dependabot-nuget 0.112.32 → 0.112.33

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 915880252c80d49f49f50d0b2db7a016a46323f0aeec6c671175b595b3d6b3d2
-  data.tar.gz: 7bfa72166ac847ed49ed79eb235e63861cad037f56cd890c89126c06cc64d0ca
+  metadata.gz: f037ef6001028c6e9f69bec4d3dd7cff65bb26ae13c6ae115ce16f9d0b187413
+  data.tar.gz: 7b813eb5a6782df9673c65161848b7bff28d54bc87e644679f11b9e47647ae35
 SHA512:
-  metadata.gz: bd17c3a48b79cdbf7281c8b79cf40711271f57520aa6766e7aa7dd0ecf784188d495a02f613b151f8cb81061fd47e0a0e11286d6ba09059cca32430e265e715d
-  data.tar.gz: ed3e0503e11f48ea4c21fd88407c5a3f12c5ef46165263aec99e8dca13060d4c55615974b1e1c9556e3f19b89eb0210629d7f1f31a372f5e5f78b57c4f7341b5
+  metadata.gz: 3be5c7b988aa8d7dd38529c1cc0a5ccdae93c7e33552d7e3be9e83bc735939c95cd17052a71fe087281020053d050c3068b69cce6ababf70ae2b41a3fe2d431e
+  data.tar.gz: 1486b00f3f48b7a5ee1a9e3e1fcce48a1dfc9ca0e23124a5204467df04b0e58557c933d1d91a17a768e69381709b7d260d500c1443acd32a92709db9cfcf488c

data/lib/dependabot/nuget/file_fetcher.rb

@@ -32,6 +32,7 @@ module Dependabot
         fetched_files += packages_config_files
         fetched_files += nuget_config_files
         fetched_files << global_json if global_json
+        fetched_files << packages_props if packages_props
 
         fetched_files = fetched_files.uniq
 
@@ -216,6 +217,10 @@ module Dependabot
         @global_json ||= fetch_file_if_present("global.json")
       end
 
+      def packages_props
+        @packages_props ||= fetch_file_if_present("Packages.props")
+      end
+
       def imported_property_files
         imported_property_files = []
 

data/lib/dependabot/nuget/file_parser/project_file_parser.rb

@@ -15,10 +15,12 @@ module Dependabot
         require_relative "property_value_finder"
 
         DEPENDENCY_SELECTOR = "ItemGroup > PackageReference, "\
+                              "ItemGroup > GlobalPackageReference, "\
                               "ItemGroup > Dependency, "\
                               "ItemGroup > DevelopmentDependency"
 
         PROPERTY_REGEX      = /\$\((?<property>.*?)\)/.freeze
+        ITEM_REGEX          = /\@\((?<property>.*?)\)/.freeze
 
         def initialize(dependency_files:)
           @dependency_files = dependency_files
@@ -79,9 +81,15 @@ module Dependabot
         def dependency_name(dependency_node, project_file)
           raw_name =
             dependency_node.attribute("Include")&.value&.strip ||
-            dependency_node.at_xpath("./Include")&.content&.strip
+            dependency_node.at_xpath("./Include")&.content&.strip ||
+            dependency_node.attribute("Update")&.value&.strip ||
+            dependency_node.at_xpath("./Update")&.content&.strip
           return unless raw_name
 
+          # If the item contains @(ItemGroup) then ignore as it
+          # updates a set of ItemGroup elements
+          return if raw_name.match?(ITEM_REGEX)
+
           evaluated_value(raw_name, project_file)
         end
 

data/lib/dependabot/nuget/file_parser/property_value_finder.rb

@@ -37,6 +37,9 @@ module Dependabot
               callsite_file: callsite_file
             )
 
+          node_details ||=
+            find_property_in_packages_props(property: property_name)
+
           return unless node_details
           return node_details unless node_details[:value] =~ PROPERTY_REGEX
 
@@ -109,6 +112,13 @@ module Dependabot
           deep_find_prop_node(property: property, file: file)
         end
 
+        def find_property_in_packages_props(property:)
+          file = packages_props_file
+          return unless file
+
+          deep_find_prop_node(property: property, file: file)
+        end
+
         def build_targets_file_for_project(project_file)
           dir = File.dirname(project_file.name)
 
@@ -142,6 +152,10 @@ module Dependabot
           dependency_files.find { |f| f.name == path }
         end
 
+        def packages_props_file
+          dependency_files.find { |f| f.name.casecmp("Packages.props").zero? }
+        end
+
         def property_xpath(property_name)
           "/Project/PropertyGroup/#{property_name}"
         end

data/lib/dependabot/nuget/file_updater/project_file_declaration_finder.rb

@@ -11,6 +11,8 @@ module Dependabot
           %r{
             <PackageReference [^>]*?/>|
             <PackageReference [^>]*?[^/]>.*?</PackageReference>|
+            <GlobalPackageReference [^>]*?/>|
+            <GlobalPackageReference [^>]*?[^/]>.*?</GlobalPackageReference>|
             <Dependency [^>]*?/>|
             <Dependency [^>]*?[^/]>.*?</Dependency>|
             <DevelopmentDependency [^>]*?/>|
@@ -39,16 +41,23 @@ module Dependabot
 
         private
 
+        def get_element_from_node(node)
+          node.at_xpath("/PackageReference") ||
+            node.at_xpath("/GlobalPackageReference") ||
+            node.at_xpath("/Dependency") ||
+            node.at_xpath("/DevelopmentDependency")
+        end
+
         def fetch_declaration_strings
           deep_find_declarations(declaring_file.content).select do |nd|
             node = Nokogiri::XML(nd)
             node.remove_namespaces!
-            node = node.at_xpath("/PackageReference") ||
-                   node.at_xpath("/Dependency") ||
-                   node.at_xpath("/DevelopmentDependency")
+            node = get_element_from_node(node)
 
             node_name = node.attribute("Include")&.value&.strip ||
-                        node.at_xpath("./Include")&.content&.strip
+                        node.at_xpath("./Include")&.content&.strip ||
+                        node.attribute("Update")&.value&.strip ||
+                        node.at_xpath("./Update")&.content&.strip
             next false unless node_name&.downcase == dependency_name&.downcase
 
             node_requirement = get_node_version_value(node)

data/lib/dependabot/nuget/file_updater.rb

@@ -16,7 +16,8 @@ module Dependabot
           /^packages\.config$/i,
           /^global\.json$/i,
           /^Directory\.Build\.props$/i,
-          /^Directory\.Build\.targets$/i
+          /^Directory\.Build\.targets$/i,
+          /^Packages\.props$/i
         ]
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.112.32
+  version: 0.112.33
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-09-02 00:00:00.000000000 Z
+date: 2019-09-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.32
+        version: 0.112.33
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.112.32
+        version: 0.112.33
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement