeByName(attributeNameToRemove);
                     }
 
-                    return (XmlNodeSyntax)newElement;
+                    return (XmlNodeSyntax)originalRestoredElement;
                 }
             );
         }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/XmlExtensions.cs

@@ -66,15 +66,25 @@ public static class XmlExtensions
 
     public static IXmlElementSyntax WithAttribute(this IXmlElementSyntax parent, string name, string value)
     {
-        var singleSpanceTrivia = SyntaxFactory.WhitespaceTrivia(" ");
-
-        return parent.AddAttribute(SyntaxFactory.XmlAttribute(
+        var singleSpaceTrivia = SyntaxFactory.WhitespaceTrivia(" ");
+        var newAttribute = SyntaxFactory.XmlAttribute(
             SyntaxFactory.XmlName(null, SyntaxFactory.XmlNameToken(name, null, null)),
             SyntaxFactory.Punctuation(SyntaxKind.EqualsToken, "=", null, null),
             SyntaxFactory.XmlString(
                 SyntaxFactory.Punctuation(SyntaxKind.SingleQuoteToken, "\"", null, null),
                 SyntaxFactory.XmlTextLiteralToken(value, null, null),
-                SyntaxFactory.Punctuation(SyntaxKind.SingleQuoteToken, "\"", null, singleSpanceTrivia))));
+                SyntaxFactory.Punctuation(SyntaxKind.SingleQuoteToken, "\"", null, singleSpaceTrivia)));
+        var lastAttribute = parent.Attributes.LastOrDefault();
+        if (lastAttribute is not null &&
+            string.IsNullOrEmpty(lastAttribute.GetTrailingTrivia().ToFullString()))
+        {
+            // ensure there's a space at the end of the previous attribute so we don't end up with this:
+            //   <Element ExistingAttribute="ExistingValue"NewAttribute="NewValue" />
+            parent = parent.RemoveAttribute(lastAttribute)
+                .AddAttribute(lastAttribute.WithTrailingTrivia(singleSpaceTrivia));
+        }
+
+        return parent.AddAttribute(newAttribute);
     }
 
     public static XmlElementSyntax CreateOpenCloseXmlElementSyntax(string name, int indentation = 2, bool spaces = true)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/UpdateHandlers/CreateSecurityUpdatePullRequestHandlerTests.cs

@@ -856,4 +856,166 @@ public class CreateSecurityUpdatePullRequestHandlerTests : UpdateHandlersTestsBa
             ]
         );
     }
+
+    [Fact]
+    public async Task DuplicatePullRequestsAreNotCreatedForDifferentDirectories()
+    {
+        await TestAsync(
+            job: new Job()
+            {
+                Dependencies = ["Some.Dependency"],
+                SecurityAdvisories = [new() { DependencyName = "Some.Dependency", AffectedVersions = [Requirement.Parse("= 1.0.0")] }],
+                SecurityUpdatesOnly = true,
+                Source = CreateJobSource("/src/client", "/src/server"),
+            },
+            files: [
+                ("src/client/client.csproj", "contents irrelevant"),
+                ("src/server/server.csproj", "contents irrelevant"),
+                ("Directory.Packages.props", "initial contents"),
+            ],
+            discoveryWorker: TestDiscoveryWorker.FromResults(
+                ("/src/client", new WorkspaceDiscoveryResult()
+                {
+                    Path = "/src/client",
+                    Projects = [
+                        new()
+                        {
+                            FilePath = "client.csproj",
+                            Dependencies = [
+                                new("Some.Dependency", "1.0.0", DependencyType.PackageReference, TargetFrameworks: ["net9.0"]),
+                            ],
+                            ImportedFiles = ["../../Directory.Packages.props"],
+                            AdditionalFiles = [],
+                        }
+                    ],
+                }),
+                ("/src/server", new WorkspaceDiscoveryResult()
+                {
+                    Path = "/src/server",
+                    Projects = [
+                        new()
+                        {
+                            FilePath = "server.csproj",
+                            Dependencies = [
+                                new("Some.Dependency", "1.0.0", DependencyType.PackageReference, TargetFrameworks: ["net9.0"]),
+                            ],
+                            ImportedFiles = ["../../Directory.Packages.props"],
+                            AdditionalFiles = [],
+                        }
+                    ],
+                })
+            ),
+            analyzeWorker: new TestAnalyzeWorker(input =>
+            {
+                var repoRoot = input.Item1;
+                var discovery = input.Item2;
+                var dependencyInfo = input.Item3;
+                if (dependencyInfo.Name != "Some.Dependency")
+                {
+                    throw new NotImplementedException($"Test didn't expect to update dependency {dependencyInfo.Name}");
+                }
+
+                return Task.FromResult(new AnalysisResult()
+                {
+                    CanUpdate = true,
+                    UpdatedVersion = "2.0.0",
+                    UpdatedDependencies = [],
+                });
+            }),
+            updaterWorker: new TestUpdaterWorker(async input =>
+            {
+                var repoRoot = input.Item1;
+                var workspacePath = input.Item2;
+                var dependencyName = input.Item3;
+                var previousVersion = input.Item4;
+                var newVersion = input.Item5;
+                var isTopLevel = input.Item6;
+
+                await File.WriteAllTextAsync(Path.Join(repoRoot, "Directory.Packages.props"), "updated contents");
+
+                return new UpdateOperationResult()
+                {
+                    UpdateOperations = [new DirectUpdate() { DependencyName = "Some.Dependency", NewVersion = NuGetVersion.Parse("2.0.0"), UpdatedFiles = ["/Directory.Packages.props"] }],
+                };
+            }),
+            expectedUpdateHandler: CreateSecurityUpdatePullRequestHandler.Instance,
+            expectedApiMessages: [
+                new UpdatedDependencyList()
+                {
+                    Dependencies = [
+                        new()
+                        {
+                            Name = "Some.Dependency",
+                            Version = "1.0.0",
+                            Requirements = [
+                                new() { Requirement = "1.0.0", File = "/src/client/client.csproj", Groups = ["dependencies"] },
+                            ],
+                        },
+                    ],
+                    DependencyFiles = ["/Directory.Packages.props", "/src/client/client.csproj"],
+                },
+                new IncrementMetric()
+                {
+                    Metric = "updater.started",
+                    Tags = new()
+                    {
+                        ["operation"] = "create_security_pr",
+                    }
+                },
+                new CreatePullRequest()
+                {
+                    Dependencies = [
+                        new()
+                        {
+                            Name = "Some.Dependency",
+                            Version = "2.0.0",
+                            Requirements = [
+                                new() { Requirement = "2.0.0", File = "/src/client/client.csproj", Groups = ["dependencies"], Source = new() { SourceUrl = null } },
+                            ],
+                            PreviousVersion = "1.0.0",
+                            PreviousRequirements = [
+                                new() { Requirement = "1.0.0", File = "/src/client/client.csproj", Groups = ["dependencies"] },
+                            ],
+                        }
+                    ],
+                    UpdatedDependencyFiles = [
+                        new()
+                        {
+                            Directory = "/",
+                            Name = "Directory.Packages.props",
+                            Content = "updated contents",
+                        }
+                    ],
+                    BaseCommitSha = "TEST-COMMIT-SHA",
+                    CommitMessage = EndToEndTests.TestPullRequestCommitMessage,
+                    PrTitle = EndToEndTests.TestPullRequestTitle,
+                    PrBody = EndToEndTests.TestPullRequestBody,
+                    DependencyGroup = null,
+                },
+                new UpdatedDependencyList()
+                {
+                    Dependencies = [
+                        new()
+                        {
+                            Name = "Some.Dependency",
+                            Version = "1.0.0",
+                            Requirements = [
+                                new() { Requirement = "1.0.0", File = "/src/server/server.csproj", Groups = ["dependencies"] },
+                            ],
+                        },
+                    ],
+                    DependencyFiles = ["/Directory.Packages.props", "/src/server/server.csproj"],
+                },
+                new IncrementMetric()
+                {
+                    Metric = "updater.started",
+                    Tags = new()
+                    {
+                        ["operation"] = "create_security_pr",
+                    }
+                },
+                new MarkAsProcessed("TEST-COMMIT-SHA"),
+            ]
+        );
+    }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/SpecialFilePatcherTests.cs

@@ -54,6 +54,120 @@ public class SpecialFilePatcherTests
         Assert.Equal(restoredContent.Replace("\r", ""), fileContent.Replace("\r", ""));
     }
 
+    [Fact]
+    public async Task ModifiedAttributesAreRetainedThroughConditionPatching()
+    {
+        // it's possible that an operation updated a `<Import Project="..." />` element after we patched it with `Condition="false"`
+        // this test ensures that if that did happen, we don't lose the updated attributes when we restore the original content
+
+        // arrange
+        var projectFileName = "project.csproj";
+        using var tempDir = await TemporaryDirectory.CreateWithContentsAsync((projectFileName, """
+            <Project Sdk="Microsoft.NET.Sdk">
+              <Import Project="Some\Path\Microsoft.WebApplication.targets" />
+            </Project>
+            """));
+        var projectPath = Path.Join(tempDir.DirectoryPath, projectFileName);
+
+        // act
+        using (var patcher = new SpecialImportsConditionPatcher(projectPath))
+        {
+            var initialPatchedContent = await File.ReadAllTextAsync(projectPath, TestContext.Current.CancellationToken);
+            Assert.Contains("Condition=\"false\"", initialPatchedContent);
+
+            // this simulates an operation that updated the `<Import Project="..."` attribute that we still want to be present when we're all done
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <Import Project="UPDATED\Path\Microsoft.WebApplication.targets" Condition="false" />
+                </Project>
+                """, TestContext.Current.CancellationToken);
+        }
+
+        // assert
+        var restoredAndUpdatedContent = await File.ReadAllTextAsync(projectPath, TestContext.Current.CancellationToken);
+        Assert.Equal("""
+            <Project Sdk="Microsoft.NET.Sdk">
+              <Import Project="UPDATED\Path\Microsoft.WebApplication.targets" />
+            </Project>
+            """.Replace("\r", ""), restoredAndUpdatedContent.Replace("\r", ""));
+    }
+
+    [Fact]
+    public async Task NewAttributesAreRetainedThroughConditionPatching()
+    {
+        // it's possible that an operation updated a `<Import Project="..." />` element after we patched it with `Condition="false"`
+        // this test ensures that if that did happen, we don't lose any attributes that were added
+
+        // arrange
+        var projectFileName = "project.csproj";
+        using var tempDir = await TemporaryDirectory.CreateWithContentsAsync((projectFileName, """
+            <Project Sdk="Microsoft.NET.Sdk">
+              <Import Project="Some\Path\Microsoft.WebApplication.targets" />
+            </Project>
+            """));
+        var projectPath = Path.Join(tempDir.DirectoryPath, projectFileName);
+
+        // act
+        using (var patcher = new SpecialImportsConditionPatcher(projectPath))
+        {
+            var initialPatchedContent = await File.ReadAllTextAsync(projectPath, TestContext.Current.CancellationToken);
+            Assert.Contains("Condition=\"false\"", initialPatchedContent);
+
+            // this simulates an operation that added the `NewAttribute="..."` attribute that we still want to be present when we're all done
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <Import Project="Some\Path\Microsoft.WebApplication.targets" NewAttribute="NewValue" Condition="false" />
+                </Project>
+                """, TestContext.Current.CancellationToken);
+        }
+
+        // assert
+        var restoredAndUpdatedContent = await File.ReadAllTextAsync(projectPath, TestContext.Current.CancellationToken);
+        Assert.Equal("""
+            <Project Sdk="Microsoft.NET.Sdk">
+              <Import Project="Some\Path\Microsoft.WebApplication.targets" NewAttribute="NewValue" />
+            </Project>
+            """.Replace("\r", ""), restoredAndUpdatedContent.Replace("\r", ""));
+    }
+
+    [Fact]
+    public async Task RemovedAttributesAreNotReAddedThroughConditionPatching()
+    {
+        // it's possible that an operation updated a `<Import Project="..." />` element after we patched it with `Condition="false"`
+        // this test ensures that if that did happen, we don't re-add any attributes that were removed
+
+        // arrange
+        var projectFileName = "project.csproj";
+        using var tempDir = await TemporaryDirectory.CreateWithContentsAsync((projectFileName, """
+            <Project Sdk="Microsoft.NET.Sdk">
+              <Import Project="Some\Path\Microsoft.WebApplication.targets" UnrelatedAttribute="UnrelatedValue" />
+            </Project>
+            """));
+        var projectPath = Path.Join(tempDir.DirectoryPath, projectFileName);
+
+        // act
+        using (var patcher = new SpecialImportsConditionPatcher(projectPath))
+        {
+            var initialPatchedContent = await File.ReadAllTextAsync(projectPath, TestContext.Current.CancellationToken);
+            Assert.Contains("Condition=\"false\"", initialPatchedContent);
+
+            // this simulates an operation that removed the `UnrelatedAttribute="..."` attribute that should remain absent when we're all done
+            await File.WriteAllTextAsync(projectPath, """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <Import Project="Some\Path\Microsoft.WebApplication.targets" Condition="false" />
+                </Project>
+                """, TestContext.Current.CancellationToken);
+        }
+
+        // assert
+        var restoredAndUpdatedContent = await File.ReadAllTextAsync(projectPath, TestContext.Current.CancellationToken);
+        Assert.Equal("""
+            <Project Sdk="Microsoft.NET.Sdk">
+              <Import Project="Some\Path\Microsoft.WebApplication.targets" />
+            </Project>
+            """.Replace("\r", ""), restoredAndUpdatedContent.Replace("\r", ""));
+    }
+
     public static IEnumerable<object[]> SpecialImportsConditionPatcherTestData()
     {
         // magic file names
@@ -79,6 +193,27 @@ public class SpecialFilePatcherTests
             """
         ];
 
+        // one-off test to verify no whitespace before end tag is supported
+        yield return
+        [
+            // fileContent
+            """
+            <Project>
+              <Import Project="Unrelated.One.targets" />
+              <Import Project="Some\Path\Microsoft.WebApplication.targets"/>
+              <Import Project="Unrelated.Two.targets" />
+            </Project>
+            """,
+            // expectedPatchedContent
+            """
+            <Project>
+              <Import Project="Unrelated.One.targets" />
+              <Import Project="Some\Path\Microsoft.WebApplication.targets" Condition="false" />
+              <Import Project="Unrelated.Two.targets" />
+            </Project>
+            """
+        ];
+
         // one-off test to verify existing conditions are restored
         yield return
         [
@@ -100,6 +235,28 @@ public class SpecialFilePatcherTests
             """
         ];
 
+        // one-off test to verify existing conditions are restored when on a different line
+        yield return
+        [
+            // fileContent
+            """
+            <Project>
+              <Import Project="Unrelated.One.targets" />
+              <Import Project="Some\Path\Microsoft.WebApplication.targets"
+                      Condition="existing condition on a different line" />
+              <Import Project="Unrelated.Two.targets" />
+            </Project>
+            """,
+            // expectedPatchedContent
+            """
+            <Project>
+              <Import Project="Unrelated.One.targets" />
+              <Import Project="Some\Path\Microsoft.WebApplication.targets" Condition="false" />
+              <Import Project="Unrelated.Two.targets" />
+            </Project>
+            """
+        ];
+
         // all file variations - by its nature, also verifies that multiple replacements can occur
         yield return
         [

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.386.0
+  version: 0.388.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.388.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.386.0
+        version: 0.388.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -581,7 +581,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.386.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.388.0
 rdoc_options: []
 require_paths:
 - lib