dependabot-nuget 0.400.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a29d38c1ed416c5fc9c810f3815f241789054754ff92ac4982bf65e9ef221488
-  data.tar.gz: 75c1ce1d121fc582d1ad2edbd1e3a35bb79e6955501984585643e455a85e4934
+  metadata.gz: 00434f51ff3cf781726cf8af2a49739342481e4d6d43d010077dac710be8f3e1
+  data.tar.gz: bb4d30f0ca2f0470f1aa45ff2d077fc934e79b86a709efd99a0bf4ed3a435c7a
 SHA512:
-  metadata.gz: 525d56946331f53dabd8705aa5a903b2489b89e2ebf40a5cc3b514dbf4c28d93633e09a46330d8d0b0509e7feb2439a988a408dd4f01e5ce71cf4b4c6a7cbb41
-  data.tar.gz: 2bdbf0b8a2c5302646e50fa666a14b91567dfecc96713472a419f15407c1c7a7628470adec534c50edf342ac4f3356f90840bf1d8c65526f24660d6b005fd9c1
+  metadata.gz: 28bed39edb1dc2c63921fdeb933449f96931c7866f0096718ca8735cc4e4d18fc9f1cf3472c656aafe9ef1e6cd610af03e739ad0f52e32e6111feea56fcab05c
+  data.tar.gz: ca65ed03d6d0440e4ac70d537a41caf0ad25438d6e716d2d3e3cbeee969a8071623bf264e4b7befb7fb19308b25c479d1bfb23dc7dbee425cdb8b96c0ed593d6

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/AnalyzeWorker.cs

@@ -4,6 +4,7 @@ using System.Text.Json;
 using System.Text.Json.Serialization;
 
 using NuGet.Frameworks;
+using NuGet.Packaging.Core;
 using NuGet.Versioning;
 
 using NuGetUpdater.Core.Discover;
@@ -258,20 +259,21 @@ public partial class AnalyzeWorker : IAnalyzeWorker
         Func<NuGetVersion, Task<bool>>? candidateValidator,
         CancellationToken cancellationToken)
     {
-        var versionResult = await VersionFinder.GetVersionsAsync(
-            projectFrameworks,
+        var currentTime = DateTimeOffset.UtcNow;
+        var versionResult = await VersionFinder.GetCandidateVersionsAsync(
             dependencyInfo,
-            DateTimeOffset.UtcNow,
+            currentTime,
             nugetContext,
             logger,
             cancellationToken);
 
         return await FindUpdatedVersionAsync(
             packageIds,
-            dependencyInfo.Version,
+            dependencyInfo,
             versionResult,
             projectFrameworks,
             findLowestVersion: dependencyInfo.IsVulnerable,
+            currentTime,
             nugetContext,
             logger,
             candidateValidator,
@@ -280,10 +282,11 @@ public partial class AnalyzeWorker : IAnalyzeWorker
 
     internal static async Task<NuGetVersion?> FindUpdatedVersionAsync(
         ImmutableHashSet<string> packageIds,
-        string versionString,
+        DependencyInfo dependencyInfo,
         VersionResult versionResult,
         ImmutableArray<NuGetFramework> projectFrameworks,
         bool findLowestVersion,
+        DateTimeOffset currentTime,
         NuGetContext nugetContext,
         ILogger logger,
         Func<NuGetVersion, Task<bool>>? candidateValidator,
@@ -302,10 +305,11 @@ public partial class AnalyzeWorker : IAnalyzeWorker
 
         return await FindFirstCompatibleVersion(
             packageIds,
-            versionString,
+            dependencyInfo,
             versionResult,
             orderedVersions,
             projectFrameworks,
+            currentTime,
             nugetContext,
             logger,
             candidateValidator,
@@ -314,58 +318,70 @@ public partial class AnalyzeWorker : IAnalyzeWorker
 
     internal static async Task<NuGetVersion?> FindFirstCompatibleVersion(
         ImmutableHashSet<string> packageIds,
-        string versionString,
+        DependencyInfo dependencyInfo,
         VersionResult versionResult,
         IEnumerable<NuGetVersion> orderedVersions,
         ImmutableArray<NuGetFramework> projectFrameworks,
+        DateTimeOffset currentTime,
         NuGetContext nugetContext,
         ILogger logger,
         Func<NuGetVersion, Task<bool>>? candidateValidator,
         CancellationToken cancellationToken)
     {
-        if (NuGetVersion.TryParse(versionString, out var currentVersion))
+        var checkSiblingCompatibility = true;
+        if (NuGetVersion.TryParse(dependencyInfo.Version, out var currentVersion))
         {
-            var isCompatible = await AreAllPackagesCompatibleAsync(
+            checkSiblingCompatibility = await AreAllPackagesCompatibleAsync(
                 packageIds,
                 currentVersion,
                 projectFrameworks,
                 nugetContext,
                 logger,
                 cancellationToken);
-
-            if (!isCompatible)
-            {
-                // If the current package is incompatible, then don't check for compatibility.
-                foreach (var version in orderedVersions)
-                {
-                    if (candidateValidator is null || await candidateValidator(version))
-                    {
-                        return version;
-                    }
-                }
-
-                return null;
-            }
         }
 
         foreach (var version in orderedVersions)
         {
-            var existsForAll = await VersionFinder.DoVersionsExistAsync(packageIds, version, nugetContext, logger, cancellationToken);
-            if (!existsForAll)
+            var primaryIdentity = new PackageIdentity(dependencyInfo.Name, version);
+            if (!await CompatibilityChecker.IsAvailableAndCompatibleAsync(
+                    primaryIdentity,
+                    projectFrameworks,
+                    nugetContext,
+                    logger,
+                    cancellationToken))
             {
                 continue;
             }
 
-            var isCompatible = await AreAllPackagesCompatibleAsync(
-                packageIds,
+            if (!await AreSiblingPackagesAcceptableAsync(
+                    dependencyInfo.Name,
+                    packageIds,
+                    version,
+                    projectFrameworks,
+                    checkSiblingCompatibility,
+                    nugetContext,
+                    logger,
+                    cancellationToken))
+            {
+                continue;
+            }
+
+            var allowedSources = await VersionFinder.GetCooldownAllowedSourcesAsync(
+                dependencyInfo,
+                currentTime,
+                versionResult.CurrentVersion,
                 version,
-                projectFrameworks,
+                versionResult.GetPackageSources(version),
                 nugetContext,
                 logger,
                 cancellationToken);
+            if (allowedSources.IsEmpty)
+            {
+                continue;
+            }
 
-            if (isCompatible &&
-                (candidateValidator is null || await candidateValidator(version)))
+            versionResult.SetPackageSources(version, allowedSources);
+            if (candidateValidator is null || await candidateValidator(version))
             {
                 return version;
             }
@@ -385,7 +401,7 @@ public partial class AnalyzeWorker : IAnalyzeWorker
     {
         foreach (var packageId in packageIds)
         {
-            var isCompatible = await CompatibilityChecker.CheckAsync(
+            var isCompatible = await CompatibilityChecker.ExistsAndIsCompatibleAsync(
                 new(packageId, currentVersion),
                 projectFrameworks,
                 nugetContext,
@@ -400,6 +416,40 @@ public partial class AnalyzeWorker : IAnalyzeWorker
         return true;
     }
 
+    internal static async Task<bool> AreSiblingPackagesAcceptableAsync(
+        string primaryPackageId,
+        ImmutableHashSet<string> packageIds,
+        NuGetVersion version,
+        ImmutableArray<NuGetFramework> projectFrameworks,
+        bool checkCompatibility,
+        NuGetContext nugetContext,
+        ILogger logger,
+        CancellationToken cancellationToken)
+    {
+        foreach (var packageId in packageIds.Where(
+                     packageId => !packageId.Equals(primaryPackageId, StringComparison.OrdinalIgnoreCase)))
+        {
+            var packageIdentity = new PackageIdentity(packageId, version);
+            var isAcceptable = checkCompatibility
+                ? await CompatibilityChecker.IsAvailableAndCompatibleAsync(
+                    packageIdentity,
+                    projectFrameworks,
+                    nugetContext,
+                    logger,
+                    cancellationToken)
+                : await CompatibilityChecker.ExistsAsync(
+                    packageIdentity,
+                    nugetContext,
+                    cancellationToken);
+            if (!isAcceptable)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     internal static async Task<ImmutableArray<Dependency>> FindUpdatedDependenciesAsync(
         string repoRoot,
         WorkspaceDiscoveryResult discovery,

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/CompatibilityChecker.cs

@@ -0,0 +1,403 @@
+using System.Collections.Immutable;
+
+using NuGet.Common;
+using NuGet.Configuration;
+using NuGet.Frameworks;
+using NuGet.Packaging;
+using NuGet.Packaging.Core;
+using NuGet.Protocol;
+using NuGet.Protocol.Core.Types;
+
+using NuGetUpdater.Core.FrameworkChecker;
+
+namespace NuGetUpdater.Core.Analyze;
+
+using PackageInfo = (bool IsDevDependency, ImmutableArray<NuGetFramework> Frameworks);
+using PackageReaders = (IAsyncPackageCoreReader CoreReader, IAsyncPackageContentReader ContentReader);
+
+internal static class CompatibilityChecker
+{
+    public static async Task<bool> CheckAsync(
+        PackageIdentity package,
+        ImmutableArray<NuGetFramework> projectFrameworks,
+        NuGetContext nugetContext,
+        ILogger logger,
+        CancellationToken cancellationToken)
+    {
+        var packageInfo = await GetPackageInfoAsync(
+            package,
+            nugetContext,
+            cancellationToken);
+        if (packageInfo is null)
+        {
+            return false;
+        }
+
+        var (isDevDependency, packageFrameworks) = packageInfo.GetValueOrDefault();
+        return PerformCheck(package, projectFrameworks, isDevDependency, packageFrameworks, logger);
+    }
+
+    public static async Task<bool> ExistsAndIsCompatibleAsync(
+        PackageIdentity package,
+        ImmutableArray<NuGetFramework> projectFrameworks,
+        NuGetContext nugetContext,
+        ILogger logger,
+        CancellationToken cancellationToken)
+    {
+        var packageInfo = await GetPackageInfoAsync(
+            package,
+            nugetContext,
+            cancellationToken);
+        if (packageInfo is null)
+        {
+            return false;
+        }
+
+        // dotnet-tools.json and global.json packages won't specify a TFM, so existence is sufficient
+        if (projectFrameworks.IsEmpty)
+        {
+            return true;
+        }
+
+        var (isDevDependency, packageFrameworks) = packageInfo.GetValueOrDefault();
+        return PerformCheck(package, projectFrameworks, isDevDependency, packageFrameworks, logger);
+    }
+
+    public static async Task<bool> IsAvailableAndCompatibleAsync(
+        PackageIdentity package,
+        ImmutableArray<NuGetFramework> projectFrameworks,
+        NuGetContext nugetContext,
+        ILogger logger,
+        CancellationToken cancellationToken)
+    {
+        var packageInfo = await GetPackageInfoAsync(
+            package,
+            nugetContext,
+            requireSourceAvailability: true,
+            cancellationToken);
+        if (packageInfo is null)
+        {
+            return false;
+        }
+
+        if (projectFrameworks.IsEmpty)
+        {
+            return true;
+        }
+
+        var (isDevDependency, packageFrameworks) = packageInfo.GetValueOrDefault();
+        return PerformCheck(package, projectFrameworks, isDevDependency, packageFrameworks, logger);
+    }
+
+    public static async Task<bool> ExistsAsync(
+        PackageIdentity package,
+        NuGetContext nugetContext,
+        CancellationToken cancellationToken)
+    {
+        var readersOption = await GetPackageReadersAsync(
+            package,
+            nugetContext,
+            requireSourceAvailability: true,
+            cancellationToken);
+        if (readersOption is null)
+        {
+            return false;
+        }
+
+        var readers = readersOption.GetValueOrDefault();
+        DisposeReaders(readers);
+        return true;
+    }
+
+    internal static bool PerformCheck(
+        PackageIdentity package,
+        ImmutableArray<NuGetFramework> projectFrameworks,
+        bool isDevDependency,
+        ImmutableArray<NuGetFramework> packageFrameworks,
+        ILogger logger)
+    {
+        // development dependencies are packages such as analyzers which need to be compatible with the compiler not the
+        // project itself, but some packages that report themselves as development dependencies still contain target
+        // framework dependencies and should be checked for compatibility through the regular means
+        if (isDevDependency && packageFrameworks.Length == 0)
+        {
+            return true;
+        }
+
+        if (packageFrameworks.Length == 0 || projectFrameworks.Length == 0)
+        {
+            return false;
+        }
+
+        var compatibilityService = new FrameworkCompatibilityService();
+        var compatibleFrameworks = compatibilityService.GetCompatibleFrameworks(packageFrameworks);
+        var packageSupportsAny = compatibleFrameworks.Any(f => f.IsAny);
+        if (packageSupportsAny)
+        {
+            return true;
+        }
+
+        var incompatibleFrameworks = projectFrameworks.Where(f => !compatibleFrameworks.Contains(f)).ToArray();
+        if (incompatibleFrameworks.Length > 0)
+        {
+            logger.Info($"The package {package} is not compatible. Incompatible project frameworks: {string.Join(", ", incompatibleFrameworks.Select(f => f.GetShortFolderName()))}");
+            return false;
+        }
+
+        return true;
+    }
+
+    internal static async Task<PackageReaders?> GetPackageReadersAsync(
+        PackageIdentity package,
+        NuGetContext nugetContext,
+        CancellationToken cancellationToken)
+    {
+        return await GetPackageReadersAsync(
+            package,
+            nugetContext,
+            requireSourceAvailability: false,
+            cancellationToken);
+    }
+
+    private static async Task<PackageReaders?> GetPackageReadersAsync(
+        PackageIdentity package,
+        NuGetContext nugetContext,
+        bool requireSourceAvailability,
+        CancellationToken cancellationToken)
+    {
+        var packagePath = GetPackagePath(package, nugetContext);
+        if (!requireSourceAvailability && File.Exists(packagePath))
+        {
+            return ReadPackage(packagePath);
+        }
+
+        if (File.Exists(packagePath))
+        {
+            return await IsAvailableAsync(package, nugetContext, cancellationToken)
+                ? ReadPackage(packagePath)
+                : null;
+        }
+
+        return await DownloadPackageAsync(package, nugetContext, cancellationToken);
+    }
+
+    internal static async Task<PackageInfo?> GetPackageInfoAsync(
+        PackageIdentity package,
+        NuGetContext nugetContext,
+        CancellationToken cancellationToken)
+    {
+        var readersOption = await GetPackageReadersAsync(package, nugetContext, cancellationToken);
+        return await ReadPackageInfoAsync(readersOption, cancellationToken);
+    }
+
+    private static async Task<PackageInfo?> GetPackageInfoAsync(
+        PackageIdentity package,
+        NuGetContext nugetContext,
+        bool requireSourceAvailability,
+        CancellationToken cancellationToken)
+    {
+        var readersOption = await GetPackageReadersAsync(
+            package,
+            nugetContext,
+            requireSourceAvailability,
+            cancellationToken);
+        return await ReadPackageInfoAsync(readersOption, cancellationToken);
+    }
+
+    private static async Task<PackageInfo?> ReadPackageInfoAsync(
+        PackageReaders? readersOption,
+        CancellationToken cancellationToken)
+    {
+        if (readersOption is null)
+        {
+            return null;
+        }
+
+        var readers = readersOption.GetValueOrDefault();
+        try
+        {
+            var nuspecStream = await readers.CoreReader.GetNuspecAsync(cancellationToken);
+            var reader = new NuspecReader(nuspecStream);
+
+            var isDevDependency = reader.GetDevelopmentDependency();
+            var tfms = new HashSet<NuGetFramework>();
+            var dependencyGroups = reader.GetDependencyGroups().ToArray();
+
+            foreach (var d in dependencyGroups)
+            {
+                if (!d.TargetFramework.IsAny)
+                {
+                    tfms.Add(d.TargetFramework);
+                }
+            }
+
+            var refItems = (await readers.ContentReader.GetReferenceItemsAsync(cancellationToken)).ToArray();
+            foreach (var refItem in refItems)
+            {
+                tfms.Add(refItem.TargetFramework);
+            }
+
+            var libItems = (await readers.ContentReader.GetLibItemsAsync(cancellationToken)).ToArray();
+            foreach (var libItem in libItems)
+            {
+                tfms.Add(libItem.TargetFramework);
+            }
+
+            // if a package contains no assemblies that need to be referenced, we can consider it compatible with all frameworks
+            if (refItems.Length == 0 && libItems.Length == 0)
+            {
+                tfms.Clear();
+            }
+
+            if (!tfms.Any())
+            {
+                tfms.Add(NuGetFramework.AnyFramework);
+            }
+
+            return (isDevDependency, tfms.ToImmutableArray());
+        }
+        finally
+        {
+            DisposeReaders(readers);
+        }
+    }
+
+    private static void DisposeReaders(PackageReaders readers)
+    {
+        // The interfaces aren't disposable, but their implementations can be. The same object often implements both.
+        var coreReader = readers.CoreReader as IDisposable;
+        var contentReader = readers.ContentReader as IDisposable;
+        try
+        {
+            coreReader?.Dispose();
+        }
+        finally
+        {
+            if (!ReferenceEquals(coreReader, contentReader))
+            {
+                contentReader?.Dispose();
+            }
+        }
+    }
+
+    internal static PackageReaders ReadPackage(string packagePath)
+    {
+        var stream = new FileStream(
+              packagePath,
+              FileMode.Open,
+              FileAccess.Read,
+              FileShare.Read,
+              bufferSize: 4096);
+        PackageArchiveReader archiveReader = new(stream);
+        return (archiveReader, archiveReader);
+    }
+
+    internal static async Task<PackageReaders?> DownloadPackageAsync(
+        PackageIdentity package,
+        NuGetContext context,
+        CancellationToken cancellationToken)
+    {
+        foreach (var source in GetAllowedSources(package.Id, context))
+        {
+            FindPackageByIdResource feed;
+            try
+            {
+                var sourceRepository = context.GetSourceRepository(source);
+                feed = await sourceRepository.GetResourceAsync<FindPackageByIdResource>(cancellationToken)
+                    ?? throw new NotSupportedException($"Failed to get FindPackageByIdResource for {source.SourceUri}");
+
+                // a non-compliant v2 API returning 404 can cause this to throw
+                var exists = await feed.DoesPackageExistAsync(
+                    package.Id,
+                    package.Version,
+                    context.SourceCacheContext,
+                    NullLogger.Instance,
+                    cancellationToken);
+                if (!exists)
+                {
+                    continue;
+                }
+            }
+            catch (FatalProtocolException)
+            {
+                // if anything goes wrong here, the package source obviously doesn't contain the requested package
+                continue;
+            }
+
+            var downloader = await feed.GetPackageDownloaderAsync(
+                package,
+                context.SourceCacheContext,
+                context.Logger,
+                cancellationToken);
+
+            var packagePath = GetPackagePath(package, context);
+            var isDownloaded = await downloader.CopyNupkgFileToAsync(packagePath, cancellationToken);
+            if (isDownloaded)
+            {
+                return (downloader.CoreReader, downloader.ContentReader);
+            }
+        }
+
+        return null;
+    }
+
+    private static async Task<bool> IsAvailableAsync(
+        PackageIdentity package,
+        NuGetContext context,
+        CancellationToken cancellationToken)
+    {
+        foreach (var source in GetAllowedSources(package.Id, context))
+        {
+            try
+            {
+                var sourceRepository = context.GetSourceRepository(source);
+                var feed = await sourceRepository.GetResourceAsync<FindPackageByIdResource>(cancellationToken)
+                    ?? throw new NotSupportedException($"Failed to get FindPackageByIdResource for {source.SourceUri}");
+                if (await feed.DoesPackageExistAsync(
+                        package.Id,
+                        package.Version,
+                        context.SourceCacheContext,
+                        NullLogger.Instance,
+                        cancellationToken))
+                {
+                    return true;
+                }
+            }
+            catch (FatalProtocolException)
+            {
+                // Try the next allowed source.
+            }
+        }
+
+        return false;
+    }
+
+    private static ImmutableArray<PackageSource> GetAllowedSources(string packageId, NuGetContext context)
+    {
+        var sourceMapping = PackageSourceMapping.GetPackageSourceMapping(context.Settings);
+        var packageSources = sourceMapping.GetConfiguredPackageSources(packageId).ToHashSet();
+        return packageSources.Count == 0
+            ? context.PackageSources
+            : context.PackageSources
+                .Where(source => packageSources.Contains(source.Name))
+                .ToImmutableArray();
+    }
+
+    internal static string GetPackagePath(PackageIdentity package, NuGetContext context)
+    {
+        // https://learn.microsoft.com/en-us/nuget/consume-packages/managing-the-global-packages-and-cache-folders
+        var nugetPackagesPath = Environment.GetEnvironmentVariable("NUGET_PACKAGES");
+        if (nugetPackagesPath is null)
+        {
+            // n.b., this path should never be hit during a unit test
+            nugetPackagesPath = Path.Join(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".nuget", "packages");
+        }
+
+        var normalizedName = package.Id.ToLowerInvariant();
+        var normalizedVersion = package.Version.ToNormalizedString().ToLowerInvariant();
+        var packageDirectory = Path.Join(nugetPackagesPath, normalizedName, normalizedVersion);
+        Directory.CreateDirectory(packageDirectory);
+        var packagePath = Path.Join(packageDirectory, $"{normalizedName}.{normalizedVersion}.nupkg");
+        return packagePath;
+    }
+}