dependabot-nuget 0.242.0 → 0.242.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 11b0607da6a75d27dbe0c012d5b3917a226fd3da340cbcc59bf70dc1ab49dea3
-  data.tar.gz: f757ea68e946791be5d44df566a91dff248f98c60be84253a25d399c24b881bd
+  metadata.gz: 1a49c3bda283658e65f9a37cf33e5b4855048bf2673bcfdcde4bb2e39d00d68e
+  data.tar.gz: 340fb04884786613bcbf75e25f7b51be9e662d26211418804965162df2c95c2a
 SHA512:
-  metadata.gz: cce478626cb19d1d3daec2b23b2448445ddbf02fde1ffa80cd1372600852cb9e7c5fc2026303f9dfb8de3938870db16a2b531c04b160ede96c7c473bb673b3e3
-  data.tar.gz: 9f084e5dfc866baa1b38cb01d2a55a9c6738b1e06703961fb33676353e4fda8095c36a951bb0a3515c503fe351582089b93d0faeac709e3e3e4f3706b158ec09
+  metadata.gz: 55e5a6b6949b5d30cfd95fb8ac185e9ccad548e0f8cc073237181c8a99e76252602920f6ff4cce68afb8310b4e358a7191ff4c9fe1ef27e92147529eb6c0012a
+  data.tar.gz: ea153c1649add8848551c6a54577beb7fa554f557275d1ed09928d741bc5ded5a1bfe7ed39561592bda152d8ded72f4081d30da3fcd748500f5d887825c27eb9

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -263,7 +263,7 @@ internal static partial class MSBuildHelper
         try
         {
             var tempProjectPath = await CreateTempProjectAsync(tempDirectory, repoRoot, projectPath, targetFramework, packages);
-            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"build \"{tempProjectPath}\"");
+            var (exitCode, stdOut, stdErr) = await ProcessEx.RunAsync("dotnet", $"restore \"{tempProjectPath}\"");
 
             // NU1608: Detected package version outside of dependency constraint
 
@@ -308,6 +308,7 @@ internal static partial class MSBuildHelper
                   <PropertyGroup>
                     <TargetFramework>{targetFramework}</TargetFramework>
                     <GenerateDependencyFile>true</GenerateDependencyFile>
+                    <RunAnalyzers>false</RunAnalyzers>
                   </PropertyGroup>
                   <ItemGroup>
                     {packageReferences}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/SdkPackageUpdaterTests.cs

@@ -187,6 +187,69 @@ public class SdkPackageUpdaterTests
             "Newtonsoft.Json", "12.0.1", "13.0.1", false // isTransitive
         };
 
+        // Make sure we don't update if there are incoherent versions
+        yield return new object[] {
+            new []
+            {
+                (Path: "src/Project.csproj", Content: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                        <PropertyGroup>
+                            <TargetFramework>netcoreapp2.1</TargetFramework>
+                        </PropertyGroup>
+                        <ItemGroup>
+                            <PackageReference Include="Microsoft.Extensions.Primitives" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Options" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Logging" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Configuration" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Caching.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore.Analyzers" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.AspNetCore.App" Version="2.1.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="2.1.0" />
+                        </ItemGroup>
+                    </Project>
+                    """)
+            }, // starting contents
+            new []
+            {
+                (Path: "src/Project.csproj", Content: """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                        <PropertyGroup>
+                            <TargetFramework>netcoreapp2.1</TargetFramework>
+                        </PropertyGroup>
+                        <ItemGroup>
+                            <PackageReference Include="Microsoft.Extensions.Primitives" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Options" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Logging" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Configuration" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.Extensions.Caching.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore.Analyzers" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore.Abstractions" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore" Version="2.2.0" />
+                            <PackageReference Include="Microsoft.AspNetCore.App" Version="2.1.0" />
+                            <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="2.1.0" />
+                        </ItemGroup>
+                    </Project>
+                    """)
+            }, // expected contents
+            "Microsoft.EntityFrameworkCore.SqlServer", "2.1.0", "2.2.0", false // isTransitive
+        };
+
         // PackageReference with Version as child element
         yield return new object[]
         {

data/lib/dependabot/nuget/file_fetcher.rb

@@ -72,7 +72,9 @@ module Dependabot
             project_files += fsproj_file
             project_files += sln_project_files
             project_files += proj_files
-            project_files += project_files.filter_map { |f| directory_packages_props_file_from_project_file(f) }
+            project_files += project_files.filter_map do |f|
+              named_file_up_tree_from_project_file(f, "Directory.Packages.props")
+            end
             project_files
           end
       rescue Octokit::NotFound, Gitlab::Error::NotFound
@@ -191,28 +193,6 @@ module Dependabot
         @proj_files ||= find_and_fetch_with_suffix(".proj")
       end
 
-      def directory_packages_props_file_from_project_file(project_file)
-        # walk up the tree from each project file stopping at the first `Directory.Packages.props` file found
-        # https://learn.microsoft.com/en-us/nuget/consume-packages/central-package-management#central-package-management-rules
-
-        found_directory_packages_props_file = nil
-        directory_path = Pathname.new(directory)
-        full_project_dir = Pathname.new(project_file.directory).join(project_file.name).dirname
-        full_project_dir.ascend.each do |base|
-          break if found_directory_packages_props_file
-
-          candidate_file_path = Pathname.new(base).join("Directory.Packages.props").cleanpath.to_path
-          candidate_directory = Pathname.new(File.dirname(candidate_file_path))
-          relative_candidate_directory = candidate_directory.relative_path_from(directory_path)
-          candidate_file = repo_contents(dir: relative_candidate_directory).find do |f|
-            f.name.casecmp?("Directory.Packages.props")
-          end
-          found_directory_packages_props_file = fetch_file_from_host(candidate_file.name) if candidate_file
-        end
-
-        found_directory_packages_props_file
-      end
-
       def find_and_fetch_with_suffix(suffix)
         repo_contents.select { |f| f.name.end_with?(suffix) }.map { |f| fetch_file_from_host(f.name) }
       end

data/lib/dependabot/nuget/file_parser/project_file_parser.rb

@@ -293,47 +293,8 @@ module Dependabot
         end
 
         def dependency_url_has_matching_result?(dependency_name, dependency_url)
-          repository_type = dependency_url.fetch(:repository_type)
-          if repository_type == "v3"
-            dependency_url_has_matching_result_v3?(dependency_name, dependency_url)
-          elsif repository_type == "v2"
-            dependency_url_has_matching_result_v2?(dependency_name, dependency_url)
-          else
-            raise "Unknown repository type: #{repository_type}"
-          end
-        end
-
-        def dependency_url_has_matching_result_v3?(dependency_name, dependency_url)
-          versions = NugetClient.get_package_versions_v3(dependency_name, dependency_url)
-
-          versions != nil
-        end
-
-        def dependency_url_has_matching_result_v2?(dependency_name, dependency_url)
-          url = dependency_url.fetch(:versions_url)
-          auth_header = dependency_url.fetch(:auth_header)
-          response = execute_search_for_dependency_url(url, auth_header)
-          return false unless response.status == 200
-
-          doc = Nokogiri::XML(response.body)
-          doc.remove_namespaces!
-          id_nodes = doc.xpath("/feed/entry/properties/Id")
-          found_matching_result = id_nodes.any? do |id_node|
-            return false unless id_node.text
-
-            id_node.text.casecmp?(dependency_name)
-          end
-          found_matching_result
-        end
-
-        def execute_search_for_dependency_url(url, auth_header)
-          cache = ProjectFileParser.dependency_url_search_cache
-          cache[url] ||= Dependabot::RegistryClient.get(
-            url: url,
-            headers: auth_header
-          )
-
-          cache[url]
+          versions = NugetClient.get_package_versions(dependency_name, dependency_url)
+          versions&.any?
         end
 
         def dependency_name(dependency_node, project_file)

data/lib/dependabot/nuget/file_parser.rb

@@ -1,4 +1,4 @@
-# typed: false
+# typed: true
 # frozen_string_literal: true
 
 require "nokogiri"
@@ -85,7 +85,7 @@ module Dependabot
 
       def packages_config_files
         dependency_files.select do |f|
-          f.name.split("/").last.casecmp("packages.config").zero?
+          f.name.split("/").last&.casecmp("packages.config")&.zero?
         end
       end
 
@@ -103,11 +103,11 @@ module Dependabot
       end
 
       def global_json
-        dependency_files.find { |f| f.name.casecmp("global.json").zero? }
+        dependency_files.find { |f| f.name.casecmp("global.json")&.zero? }
       end
 
       def dotnet_tools_json
-        dependency_files.find { |f| f.name.casecmp(".config/dotnet-tools.json").zero? }
+        dependency_files.find { |f| f.name.casecmp(".config/dotnet-tools.json")&.zero? }
       end
 
       def check_required_files

data/lib/dependabot/nuget/nuget_client.rb

@@ -7,7 +7,18 @@ require "dependabot/nuget/update_checker/repository_finder"
 module Dependabot
   module Nuget
     class NugetClient
-      def self.get_package_versions_v3(dependency_name, repository_details)
+      def self.get_package_versions(dependency_name, repository_details)
+        repository_type = repository_details.fetch(:repository_type)
+        if repository_type == "v3"
+          get_package_versions_v3(dependency_name, repository_details)
+        elsif repository_type == "v2"
+          get_package_versions_v2(dependency_name, repository_details)
+        else
+          raise "Unknown repository type: #{repository_type}"
+        end
+      end
+
+      private_class_method def self.get_package_versions_v3(dependency_name, repository_details)
         # Use the registration URL if possible because it is fast and correct
         if repository_details[:registration_url]
           get_versions_from_registration_v3(repository_details)
@@ -20,14 +31,32 @@ module Dependabot
         end
       end
 
+      private_class_method def self.get_package_versions_v2(dependency_name, repository_details)
+        doc = execute_xml_nuget_request(repository_details.fetch(:versions_url), repository_details)
+        return unless doc
+
+        id_nodes = doc.xpath("/feed/entry/properties/Id")
+        matching_versions = Set.new
+        id_nodes.each do |id_node|
+          return nil unless id_node.text
+
+          next unless id_node.text.casecmp?(dependency_name)
+
+          version_node = id_node.parent.xpath("Version")
+          matching_versions << version_node.text if version_node && version_node.text
+        end
+
+        matching_versions
+      end
+
       private_class_method def self.get_versions_from_versions_url_v3(repository_details)
-        body = execute_search_for_dependency_url(repository_details[:versions_url], repository_details)
+        body = execute_json_nuget_request(repository_details[:versions_url], repository_details)
         body&.fetch("versions")
       end
 
       private_class_method def self.get_versions_from_registration_v3(repository_details)
         url = repository_details[:registration_url]
-        body = execute_search_for_dependency_url(url, repository_details)
+        body = execute_json_nuget_request(url, repository_details)
 
         return unless body
 
@@ -47,7 +76,7 @@ module Dependabot
           else
             # paged entries
             page_url = page["@id"]
-            page_body = execute_search_for_dependency_url(page_url, repository_details)
+            page_body = execute_json_nuget_request(page_url, repository_details)
             items = page_body.fetch("items")
             items.each do |item|
               catalog_entry = item.fetch("catalogEntry")
@@ -61,7 +90,7 @@ module Dependabot
 
       private_class_method def self.get_versions_from_search_url_v3(repository_details, dependency_name)
         search_url = repository_details[:search_url]
-        body = execute_search_for_dependency_url(search_url, repository_details)
+        body = execute_json_nuget_request(search_url, repository_details)
 
         body&.fetch("data")
             &.find { |d| d.fetch("id").casecmp(dependency_name.downcase).zero? }
@@ -69,21 +98,55 @@ module Dependabot
             &.map { |d| d.fetch("version") }
       end
 
-      private_class_method def self.execute_search_for_dependency_url(url, repository_details)
-        cache = CacheManager.cache("dependency_url_search_cache")
-        cache[url] ||= Dependabot::RegistryClient.get(
+      private_class_method def self.execute_xml_nuget_request(url, repository_details)
+        response = execute_nuget_request_internal(
           url: url,
-          headers: repository_details[:auth_header]
+          auth_header: repository_details[:auth_header],
+          repository_url: repository_details[:repository_url]
         )
+        return unless response.status == 200
 
-        response = cache[url]
+        doc = Nokogiri::XML(response.body)
+        doc.remove_namespaces!
+        doc
+      end
 
+      private_class_method def self.execute_json_nuget_request(url, repository_details)
+        response = execute_nuget_request_internal(
+          url: url,
+          auth_header: repository_details[:auth_header],
+          repository_url: repository_details[:repository_url]
+        )
         return unless response.status == 200
 
         body = remove_wrapping_zero_width_chars(response.body)
         JSON.parse(body)
+      end
+
+      private_class_method def self.execute_nuget_request_internal(
+        url: String,
+        auth_header: String,
+        repository_url: String
+      )
+        cache = CacheManager.cache("dependency_url_search_cache")
+        if cache[url].nil?
+          response = Dependabot::RegistryClient.get(
+            url: url,
+            headers: auth_header
+          )
+
+          if [401, 402, 403].include?(response.status)
+            raise Dependabot::PrivateSourceAuthenticationFailure, repository_url
+          end
+
+          cache[url] = response if !CacheManager.caching_disabled? && response.status == 200
+        else
+          response = cache[url]
+        end
+
+        response
       rescue Excon::Error::Timeout, Excon::Error::Socket
-        repo_url = repository_details[:repository_url]
+        repo_url = repository_url
         raise if repo_url == Dependabot::Nuget::UpdateChecker::RepositoryFinder::DEFAULT_REPOSITORY_URL
 
         raise PrivateSourceTimedOut, repo_url

data/lib/dependabot/nuget/update_checker/version_finder.rb

@@ -235,7 +235,7 @@ module Dependabot
             dependency_urls
             .select { |details| details.fetch(:repository_type) == "v3" }
             .filter_map do |url_details|
-              versions = versions_for_v3_repository(url_details)
+              versions = NugetClient.get_package_versions(dependency.name, url_details)
               next unless versions
 
               { "versions" => versions, "listing_details" => url_details }
@@ -294,10 +294,6 @@ module Dependabot
           nil
         end
 
-        def versions_for_v3_repository(repository_details)
-          NugetClient.get_package_versions_v3(dependency.name, repository_details)
-        end
-
         def dependency_urls
           @dependency_urls ||=
             RepositoryFinder.new(

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.242.0
+  version: 0.242.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-01-22 00:00:00.000000000 Z
+date: 2024-01-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.242.0
+        version: 0.242.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.242.0
+        version: 0.242.1
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -369,7 +369,7 @@ licenses:
 - Nonstandard
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.242.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.242.1
 post_install_message: 
 rdoc_options: []
 require_paths: