dependabot-nuget 0.239.0 → 0.240.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bf5bdfc4f365f5d04c30193e1b44e7a82ddb5816461148e4172cabc1a86bea3
-  data.tar.gz: 0ca7483d0fdc3d3a7dc2af7c8f475e7b02a121d4a8a5c58f495ff857d32c3dad
+  metadata.gz: 7d8152c074be84d639b86fe67da074f558ca1509102a5a1e9e97c3411178a747
+  data.tar.gz: 6562552b5b89ddfc8c521aeb7a52cf17e2d918c230439f70281663d5e8e45811
 SHA512:
-  metadata.gz: a0bd5448386d99ac0fa6a27ea6f5ec137885cd8a208762602d69284c1cdea6bb9e521a885b9a50cb42eb45b2de9ec760def87940c15023a910f7f9455a612fc9
-  data.tar.gz: 4096cfc58f861ec2f4f5d7a4022fd06f001d0f4421130bf0708e877a93ce2e12e722259d60b29f8303375d2e3cdc5f595e396cb4273d5c1e03a34e23a3a154ec
+  metadata.gz: 6d91dec9cd6d5db739507bfc91d6454b6f21426a60a2086bd7b944922d4fa123886dbb1037a94b712471deeb89d175c1b0f10a2b84aeb7f6810f3aeddb92eecb
+  data.tar.gz: 7dbe0cacc3ffaa2d9290e09da5026a94432b8f45b839c6db49905b40636188c0201b61f6650aa1a01fa36fe590672b3e0359b8d4139d1bfe26d98dac344b494a

data/lib/dependabot/nuget/cache_manager.rb

@@ -13,6 +13,8 @@ module Dependabot
       end
 
       def self.cache(name)
+        return {} if caching_disabled?
+
         @cache ||= {}
         @cache[name] ||= {}
         @cache[name]

data/lib/dependabot/nuget/file_fetcher.rb

@@ -3,6 +3,7 @@
 
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/nuget/cache_manager"
 require "set"
 require "sorbet-runtime"
 
@@ -23,7 +24,7 @@ module Dependabot
         return true if filenames.any? { |f| f.match?("^src$") }
         return true if filenames.any? { |f| f.end_with?(".proj") }
 
-        filenames.any? { |name| name.match?(%r{^[^/]*\.[a-z]{2}proj$}) }
+        filenames.any? { |name| name.match?(/\.[a-z]{2}proj$/) }
       end
 
       def self.required_files_message
@@ -219,29 +220,32 @@ module Dependabot
       def nuget_config_files
         return @nuget_config_files if @nuget_config_files
 
-        @nuget_config_files = []
-        candidate_paths = [*project_files.map { |f| File.dirname(f.name) }, "."].uniq
-        visited_directories = Set.new
-        candidate_paths.each do |dir|
-          search_in_directory_and_parents(dir, visited_directories)
-        end
+        @nuget_config_files = [*project_files.map do |f|
+                                 named_file_up_tree_from_project_file(f, "nuget.config")
+                               end].compact.uniq
         @nuget_config_files
       end
 
-      def search_in_directory_and_parents(dir, visited_directories)
-        loop do
-          break if visited_directories.include?(dir)
-
-          visited_directories << dir
-          file = repo_contents(dir: dir)
-                 .find { |f| f.name.casecmp("nuget.config").zero? }
-          if file
-            file = fetch_file_from_host(File.join(dir, file.name))
-            file&.tap { |f| f.support_file = true }
-            @nuget_config_files << file
+      def named_file_up_tree_from_project_file(project_file, expected_file_name)
+        found_expected_file = nil
+        directory_path = Pathname.new(directory)
+        full_project_dir = Pathname.new(project_file.directory).join(project_file.name).dirname
+        full_project_dir.ascend.each do |base|
+          break if found_expected_file
+
+          candidate_file_path = Pathname.new(base).join(expected_file_name).cleanpath.to_path
+          candidate_directory = Pathname.new(File.dirname(candidate_file_path))
+          relative_candidate_directory = candidate_directory.relative_path_from(directory_path)
+          candidate_file = repo_contents(dir: relative_candidate_directory).find do |f|
+            f.name.casecmp?(expected_file_name)
+          end
+          if candidate_file
+            found_expected_file = fetch_file_from_host(File.join(relative_candidate_directory,
+                                                                 candidate_file.name))
           end
-          dir = File.dirname(dir)
         end
+
+        found_expected_file
       end
 
       def global_json
@@ -280,27 +284,34 @@ module Dependabot
       end
 
       def fetch_imported_property_files(file:, previously_fetched_files:)
-        paths =
-          ImportPathsFinder.new(project_file: file).import_paths +
-          ImportPathsFinder.new(project_file: file).project_reference_paths +
-          ImportPathsFinder.new(project_file: file).project_file_paths
-
-        paths.flat_map do |path|
-          next if previously_fetched_files.map(&:name).include?(path)
-          next if file.name == path
-          next if path.include?("$(")
-
-          fetched_file = fetch_file_from_host(path)
-          grandchild_property_files = fetch_imported_property_files(
-            file: fetched_file,
-            previously_fetched_files: previously_fetched_files + [file]
-          )
-          [fetched_file, *grandchild_property_files]
-        rescue Dependabot::DependencyFileNotFound
-          # Don't worry about missing files too much for now (at least
-          # until we start resolving properties)
-          nil
-        end.compact
+        file_id = file.directory + "/" + file.name
+        @fetched_files ||= {}
+        if @fetched_files[file_id]
+          @fetched_files[file_id]
+        else
+          paths =
+            ImportPathsFinder.new(project_file: file).import_paths +
+            ImportPathsFinder.new(project_file: file).project_reference_paths +
+            ImportPathsFinder.new(project_file: file).project_file_paths
+
+          paths.flat_map do |path|
+            next if previously_fetched_files.map(&:name).include?(path)
+            next if file.name == path
+            next if path.include?("$(")
+
+            fetched_file = fetch_file_from_host(path)
+            grandchild_property_files = fetch_imported_property_files(
+              file: fetched_file,
+              previously_fetched_files: previously_fetched_files + [file]
+            )
+            @fetched_files[file_id] = [fetched_file, *grandchild_property_files]
+            @fetched_files[file_id]
+          rescue Dependabot::DependencyFileNotFound
+            # Don't worry about missing files too much for now (at least
+            # until we start resolving properties)
+            nil
+          end.compact
+        end
       end
     end
   end

data/lib/dependabot/nuget/file_parser/packages_config_parser.rb

@@ -26,16 +26,10 @@ module Dependabot
         end
 
         def dependency_set
-          return parse_dependencies if CacheManager.caching_disabled?
-
           key = "#{packages_config.name.downcase}::#{packages_config.content.hash}"
           cache = PackagesConfigParser.dependency_set_cache
 
           cache[key] ||= parse_dependencies
-
-          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
-          dependency_set += cache[key]
-          dependency_set
         end
 
         private

data/lib/dependabot/nuget/file_parser/project_file_parser.rb

@@ -7,13 +7,13 @@ require "dependabot/dependency"
 require "dependabot/nuget/file_parser"
 require "dependabot/nuget/update_checker"
 require "dependabot/nuget/cache_manager"
+require "dependabot/nuget/nuget_client"
 
 # For details on how dotnet handles version constraints, see:
 # https://docs.microsoft.com/en-us/nuget/reference/package-versioning
 module Dependabot
   module Nuget
     class FileParser
-      # rubocop:disable Metrics/ClassLength
       class ProjectFileParser
         require "dependabot/file_parsers/base/dependency_set"
         require_relative "property_value_finder"
@@ -50,16 +50,10 @@ module Dependabot
         end
 
         def dependency_set(project_file:)
-          return parse_dependencies(project_file) if CacheManager.caching_disabled?
-
           key = "#{project_file.name.downcase}::#{project_file.content.hash}"
           cache = ProjectFileParser.dependency_set_cache
 
           cache[key] ||= parse_dependencies(project_file)
-
-          dependency_set = Dependabot::FileParsers::Base::DependencySet.new
-          dependency_set += cache[key]
-          dependency_set
         end
 
         def target_frameworks(project_file:)
@@ -78,6 +72,10 @@ module Dependabot
           ["net#{value[1..-1].delete('.')}"]
         end
 
+        def nuget_configs
+          dependency_files.select { |f| f.name.match?(%r{(^|/)nuget\.config$}i) }
+        end
+
         private
 
         attr_reader :dependency_files, :credentials
@@ -281,7 +279,6 @@ module Dependabot
         end
 
         def dependency_has_search_results?(dependency)
-          nuget_configs = dependency_files.select { |f| f.name.casecmp?("nuget.config") }
           dependency_urls = UpdateChecker::RepositoryFinder.new(
             dependency: dependency,
             credentials: credentials,
@@ -307,16 +304,9 @@ module Dependabot
         end
 
         def dependency_url_has_matching_result_v3?(dependency_name, dependency_url)
-          url = dependency_url.fetch(:search_url)
-          auth_header = dependency_url.fetch(:auth_header)
-          response = execute_search_for_dependency_url(url, auth_header)
-          return false unless response.status == 200
-
-          body = JSON.parse(response.body)
-          data = body["data"]
-          return false unless data.length.positive?
+          versions = NugetClient.get_package_versions_v3(dependency_name, dependency_url)
 
-          data.any? { |result| result["id"].casecmp?(dependency_name) }
+          versions != nil
         end
 
         def dependency_url_has_matching_result_v2?(dependency_name, dependency_url)
@@ -490,10 +480,6 @@ module Dependabot
           end
         end
 
-        def nuget_configs
-          dependency_files.select { |f| f.name.match?(/nuget\.config$/i) }
-        end
-
         def global_json
           dependency_files.find { |f| f.name.casecmp("global.json").zero? }
         end
@@ -502,7 +488,6 @@ module Dependabot
           dependency_files.find { |f| f.name.casecmp(".config/dotnet-tools.json").zero? }
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/dependabot/nuget/file_parser.rb

@@ -74,7 +74,7 @@ module Dependabot
       end
 
       def project_files
-        projfile = /\.[a-z]{2}proj$/
+        projfile = /\.([a-z]{2})?proj$/
         packageprops = /[Dd]irectory.[Pp]ackages.props/
 
         dependency_files.select do |df|

data/lib/dependabot/nuget/file_updater.rb

@@ -62,7 +62,9 @@ module Dependabot
 
           next unless project_dependencies.any? { |dep| dep.name.casecmp(dependency.name).zero? }
 
-          NativeHelpers.run_nuget_updater_tool(repo_contents_path, proj_path, dependency, !dependency.top_level?)
+          NativeHelpers.run_nuget_updater_tool(repo_root: repo_contents_path, proj_path: proj_path,
+                                               dependency: dependency, is_transitive: !dependency.top_level?,
+                                               credentials: credentials)
           update_ran = true
         end
 
@@ -77,7 +79,9 @@ module Dependabot
           project_file = project_files.first
           proj_path = dependency_file_path(project_file)
 
-          NativeHelpers.run_nuget_updater_tool(repo_contents_path, proj_path, dependency, !dependency.top_level?)
+          NativeHelpers.run_nuget_updater_tool(repo_root: repo_contents_path, proj_path: proj_path,
+                                               dependency: dependency, is_transitive: !dependency.top_level?,
+                                               credentials: credentials)
           return true
         end
 

data/lib/dependabot/nuget/native_helpers.rb

@@ -1,6 +1,8 @@
 # typed: true
 # frozen_string_literal: true
 
+require_relative "nuget_config_credential_helpers"
+
 module Dependabot
   module Nuget
     module NativeHelpers
@@ -46,7 +48,7 @@ module Dependabot
       end
 
       # rubocop:disable Metrics/MethodLength
-      def self.run_nuget_updater_tool(repo_root, proj_path, dependency, is_transitive)
+      def self.run_nuget_updater_tool(repo_root:, proj_path:, dependency:, is_transitive:, credentials:)
         exe_path = File.join(native_helpers_root, "NuGetUpdater", "NuGetUpdater.Cli")
         command = [
           exe_path,
@@ -84,9 +86,10 @@ module Dependabot
 
         puts "running NuGet updater:\n" + command
 
-        output = SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
-
-        puts output
+        NuGetConfigCredentialHelpers.patch_nuget_config_for_action(credentials) do
+          output = SharedHelpers.run_shell_command(command, fingerprint: fingerprint)
+          puts output
+        end
       end
       # rubocop:enable Metrics/MethodLength
     end

data/lib/dependabot/nuget/nuget_client.rb

@@ -0,0 +1,99 @@
+# typed: true
+# frozen_string_literal: true
+
+require "dependabot/nuget/cache_manager"
+require "dependabot/nuget/update_checker/repository_finder"
+
+module Dependabot
+  module Nuget
+    class NugetClient
+      def self.get_package_versions_v3(dependency_name, repository_details)
+        # Use the registration URL if possible because it is fast and correct
+        if repository_details[:registration_url]
+          get_versions_from_registration_v3(repository_details)
+        # use the search API if not because it is slow but correct
+        elsif repository_details[:search_url]
+          get_versions_from_search_url_v3(repository_details, dependency_name)
+        # Otherwise, use the versions URL (fast but wrong because it includes unlisted versions)
+        elsif repository_details[:versions_url]
+          get_versions_from_versions_url_v3(repository_details)
+        end
+      end
+
+      private_class_method def self.get_versions_from_versions_url_v3(repository_details)
+        body = execute_search_for_dependency_url(repository_details[:versions_url], repository_details)
+        body&.fetch("versions")
+      end
+
+      private_class_method def self.get_versions_from_registration_v3(repository_details)
+        url = repository_details[:registration_url]
+        body = execute_search_for_dependency_url(url, repository_details)
+
+        return unless body
+
+        pages = body.fetch("items")
+        versions = Set.new
+        pages.each do |page|
+          items = page["items"]
+          if items
+            # inlined entries
+            items.each do |item|
+              catalog_entry = item["catalogEntry"]
+              if catalog_entry["listed"] == true
+                vers = catalog_entry["version"]
+                versions << vers
+              end
+            end
+          else
+            # paged entries
+            page_url = page["@id"]
+            page_body = execute_search_for_dependency_url(page_url, repository_details)
+            items = page_body.fetch("items")
+            items.each do |item|
+              catalog_entry = item.fetch("catalogEntry")
+              versions << catalog_entry.fetch("version") if catalog_entry["listed"] == true
+            end
+          end
+        end
+
+        versions
+      end
+
+      private_class_method def self.get_versions_from_search_url_v3(repository_details, dependency_name)
+        search_url = repository_details[:search_url]
+        body = execute_search_for_dependency_url(search_url, repository_details)
+
+        body&.fetch("data")
+            &.find { |d| d.fetch("id").casecmp(dependency_name.downcase).zero? }
+            &.fetch("versions")
+            &.map { |d| d.fetch("version") }
+      end
+
+      private_class_method def self.execute_search_for_dependency_url(url, repository_details)
+        cache = CacheManager.cache("dependency_url_search_cache")
+        cache[url] ||= Dependabot::RegistryClient.get(
+          url: url,
+          headers: repository_details[:auth_header]
+        )
+
+        response = cache[url]
+
+        return unless response.status == 200
+
+        body = remove_wrapping_zero_width_chars(response.body)
+        JSON.parse(body)
+      rescue Excon::Error::Timeout, Excon::Error::Socket
+        repo_url = repository_details[:repository_url]
+        raise if repo_url == Dependabot::Nuget::UpdateChecker::RepositoryFinder::DEFAULT_REPOSITORY_URL
+
+        raise PrivateSourceTimedOut, repo_url
+      end
+
+      private_class_method def self.remove_wrapping_zero_width_chars(string)
+        string.force_encoding("UTF-8").encode
+              .gsub(/\A[\u200B-\u200D\uFEFF]/, "")
+              .gsub(/[\u200B-\u200D\uFEFF]\Z/, "")
+      end
+    end
+  end
+end

data/lib/dependabot/nuget/nuget_config_credential_helpers.rb

@@ -0,0 +1,71 @@
+# typed: true
+# frozen_string_literal: true
+
+module Dependabot
+  module Nuget
+    module NuGetConfigCredentialHelpers
+      def self.user_nuget_config_path
+        home_directory = Dir.home
+        File.join(home_directory, ".nuget", "NuGet", "NuGet.Config")
+      end
+
+      def self.temporary_nuget_config_path
+        user_nuget_config_path + "_ORIGINAL"
+      end
+
+      def self.add_credentials_to_nuget_config(credentials)
+        return unless File.exist?(user_nuget_config_path)
+
+        nuget_credentials = credentials.select { |cred| cred["type"] == "nuget_feed" }
+        return if nuget_credentials.empty?
+
+        File.rename(user_nuget_config_path, temporary_nuget_config_path)
+
+        package_sources = []
+        package_source_credentials = []
+        nuget_credentials.each_with_index do |c, i|
+          source_name = "nuget_source_#{i + 1}"
+          package_sources << "    <add key=\"#{source_name}\" value=\"#{c['url']}\" />"
+          next unless c["token"]
+
+          package_source_credentials << "    <#{source_name}>"
+          package_source_credentials << "      <add key=\"Username\" value=\"user\" />"
+          package_source_credentials << "      <add key=\"ClearTextPassword\" value=\"#{c['token']}\" />"
+          package_source_credentials << "    </#{source_name}>"
+        end
+
+        nuget_config = <<~NUGET_XML
+          <?xml version="1.0" encoding="utf-8"?>
+          <configuration>
+            <packageSources>
+          #{package_sources.join("\n")}
+            </packageSources>
+            <packageSourceCredentials>
+          #{package_source_credentials.join("\n")}
+            </packageSourceCredentials>
+          </configuration>
+        NUGET_XML
+        File.write(user_nuget_config_path, nuget_config)
+      end
+
+      def self.restore_user_nuget_config
+        return unless File.exist?(temporary_nuget_config_path)
+
+        File.delete(user_nuget_config_path)
+        File.rename(temporary_nuget_config_path, user_nuget_config_path)
+      end
+
+      # rubocop:disable Lint/SuppressedException
+      def self.patch_nuget_config_for_action(credentials, &_block)
+        add_credentials_to_nuget_config(credentials)
+        begin
+          yield
+        rescue StandardError
+        ensure
+          restore_user_nuget_config
+        end
+      end
+      # rubocop:enable Lint/SuppressedException
+    end
+  end
+end

data/lib/dependabot/nuget/requirement.rb

@@ -22,7 +22,7 @@ module Dependabot
 
         return DefaultRequirement if matches[1] == ">=" && matches[2] == "0"
 
-        [matches[1] || "=", Nuget::Version.new(matches[2])]
+        [matches[1] || "=", Nuget::Version.new(T.must(matches[2]))]
       end
 
       # For consistency with other languages, we define a requirements array.

data/lib/dependabot/nuget/update_checker/compatibility_checker.rb

@@ -1,11 +1,11 @@
 # typed: true
 # frozen_string_literal: true
 
-require "dependabot/nuget/update_checker"
+require "dependabot/update_checkers/base"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
       class CompatibilityChecker
         require_relative "nuspec_fetcher"
         require_relative "nupkg_fetcher"

data/lib/dependabot/nuget/update_checker/dependency_finder.rb

@@ -4,12 +4,12 @@
 require "nokogiri"
 require "zip"
 require "stringio"
-require "dependabot/nuget/update_checker"
+require "dependabot/update_checkers/base"
 require "dependabot/nuget/version"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
       class DependencyFinder
         require_relative "requirements_updater"
         require_relative "nuspec_fetcher"

data/lib/dependabot/nuget/update_checker/nupkg_fetcher.rb

@@ -23,10 +23,7 @@ module Dependabot
         feed_url = repository_details[:repository_url]
         repository_type = repository_details[:repository_type]
 
-        azure_devops_match = try_match_azure_url(feed_url)
-        package_url = if azure_devops_match
-                        get_azure_package_url(azure_devops_match, package_id, package_version)
-                      elsif repository_type == "v2"
+        package_url = if repository_type == "v2"
                         get_nuget_v2_package_url(feed_url, package_id, package_version)
                       elsif repository_type == "v3"
                         get_nuget_v3_package_url(repository_details, package_id, package_version)
@@ -45,31 +42,6 @@ module Dependabot
         fetch_stream(package_url, auth_header)
       end
 
-      def self.try_match_azure_url(feed_url)
-        # if url is azure devops
-        azure_devops_regexs = [
-          %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/(?<project>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json},
-          %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)},
-          %r{https://(?<organization>[^\.\/]+)\.pkgs\.visualstudio\.com/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)}
-        ]
-        regex = azure_devops_regexs.find { |reg| reg.match(feed_url) }
-        return unless regex
-
-        regex.match(feed_url)
-      end
-
-      def self.get_azure_package_url(azure_devops_match, package_id, package_version)
-        organization = azure_devops_match[:organization]
-        project = azure_devops_match[:project]
-        feed_id = azure_devops_match[:feedId]
-
-        if project.empty?
-          "https://pkgs.dev.azure.com/#{organization}/_apis/packaging/feeds/#{feed_id}/nuget/packages/#{package_id}/versions/#{package_version}/content?sourceProtocolVersion=nuget&api-version=7.0-preview"
-        else
-          "https://pkgs.dev.azure.com/#{organization}/#{project}/_apis/packaging/feeds/#{feed_id}/nuget/packages/#{package_id}/versions/#{package_version}/content?sourceProtocolVersion=nuget&api-version=7.0-preview"
-        end
-      end
-
       def self.get_nuget_v3_package_url(repository_details, package_id, package_version)
         base_url = repository_details[:base_url].delete_suffix("/")
         package_id_downcased = package_id.downcase

data/lib/dependabot/nuget/update_checker/property_updater.rb

@@ -1,12 +1,12 @@
 # typed: true
 # frozen_string_literal: true
 
+require "dependabot/update_checkers/base"
 require "dependabot/nuget/file_parser"
-require "dependabot/nuget/update_checker"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
       class PropertyUpdater
         require_relative "version_finder"
         require_relative "requirements_updater"

data/lib/dependabot/nuget/update_checker/repository_finder.rb

@@ -4,12 +4,13 @@
 require "excon"
 require "nokogiri"
 require "dependabot/errors"
-require "dependabot/nuget/update_checker"
+require "dependabot/update_checkers/base"
 require "dependabot/registry_client"
+require "dependabot/nuget/cache_manager"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
       class RepositoryFinder
         DEFAULT_REPOSITORY_URL = "https://api.nuget.org/v3/index.json"
         DEFAULT_REPOSITORY_API_KEY = "nuget.org"
@@ -27,6 +28,7 @@ module Dependabot
         def self.get_default_repository_details(dependency_name)
           {
             base_url: "https://api.nuget.org/v3-flatcontainer/",
+            registration_url: "https://api.nuget.org/v3/registration5-gz-semver2/#{dependency_name.downcase}/index.json",
             repository_url: DEFAULT_REPOSITORY_URL,
             versions_url: "https://api.nuget.org/v3-flatcontainer/" \
                           "#{dependency_name.downcase}/index.json",
@@ -60,9 +62,11 @@ module Dependabot
           return unless response.status == 200
 
           body = remove_wrapping_zero_width_chars(response.body)
-          base_url = base_url_from_v3_metadata(JSON.parse(body))
+          parsed_json = JSON.parse(body)
+          base_url = base_url_from_v3_metadata(parsed_json)
           resolved_base_url = base_url || repo_details.fetch(:url).gsub("/index.json", "-flatcontainer")
-          search_url = search_url_from_v3_metadata(JSON.parse(body))
+          search_url = search_url_from_v3_metadata(parsed_json)
+          registration_url = registration_url_from_v3_metadata(parsed_json)
 
           details = {
             base_url: resolved_base_url,
@@ -78,6 +82,11 @@ module Dependabot
             details[:search_url] =
               search_url + "?q=#{dependency.name.downcase}&prerelease=true&semVerLevel=2.0.0"
           end
+
+          if registration_url
+            details[:registration_url] = File.join(registration_url, dependency.name.downcase, "index.json")
+          end
+
           details
         rescue JSON::ParserError
           build_v2_url(response, repo_details)
@@ -86,10 +95,18 @@ module Dependabot
         end
 
         def get_repo_metadata(repo_details)
-          Dependabot::RegistryClient.get(
-            url: repo_details.fetch(:url),
-            headers: auth_header_for_token(repo_details.fetch(:token))
-          )
+          url = repo_details.fetch(:url)
+          cache = CacheManager.cache("repo_finder_metadatacache")
+          if cache[url]
+            cache[url]
+          else
+            result = Dependabot::RegistryClient.get(
+              url: url,
+              headers: auth_header_for_token(repo_details.fetch(:token))
+            )
+            cache[url] = result
+            result
+          end
         end
 
         def base_url_from_v3_metadata(metadata)
@@ -99,6 +116,20 @@ module Dependabot
             &.fetch("@id")
         end
 
+        def registration_url_from_v3_metadata(metadata)
+          allowed_registration_types = %w(
+            RegistrationsBaseUrl
+            RegistrationsBaseUrl/3.0.0-beta
+            RegistrationsBaseUrl/3.0.0-rc
+            RegistrationsBaseUrl/3.4.0
+            RegistrationsBaseUrl/3.6.0
+          )
+          metadata
+            .fetch("resources", [])
+            .find { |r| allowed_registration_types.find { |s| r.fetch("@type") == s } }
+            &.fetch("@id")
+        end
+
         def search_url_from_v3_metadata(metadata)
           # allowable values from here: https://learn.microsoft.com/en-us/nuget/api/search-query-service-resource#versioning
           allowed_search_types = %w(

data/lib/dependabot/nuget/update_checker/requirements_updater.rb

@@ -6,12 +6,12 @@
 # https://docs.microsoft.com/en-us/nuget/reference/package-versioning #
 #######################################################################
 
-require "dependabot/nuget/update_checker"
+require "dependabot/update_checkers/base"
 require "dependabot/nuget/version"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
       class RequirementsUpdater
         def initialize(requirements:, latest_version:, source_details:)
           @requirements = requirements

data/lib/dependabot/nuget/update_checker/tfm_comparer.rb

@@ -1,15 +1,15 @@
 # typed: true
 # frozen_string_literal: true
 
+require "dependabot/update_checkers/base"
 require "dependabot/nuget/version"
 require "dependabot/nuget/requirement"
 require "dependabot/nuget/native_helpers"
-require "dependabot/nuget/update_checker"
 require "dependabot/shared_helpers"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
       class TfmComparer
         def self.are_frameworks_compatible?(project_tfms, package_tfms)
           return false if package_tfms.empty?

data/lib/dependabot/nuget/update_checker/tfm_finder.rb

@@ -4,15 +4,15 @@
 require "excon"
 require "nokogiri"
 
+require "dependabot/update_checkers/base"
 require "dependabot/nuget/version"
 require "dependabot/nuget/requirement"
 require "dependabot/nuget/native_helpers"
-require "dependabot/nuget/update_checker"
 require "dependabot/shared_helpers"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
       class TfmFinder
         require "dependabot/nuget/file_parser/packages_config_parser"
         require "dependabot/nuget/file_parser/project_file_parser"

data/lib/dependabot/nuget/update_checker/version_finder.rb

@@ -3,12 +3,13 @@
 
 require "dependabot/nuget/version"
 require "dependabot/nuget/requirement"
+require "dependabot/update_checkers/base"
 require "dependabot/update_checkers/version_filters"
-require "dependabot/nuget/update_checker"
+require "dependabot/nuget/nuget_client"
 
 module Dependabot
   module Nuget
-    class UpdateChecker
+    class UpdateChecker < Dependabot::UpdateCheckers::Base
       class VersionFinder
         require_relative "compatibility_checker"
         require_relative "repository_finder"
@@ -294,40 +295,7 @@ module Dependabot
         end
 
         def versions_for_v3_repository(repository_details)
-          # If we have a search URL that returns results we use it
-          # (since it will exclude unlisted versions)
-          if repository_details[:search_url]
-            fetch_versions_from_search_url(repository_details)
-          # Otherwise, use the versions URL
-          elsif repository_details[:versions_url]
-            response = Dependabot::RegistryClient.get(
-              url: repository_details[:versions_url],
-              headers: repository_details[:auth_header]
-            )
-            return unless response.status == 200
-
-            body = remove_wrapping_zero_width_chars(response.body)
-            JSON.parse(body).fetch("versions")
-          end
-        end
-
-        def fetch_versions_from_search_url(repository_details)
-          response = Dependabot::RegistryClient.get(
-            url: repository_details[:search_url],
-            headers: repository_details[:auth_header]
-          )
-          return unless response.status == 200
-
-          body = remove_wrapping_zero_width_chars(response.body)
-          JSON.parse(body).fetch("data")
-              .find { |d| d.fetch("id").casecmp(sanitized_name).zero? }
-              &.fetch("versions")
-              &.map { |d| d.fetch("version") }
-        rescue Excon::Error::Timeout, Excon::Error::Socket
-          repo_url = repository_details[:repository_url]
-          raise if repo_url == RepositoryFinder::DEFAULT_REPOSITORY_URL
-
-          raise PrivateSourceTimedOut, repo_url
+          NugetClient.get_package_versions_v3(dependency.name, repository_details)
         end
 
         def dependency_urls
@@ -356,12 +324,6 @@ module Dependabot
           dependency.requirement_class
         end
 
-        def remove_wrapping_zero_width_chars(string)
-          string.force_encoding("UTF-8").encode
-                .gsub(/\A[\u200B-\u200D\uFEFF]/, "")
-                .gsub(/[\u200B-\u200D\uFEFF]\Z/, "")
-        end
-
         def excon_options
           # For large JSON files we sometimes need a little longer than for
           # other languages. For example, see:

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.239.0
+  version: 0.240.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-12-28 00:00:00.000000000 Z
+date: 2024-01-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.239.0
+        version: 0.240.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.239.0
+        version: 0.240.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -226,6 +226,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.18'
+- !ruby/object:Gem::Dependency
+  name: webrick
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.7'
 description: Dependabot-Nuget provides support for bumping .NET (NuGet) packages via
   Dependabot. If you want support for multiple package managers, you probably want
   the meta-gem dependabot-omnibus.
@@ -249,6 +263,8 @@ files:
 - lib/dependabot/nuget/file_updater/property_value_updater.rb
 - lib/dependabot/nuget/metadata_finder.rb
 - lib/dependabot/nuget/native_helpers.rb
+- lib/dependabot/nuget/nuget_client.rb
+- lib/dependabot/nuget/nuget_config_credential_helpers.rb
 - lib/dependabot/nuget/requirement.rb
 - lib/dependabot/nuget/update_checker.rb
 - lib/dependabot/nuget/update_checker/compatibility_checker.rb
@@ -267,7 +283,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.239.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.240.0
 post_install_message: 
 rdoc_options: []
 require_paths: