dependabot-nuget 0.294.0 → 0.295.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97e76c69b2fed1672ebe1e9b3b890e8f445139f26729895c72a196d49cd43d63
-  data.tar.gz: 10ef8cb4d30c84e9e8f51fdc5bf4f529b451936ad8a34e905e69fbaa0b813cac
+  metadata.gz: 8ac3a95f5211adff79f8e7954308a4d3656b63c8be20b70a7b6f129f04402881
+  data.tar.gz: a79771c0cc6c0a08bfaa2a7cef8253902c7e8b92b868568c231064098ba77a1c
 SHA512:
-  metadata.gz: 73cdefd4ef762621a7142a040a747011ee4a390635379ee311deccaf6664062834a8e809b6203816e81f8ebb24ed10f68d04975e9bcde40e5ffd2d3720779c68
-  data.tar.gz: a8cde74fdb1b400ced101cac7132bb32c8dc6b3d36ff6c249908e33e9e8c719e63999c02982ba2bf7704b18007be0daac14dcdd6c39ba74c4a8c38ccad2ae11e
+  metadata.gz: 800097bc4856927e983da508d16b4e6d0fd75cf40b5ca5ed25901fbb467f0f99e8f8dc724341c0da6cc6126303c6437a5bd8c7521132c3363ed752181402ee1b
+  data.tar.gz: c0a1675e7cdf06ec0314d58092de09d633fa46892ae8f01c20ec74553d756265fda431434babb6eb140184b3380b78576f6309c1ec010f41e0e09e6ad6b28adb

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DiscoveryWorker.cs

@@ -262,7 +262,8 @@ public partial class DiscoveryWorker : IDiscoveryWorker
             }
         }
 
-        return expandedProjects.ToImmutableArray();
+        var result = expandedProjects.OrderBy(p => p).ToImmutableArray();
+        return result;
     }
 
     private static IEnumerable<string> ExpandItemGroupFilesFromProject(string projectPath, params string[] itemTypes)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -114,7 +114,7 @@ internal static class SdkProjectDiscovery
                     var (exitCode, stdOut, stdErr) = await ProcessEx.RunDotnetWithoutMSBuildEnvironmentVariablesAsync(args, startingProjectDirectory, experimentsManager);
                     return (exitCode, stdOut, stdErr);
                 }, logger, retainMSBuildSdks: true);
-                MSBuildHelper.ThrowOnUnauthenticatedFeed(stdOut);
+                MSBuildHelper.ThrowOnError(stdOut);
                 if (stdOut.Contains("""error MSB4057: The target "GenerateBuildDependencyFile" does not exist in the project."""))
                 {
                     // this can happen if it's a non-SDK-style project; totally normal, not worth examining the binlog

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -4,6 +4,8 @@ using System.Text;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 
+using Microsoft.Extensions.FileSystemGlobbing;
+
 using NuGet.Versioning;
 
 using NuGetUpdater.Core.Analyze;
@@ -115,161 +117,145 @@ public class RunWorker
         await _apiHandler.UpdateDependencyList(discoveredUpdatedDependencies);
 
         // TODO: pull out relevant dependencies, then check each for updates and track the changes
-        // TODO: for each top-level dependency, _or_ specific dependency (if security, use transitive)
         var originalDependencyFileContents = new Dictionary<string, string>();
         var actualUpdatedDependencies = new List<ReportedDependency>();
-        if (job.AllowedUpdates.Any(a => a.UpdateType == UpdateType.All))
+        await _apiHandler.IncrementMetric(new()
         {
-            await _apiHandler.IncrementMetric(new()
-            {
-                Metric = "updater.started",
-                Tags = { ["operation"] = "group_update_all_versions" },
-            });
+            Metric = "updater.started",
+            Tags = { ["operation"] = "group_update_all_versions" },
+        });
+
+        // track original contents for later handling
+        async Task TrackOriginalContentsAsync(string directory, string fileName)
+        {
+            var repoFullPath = Path.Join(directory, fileName).FullyNormalizedRootedPath();
+            var localFullPath = Path.Join(repoContentsPath.FullName, repoFullPath);
+            var content = await File.ReadAllTextAsync(localFullPath);
+            originalDependencyFileContents[repoFullPath] = content;
+        }
 
-            // track original contents for later handling
-            async Task TrackOriginalContentsAsync(string directory, string fileName)
+        foreach (var project in discoveryResult.Projects)
+        {
+            var projectDirectory = Path.GetDirectoryName(project.FilePath);
+            await TrackOriginalContentsAsync(discoveryResult.Path, project.FilePath);
+            foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
             {
-                var repoFullPath = Path.Join(directory, fileName).FullyNormalizedRootedPath();
-                var localFullPath = Path.Join(repoContentsPath.FullName, repoFullPath);
-                var content = await File.ReadAllTextAsync(localFullPath);
-                originalDependencyFileContents[repoFullPath] = content;
+                var extraFilePath = Path.Join(projectDirectory, extraFile);
+                await TrackOriginalContentsAsync(discoveryResult.Path, extraFilePath);
             }
+            // TODO: include global.json, etc.
+        }
 
-            foreach (var project in discoveryResult.Projects)
+        // do update
+        _logger.Info($"Running update in directory {repoDirectory}");
+        foreach (var project in discoveryResult.Projects)
+        {
+            foreach (var dependency in project.Dependencies)
             {
-                var projectDirectory = Path.GetDirectoryName(project.FilePath);
-                await TrackOriginalContentsAsync(discoveryResult.Path, project.FilePath);
-                foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
+                if (!IsUpdateAllowed(job, dependency))
                 {
-                    var extraFilePath = Path.Join(projectDirectory, extraFile);
-                    await TrackOriginalContentsAsync(discoveryResult.Path, extraFilePath);
+                    continue;
                 }
-                // TODO: include global.json, etc.
-            }
 
-            // do update
-            _logger.Info($"Running update in directory {repoDirectory}");
-            foreach (var project in discoveryResult.Projects)
-            {
-                foreach (var dependency in project.Dependencies.Where(d => !d.IsTransitive))
+                var dependencyInfo = GetDependencyInfo(job, dependency);
+                var analysisResult = await _analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
+                // TODO: log analysisResult
+                if (analysisResult.CanUpdate)
                 {
-                    if (dependency.Name == "Microsoft.NET.Sdk")
-                    {
-                        // this can't be updated
-                        // TODO: pull this out of discovery?
-                        continue;
-                    }
-
-                    if (dependency.Version is null)
-                    {
-                        // if we don't know the version, there's nothing we can do
-                        continue;
-                    }
+                    var dependencyLocation = Path.Join(discoveryResult.Path, project.FilePath).FullyNormalizedRootedPath();
 
-                    var dependencyInfo = GetDependencyInfo(job, dependency);
-                    var analysisResult = await _analyzeWorker.RunAsync(repoContentsPath.FullName, discoveryResult, dependencyInfo);
-                    // TODO: log analysisResult
-                    if (analysisResult.CanUpdate)
+                    // TODO: this is inefficient, but not likely causing a bottleneck
+                    var previousDependency = discoveredUpdatedDependencies.Dependencies
+                        .Single(d => d.Name == dependency.Name && d.Requirements.Single().File == dependencyLocation);
+                    var updatedDependency = new ReportedDependency()
                     {
-                        var dependencyLocation = Path.Join(discoveryResult.Path, project.FilePath).FullyNormalizedRootedPath();
-
-                        // TODO: this is inefficient, but not likely causing a bottleneck
-                        var previousDependency = discoveredUpdatedDependencies.Dependencies
-                            .Single(d => d.Name == dependency.Name && d.Requirements.Single().File == dependencyLocation);
-                        var updatedDependency = new ReportedDependency()
-                        {
-                            Name = dependency.Name,
-                            Version = analysisResult.UpdatedVersion,
-                            Requirements =
-                            [
-                                new ReportedRequirement()
-                                {
-                                    File = dependencyLocation,
-                                    Requirement = analysisResult.UpdatedVersion,
-                                    Groups = previousDependency.Requirements.Single().Groups,
-                                    Source = new RequirementSource()
-                                    {
-                                        SourceUrl = analysisResult.UpdatedDependencies.FirstOrDefault(d => d.Name == dependency.Name)?.InfoUrl,
-                                    },
-                                }
-                            ],
-                            PreviousVersion = dependency.Version,
-                            PreviousRequirements = previousDependency.Requirements,
-                        };
-
-                        var dependencyFilePath = Path.Join(discoveryResult.Path, project.FilePath).FullyNormalizedRootedPath();
-                        var updateResult = await _updaterWorker.RunAsync(repoContentsPath.FullName, dependencyFilePath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, isTransitive: false);
-                        // TODO: need to report if anything was actually updated
-                        if (updateResult.Error is null)
-                        {
-                            if (dependencyLocation != dependencyFilePath)
+                        Name = dependency.Name,
+                        Version = analysisResult.UpdatedVersion,
+                        Requirements =
+                        [
+                            new ReportedRequirement()
                             {
-                                updatedDependency.Requirements.All(r => r.File == dependencyFilePath);
+                                File = dependencyLocation,
+                                Requirement = analysisResult.UpdatedVersion,
+                                Groups = previousDependency.Requirements.Single().Groups,
+                                Source = new RequirementSource()
+                                {
+                                    SourceUrl = analysisResult.UpdatedDependencies.FirstOrDefault(d => d.Name == dependency.Name)?.InfoUrl,
+                                },
                             }
+                        ],
+                        PreviousVersion = dependency.Version,
+                        PreviousRequirements = previousDependency.Requirements,
+                    };
 
-                            actualUpdatedDependencies.Add(updatedDependency);
+                    var dependencyFilePath = Path.Join(discoveryResult.Path, project.FilePath).FullyNormalizedRootedPath();
+                    var updateResult = await _updaterWorker.RunAsync(repoContentsPath.FullName, dependencyFilePath, dependency.Name, dependency.Version!, analysisResult.UpdatedVersion, isTransitive: dependency.IsTransitive);
+                    // TODO: need to report if anything was actually updated
+                    if (updateResult.Error is null)
+                    {
+                        if (dependencyLocation != dependencyFilePath)
+                        {
+                            updatedDependency.Requirements.All(r => r.File == dependencyFilePath);
                         }
+
+                        actualUpdatedDependencies.Add(updatedDependency);
                     }
                 }
             }
+        }
 
-            // create PR - we need to manually check file contents; we can't easily use `git status` in tests
-            var updatedDependencyFiles = new Dictionary<string, DependencyFile>();
-            async Task AddUpdatedFileIfDifferentAsync(string directory, string fileName)
+        // create PR - we need to manually check file contents; we can't easily use `git status` in tests
+        var updatedDependencyFiles = new Dictionary<string, DependencyFile>();
+        async Task AddUpdatedFileIfDifferentAsync(string directory, string fileName)
+        {
+            var repoFullPath = Path.Join(directory, fileName).FullyNormalizedRootedPath();
+            var localFullPath = Path.GetFullPath(Path.Join(repoContentsPath.FullName, repoFullPath));
+            var originalContent = originalDependencyFileContents[repoFullPath];
+            var updatedContent = await File.ReadAllTextAsync(localFullPath);
+            if (updatedContent != originalContent)
             {
-                var repoFullPath = Path.Join(directory, fileName).FullyNormalizedRootedPath();
-                var localFullPath = Path.GetFullPath(Path.Join(repoContentsPath.FullName, repoFullPath));
-                var originalContent = originalDependencyFileContents[repoFullPath];
-                var updatedContent = await File.ReadAllTextAsync(localFullPath);
-                if (updatedContent != originalContent)
+                updatedDependencyFiles[localFullPath] = new DependencyFile()
                 {
-                    updatedDependencyFiles[localFullPath] = new DependencyFile()
-                    {
-                        Name = Path.GetFileName(repoFullPath),
-                        Directory = Path.GetDirectoryName(repoFullPath)!.NormalizePathToUnix(),
-                        Content = updatedContent,
-                    };
-                }
+                    Name = Path.GetFileName(repoFullPath),
+                    Directory = Path.GetDirectoryName(repoFullPath)!.NormalizePathToUnix(),
+                    Content = updatedContent,
+                };
             }
+        }
 
-            foreach (var project in discoveryResult.Projects)
+        foreach (var project in discoveryResult.Projects)
+        {
+            await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, project.FilePath);
+            var projectDirectory = Path.GetDirectoryName(project.FilePath);
+            foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
             {
-                await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, project.FilePath);
-                var projectDirectory = Path.GetDirectoryName(project.FilePath);
-                foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
-                {
-                    var extraFilePath = Path.Join(projectDirectory, extraFile);
-                    await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, extraFilePath);
-                }
-                // TODO: handle global.json, etc.
+                var extraFilePath = Path.Join(projectDirectory, extraFile);
+                await AddUpdatedFileIfDifferentAsync(discoveryResult.Path, extraFilePath);
             }
+            // TODO: handle global.json, etc.
+        }
 
-            if (updatedDependencyFiles.Count > 0)
-            {
-                var updatedDependencyFileList = updatedDependencyFiles
-                    .OrderBy(kvp => kvp.Key)
-                    .Select(kvp => kvp.Value)
-                    .ToArray();
-                var createPullRequest = new CreatePullRequest()
-                {
-                    Dependencies = actualUpdatedDependencies.ToArray(),
-                    UpdatedDependencyFiles = updatedDependencyFileList,
-                    BaseCommitSha = baseCommitSha,
-                    CommitMessage = "TODO: message",
-                    PrTitle = "TODO: title",
-                    PrBody = "TODO: body",
-                };
-                await _apiHandler.CreatePullRequest(createPullRequest);
-                // TODO: log updated dependencies to console
-            }
-            else
+        if (updatedDependencyFiles.Count > 0)
+        {
+            var updatedDependencyFileList = updatedDependencyFiles
+                .OrderBy(kvp => kvp.Key)
+                .Select(kvp => kvp.Value)
+                .ToArray();
+            var createPullRequest = new CreatePullRequest()
             {
-                // TODO: log or throw if nothing was updated, but was expected to be
-            }
+                Dependencies = actualUpdatedDependencies.ToArray(),
+                UpdatedDependencyFiles = updatedDependencyFileList,
+                BaseCommitSha = baseCommitSha,
+                CommitMessage = "TODO: message",
+                PrTitle = "TODO: title",
+                PrBody = "TODO: body",
+            };
+            await _apiHandler.CreatePullRequest(createPullRequest);
+            // TODO: log updated dependencies to console
         }
         else
         {
-            // TODO: throw if no updates performed
+            // TODO: log or throw if nothing was updated, but was expected to be
         }
 
         var result = new RunResult()
@@ -289,6 +275,62 @@ public class RunWorker
         return result;
     }
 
+    internal static bool IsUpdateAllowed(Job job, Dependency dependency)
+    {
+        if (dependency.Name.Equals("Microsoft.NET.Sdk", StringComparison.OrdinalIgnoreCase))
+        {
+            // this can't be updated
+            // TODO: pull this out of discovery?
+            return false;
+        }
+
+        if (dependency.Version is null)
+        {
+            // if we don't know the version, there's nothing we can do
+            // TODO: pull this out of discovery?
+            return false;
+        }
+
+        var version = NuGetVersion.Parse(dependency.Version);
+        var dependencyInfo = GetDependencyInfo(job, dependency);
+        var isVulnerable = dependencyInfo.Vulnerabilities.Any(v => v.IsVulnerable(version));
+        var allowed = job.AllowedUpdates.Any(allowedUpdate =>
+        {
+            // check name restriction, if any
+            if (allowedUpdate.DependencyName is not null)
+            {
+                var matcher = new Matcher(StringComparison.OrdinalIgnoreCase)
+                    .AddInclude(allowedUpdate.DependencyName);
+                var result = matcher.Match(dependency.Name);
+                if (!result.HasMatches)
+                {
+                    return false;
+                }
+            }
+
+            var isSecurityUpdate = allowedUpdate.UpdateType == UpdateType.Security || job.SecurityUpdatesOnly;
+            if (isSecurityUpdate)
+            {
+                // only update if it's vulnerable
+                return isVulnerable;
+            }
+            else
+            {
+                // not a security update, so only update if...
+                // ...we've been explicitly asked to update this
+                if ((job.Dependencies ?? []).Any(d => d.Equals(dependency.Name, StringComparison.OrdinalIgnoreCase)))
+                {
+                    return true;
+                }
+
+                // ...no specific update being performed, do it if it's not transitive
+                return !dependency.IsTransitive;
+            }
+        });
+
+        return allowed;
+    }
+
     internal static ImmutableArray<Requirement> GetIgnoredRequirementsForDependency(Job job, string dependencyName)
     {
         var ignoreConditions = job.IgnoreConditions
@@ -375,7 +417,7 @@ public class RunWorker
                     new ReportedDependency()
                     {
                         Name = d.Name,
-                        Requirements = d.IsTransitive ? [] : [new ReportedRequirement()
+                        Requirements = [new ReportedRequirement()
                         {
                             File = GetFullRepoPath(p.FilePath),
                             Requirement = d.Version!,

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackageReferenceUpdater.cs

@@ -347,7 +347,7 @@ internal static class PackageReferenceUpdater
                 projectDirectory,
                 experimentsManager
             );
-            MSBuildHelper.ThrowOnUnauthenticatedFeed(stdout);
+            MSBuildHelper.ThrowOnError(stdout);
             if (exitCode != 0)
             {
                 logger.Warn($"    Transitive dependency [{dependencyName}/{newDependencyVersion}] was not added.\nSTDOUT:\n{stdout}\nSTDERR:\n{stderr}");

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/PackagesConfigUpdater.cs

@@ -148,18 +148,15 @@ internal static partial class PackagesConfigUpdater
 
                     if (exitCodeAgain != 0)
                     {
-                        MSBuildHelper.ThrowOnMissingFile(fullOutput);
-                        MSBuildHelper.ThrowOnMissingFile(restoreOutput);
-                        MSBuildHelper.ThrowOnMissingPackages(restoreOutput);
+                        MSBuildHelper.ThrowOnError(fullOutput);
+                        MSBuildHelper.ThrowOnError(restoreOutput);
                         throw new Exception($"Unable to restore.\nOutput:\n${restoreOutput}\n");
                     }
 
                     goto doRestore;
                 }
 
-                MSBuildHelper.ThrowOnUnauthenticatedFeed(fullOutput);
-                MSBuildHelper.ThrowOnMissingFile(fullOutput);
-                MSBuildHelper.ThrowOnMissingPackages(fullOutput);
+                MSBuildHelper.ThrowOnError(fullOutput);
                 throw new Exception(fullOutput);
             }
         }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Utilities/MSBuildHelper.cs

@@ -903,21 +903,6 @@ internal static partial class MSBuildHelper
         }
     }
 
-    internal static void ThrowOnUnauthenticatedFeed(string stdout)
-    {
-        var unauthorizedMessageSnippets = new string[]
-        {
-            "The plugin credential provider could not acquire credentials",
-            "401 (Unauthorized)",
-            "error NU1301: Unable to load the service index for source",
-            "Response status code does not indicate success: 403",
-        };
-        if (unauthorizedMessageSnippets.Any(stdout.Contains))
-        {
-            throw new HttpRequestException(message: stdout, inner: null, statusCode: System.Net.HttpStatusCode.Unauthorized);
-        }
-    }
-
     internal static string? GetMissingFile(string output)
     {
         var missingFilePatterns = new[]
@@ -934,7 +919,30 @@ internal static partial class MSBuildHelper
         return null;
     }
 
-    internal static void ThrowOnMissingFile(string output)
+    internal static void ThrowOnError(string output)
+    {
+        ThrowOnUnauthenticatedFeed(output);
+        ThrowOnMissingFile(output);
+        ThrowOnMissingPackages(output);
+        ThrowOnUnresolvableDependencies(output);
+    }
+
+    private static void ThrowOnUnauthenticatedFeed(string stdout)
+    {
+        var unauthorizedMessageSnippets = new string[]
+        {
+            "The plugin credential provider could not acquire credentials",
+            "401 (Unauthorized)",
+            "error NU1301: Unable to load the service index for source",
+            "Response status code does not indicate success: 403",
+        };
+        if (unauthorizedMessageSnippets.Any(stdout.Contains))
+        {
+            throw new HttpRequestException(message: stdout, inner: null, statusCode: System.Net.HttpStatusCode.Unauthorized);
+        }
+    }
+
+    private static void ThrowOnMissingFile(string output)
     {
         var missingFile = GetMissingFile(output);
         if (missingFile is not null)
@@ -943,9 +951,9 @@ internal static partial class MSBuildHelper
         }
     }
 
-    internal static void ThrowOnMissingPackages(string output)
+    private static void ThrowOnMissingPackages(string output)
     {
-        var missingPackagesPattern = new Regex(@"Package '(?<PackageName>[^'].*)' is not found on source");
+        var missingPackagesPattern = new Regex(@"Package '(?<PackageName>[^']*)' is not found on source");
         var matchCollection = missingPackagesPattern.Matches(output);
         var missingPackages = matchCollection.Select(m => m.Groups["PackageName"].Value).Distinct().ToArray();
         if (missingPackages.Length > 0)
@@ -954,6 +962,16 @@ internal static partial class MSBuildHelper
         }
     }
 
+    private static void ThrowOnUnresolvableDependencies(string output)
+    {
+        var unresolvablePackagePattern = new Regex(@"Unable to resolve dependencies\. '(?<PackageName>[^ ]+) (?<PackageVersion>[^']+)'");
+        var match = unresolvablePackagePattern.Match(output);
+        if (match.Success)
+        {
+            throw new UpdateNotPossibleException([$"{match.Groups["PackageName"].Value}.{match.Groups["PackageVersion"].Value}"]);
+        }
+    }
+
     internal static bool TryGetGlobalJsonPath(string repoRootPath, string workspacePath, [NotNullWhen(returnValue: true)] out string? globalJsonPath)
     {
         globalJsonPath = PathHelper.GetFileInDirectoryOrParent(workspacePath, repoRootPath, "global.json", caseSensitive: false);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/RunWorkerTests.cs

@@ -1711,6 +1711,344 @@ public class RunWorkerTests
         );
     }
 
+    [Fact]
+    public async Task UpdatePackageWithDifferentVersionsInDifferentDirectories()
+    {
+        // this test passes `null` for discovery, analyze, and update workers to fully test the desired behavior
+
+        // the same dependency Some.Package is reported for 3 cases:
+        //   library1.csproj - top level dependency, already up to date
+        //   library2.csproj - top level dependency, needs direct update
+        //   library3.csproj - transitive dependency, needs pin
+        await RunAsync(
+            experimentsManager: new ExperimentsManager() { UseDirectDiscovery = true },
+            packages: [
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net8.0"),
+                MockNuGetPackage.CreateSimplePackage("Some.Package", "2.0.0", "net8.0"),
+                MockNuGetPackage.CreateSimplePackage("Package.With.Transitive.Dependency", "0.1.0", "net8.0", [(null, [("Some.Package", "1.0.0")])]),
+            ],
+            job: new Job()
+            {
+                AllowedUpdates = [new() { UpdateType = UpdateType.Security }],
+                SecurityAdvisories =
+                [
+                    new()
+                    {
+                        DependencyName = "Some.Package",
+                        AffectedVersions = [Requirement.Parse("= 1.0.0")]
+                    }
+                ],
+                Source = new()
+                {
+                    Provider = "github",
+                    Repo = "test/repo",
+                    Directory = "/"
+                }
+            },
+            files: [
+                ("dirs.proj", """
+                    <Project>
+                      <ItemGroup>
+                        <ProjectFile Include="library1\library1.csproj" />
+                        <ProjectFile Include="library2\library2.csproj" />
+                        <ProjectFile Include="library3\library3.csproj" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("Directory.Build.props", "<Project />"),
+                ("Directory.Build.targets", "<Project />"),
+                ("Directory.Packages.props", """
+                    <Project>
+                      <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+                      </PropertyGroup>
+                    </Project>
+                    """),
+                ("library1/library1.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="2.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("library2/library2.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Some.Package" Version="1.0.0" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("library3/library3.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <PropertyGroup>
+                        <TargetFramework>net8.0</TargetFramework>
+                      </PropertyGroup>
+                      <ItemGroup>
+                        <PackageReference Include="Package.With.Transitive.Dependency" Version="0.1.0" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+            ],
+            discoveryWorker: null,
+            analyzeWorker: null,
+            updaterWorker: null,
+            expectedResult: new RunResult()
+            {
+                Base64DependencyFiles =
+                [
+                    new DependencyFile()
+                    {
+                        Directory = "/",
+                        Name = "Directory.Build.props",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("<Project />"))
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/",
+                        Name = "Directory.Build.targets",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("<Project />"))
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/",
+                        Name = "Directory.Packages.props",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
+                            <Project>
+                              <PropertyGroup>
+                                <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+                              </PropertyGroup>
+                            </Project>
+                            """))
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/library1",
+                        Name = "library1.csproj",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
+                            <Project Sdk="Microsoft.NET.Sdk">
+                              <PropertyGroup>
+                                <TargetFramework>net8.0</TargetFramework>
+                              </PropertyGroup>
+                              <ItemGroup>
+                                <PackageReference Include="Some.Package" Version="2.0.0" />
+                              </ItemGroup>
+                            </Project>
+                            """))
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/library2",
+                        Name = "library2.csproj",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
+                            <Project Sdk="Microsoft.NET.Sdk">
+                              <PropertyGroup>
+                                <TargetFramework>net8.0</TargetFramework>
+                              </PropertyGroup>
+                              <ItemGroup>
+                                <PackageReference Include="Some.Package" Version="1.0.0" />
+                              </ItemGroup>
+                            </Project>
+                            """))
+                    },
+                    new DependencyFile()
+                    {
+                        Directory = "/library3",
+                        Name = "library3.csproj",
+                        Content = Convert.ToBase64String(Encoding.UTF8.GetBytes("""
+                            <Project Sdk="Microsoft.NET.Sdk">
+                              <PropertyGroup>
+                                <TargetFramework>net8.0</TargetFramework>
+                              </PropertyGroup>
+                              <ItemGroup>
+                                <PackageReference Include="Package.With.Transitive.Dependency" Version="0.1.0" />
+                              </ItemGroup>
+                            </Project>
+                            """))
+                    }
+                ],
+                BaseCommitSha = "TEST-COMMIT-SHA",
+            },
+            expectedApiMessages: [
+                new UpdatedDependencyList()
+                {
+                    Dependencies = [
+                        new()
+                        {
+                            Name = "Some.Package",
+                            Version = "2.0.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "2.0.0",
+                                    File = "/library1/library1.csproj",
+                                    Groups = ["dependencies"],
+                                }
+                            ]
+                        },
+                        new()
+                        {
+                            Name = "Some.Package",
+                            Version = "1.0.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "1.0.0",
+                                    File = "/library2/library2.csproj",
+                                    Groups = ["dependencies"],
+                                }
+                            ]
+                        },
+                        new()
+                        {
+                            Name = "Package.With.Transitive.Dependency",
+                            Version = "0.1.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "0.1.0",
+                                    File = "/library3/library3.csproj",
+                                    Groups = ["dependencies"],
+                                }
+                            ]
+                        },
+                        new()
+                        {
+                            Name = "Some.Package",
+                            Version = "1.0.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "1.0.0",
+                                    File = "/library3/library3.csproj",
+                                    Groups = ["dependencies"],
+                                }
+                            ]
+                        },
+                    ],
+                    DependencyFiles = [
+                        "/Directory.Build.props",
+                        "/Directory.Build.targets",
+                        "/Directory.Packages.props",
+                        "/library1/library1.csproj",
+                        "/library2/library2.csproj",
+                        "/library3/library3.csproj",
+                    ],
+                },
+                new IncrementMetric()
+                {
+                    Metric = "updater.started",
+                    Tags = new()
+                    {
+                        ["operation"] = "group_update_all_versions"
+                    }
+                },
+                new CreatePullRequest()
+                {
+                    Dependencies = [
+                        new()
+                        {
+                            Name = "Some.Package",
+                            Version = "2.0.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "2.0.0",
+                                    File = "/library2/library2.csproj",
+                                    Groups = ["dependencies"],
+                                    Source = new()
+                                    {
+                                        SourceUrl = null,
+                                        Type = "nuget_repo",
+                                    }
+                                }
+                            ],
+                            PreviousVersion = "1.0.0",
+                            PreviousRequirements = [
+                                new()
+                                {
+                                    Requirement = "1.0.0",
+                                    File = "/library2/library2.csproj",
+                                    Groups = ["dependencies"],
+                                }
+                            ],
+                        },
+                        new()
+                        {
+                            Name = "Some.Package",
+                            Version = "2.0.0",
+                            Requirements = [
+                                new()
+                                {
+                                    Requirement = "2.0.0",
+                                    File = "/library3/library3.csproj",
+                                    Groups = ["dependencies"],
+                                    Source = new()
+                                    {
+                                        SourceUrl = null,
+                                        Type = "nuget_repo",
+                                    }
+                                }
+                            ],
+                            PreviousVersion = "1.0.0",
+                            PreviousRequirements = [
+                                new()
+                                {
+                                    Requirement = "1.0.0",
+                                    File = "/library3/library3.csproj",
+                                    Groups = ["dependencies"],
+                                }
+                            ],
+                        },
+                    ],
+                    UpdatedDependencyFiles = [
+                        new()
+                        {
+                            Directory = "/library2",
+                            Name = "library2.csproj",
+                            Content = """
+                                <Project Sdk="Microsoft.NET.Sdk">
+                                  <PropertyGroup>
+                                    <TargetFramework>net8.0</TargetFramework>
+                                  </PropertyGroup>
+                                  <ItemGroup>
+                                    <PackageReference Include="Some.Package" Version="2.0.0" />
+                                  </ItemGroup>
+                                </Project>
+                                """
+                        },
+                        new()
+                        {
+                            Directory = "/library3",
+                            Name = "library3.csproj",
+                            Content = """
+                                <Project Sdk="Microsoft.NET.Sdk">
+                                  <PropertyGroup>
+                                    <TargetFramework>net8.0</TargetFramework>
+                                  </PropertyGroup>
+                                  <ItemGroup>
+                                    <PackageReference Include="Package.With.Transitive.Dependency" Version="0.1.0" />
+                                    <PackageReference Include="Some.Package" Version="2.0.0" />
+                                  </ItemGroup>
+                                </Project>
+                                """
+                        }
+                    ],
+                    BaseCommitSha = "TEST-COMMIT-SHA",
+                    CommitMessage = "TODO: message",
+                    PrTitle = "TODO: title",
+                    PrBody = "TODO: body"
+                },
+                new MarkAsProcessed("TEST-COMMIT-SHA")
+            ]
+        );
+    }
+
     private static async Task RunAsync(Job job, TestFile[] files, IDiscoveryWorker? discoveryWorker, IAnalyzeWorker? analyzeWorker, IUpdaterWorker? updaterWorker, RunResult expectedResult, object[] expectedApiMessages, MockNuGetPackage[]? packages = null, ExperimentsManager? experimentsManager = null, string? repoContentsPath = null)
     {
         // arrange

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/UpdateAllowedTests.cs

@@ -0,0 +1,286 @@
+using System.Collections.Immutable;
+
+using NuGetUpdater.Core.Analyze;
+using NuGetUpdater.Core.Run;
+using NuGetUpdater.Core.Run.ApiModel;
+
+using Xunit;
+
+using DepType = NuGetUpdater.Core.Run.ApiModel.DependencyType;
+
+namespace NuGetUpdater.Core.Test.Run;
+
+public class UpdateAllowedTests
+{
+    [Theory]
+    [MemberData(nameof(IsUpdateAllowedTestData))]
+    public void IsUpdateAllowed(Job job, Dependency dependency, bool expectedResult)
+    {
+        var actualResult = RunWorker.IsUpdateAllowed(job, dependency);
+        Assert.Equal(expectedResult, actualResult);
+    }
+
+    public static IEnumerable<object[]> IsUpdateAllowedTestData()
+    {
+        // with default allowed updates on a transitive dependency
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: true),
+            // expectedResult
+            false,
+        ];
+
+        // when dealing with a security update
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: true),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: true),
+            // expectedResult
+            true,
+        ];
+
+        // with a top-level dependency
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // with a sub-dependency
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: true),
+            // expectedResult
+            false,
+        ];
+
+        // when insecure
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: true),
+            // expectedResult
+            true,
+        ];
+
+        // when only security fixes are allowed
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: true),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when dealing with a security fix
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: true),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // when dealing with a security fix that doesn't apply
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [Requirement.Parse("> 1.8.0")], PatchedVersions = [], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: true),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when dealing with a security fix that doesn't apply to some versions
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyType = DepType.Direct, UpdateType = UpdateType.All },
+                    new AllowedUpdate() { DependencyType = DepType.Indirect, UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [Requirement.Parse("< 1.8.0"), Requirement.Parse("> 1.8.0")], PatchedVersions = [], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: true),
+            new Dependency("Some.Package", "1.8.1", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // when a dependency allow list that includes the dependency
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Some.Package" }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // with a dependency allow list that uses a wildcard
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Some.*" }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+
+        // when dependency allow list that excludes the dependency
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Unrelated.Package" }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when matching with an incomplete dependency name
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Some" }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // with a dependency allow list that uses a wildcard
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Unrelated.*" }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when security fixes are also allowed
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Unrelated.Package" },
+                    new AllowedUpdate() { UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            false,
+        ];
+
+        // when dealing with a security fix
+        yield return
+        [
+            CreateJob(
+                allowedUpdates: [
+                    new AllowedUpdate() { DependencyName = "Unrelated.Package"}, new AllowedUpdate(){ UpdateType = UpdateType.Security }
+                ],
+                securityAdvisories: [
+                    new Advisory() { DependencyName = "Some.Package", AffectedVersions = [], PatchedVersions = [Requirement.Parse(">= 1.11.0")], UnaffectedVersions = [] }
+                ],
+                securityUpdatesOnly: false),
+            new Dependency("Some.Package", "1.8.0", DependencyType.PackageReference, IsTransitive: false),
+            // expectedResult
+            true,
+        ];
+    }
+
+    private static Job CreateJob(AllowedUpdate[] allowedUpdates, Advisory[] securityAdvisories, bool securityUpdatesOnly)
+    {
+        return new Job()
+        {
+            AllowedUpdates = allowedUpdates.ToImmutableArray(),
+            SecurityAdvisories = securityAdvisories.ToImmutableArray(),
+            SecurityUpdatesOnly = securityUpdatesOnly,
+            Source = new()
+            {
+                Provider = "nuget",
+                Repo = "test/repo",
+            }
+        };
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/UpdatedDependencyListTests.cs

@@ -94,7 +94,15 @@ public class UpdatedDependencyListTests
                 {
                     Name = "System.Text.Json",
                     Version = "6.0.0",
-                    Requirements = [],
+                    Requirements =
+                    [
+                        new ReportedRequirement()
+                        {
+                            Requirement = "6.0.0",
+                            File = "/src/c/project.csproj",
+                            Groups = ["dependencies"],
+                        }
+                    ],
                 },
                 new ReportedDependency()
                 {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs

@@ -1,7 +1,8 @@
 using System.Collections.Immutable;
+using System.Text.Json;
 
-using NuGet.Build.Tasks;
-
+using NuGetUpdater.Core.Run;
+using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Test.Update;
 
 using Xunit;
@@ -1366,6 +1367,91 @@ public class MSBuildHelperTests : TestBase
     }
     #endregion
 
+    [Theory]
+    [MemberData(nameof(GenerateErrorFromToolOutputTestData))]
+    public async Task GenerateErrorFromToolOutput(string output, JobErrorBase? expectedError)
+    {
+        Exception? exception = null;
+        try
+        {
+            MSBuildHelper.ThrowOnError(output);
+        }
+        catch (Exception ex)
+        {
+            exception = ex;
+        }
+
+        if (expectedError is null)
+        {
+            Assert.Null(exception);
+        }
+        else
+        {
+            Assert.NotNull(exception);
+            using var tempDir = await TemporaryDirectory.CreateWithContentsAsync([("NuGet.Config", """
+                <configuration>
+                  <packageSources>
+                    <clear />
+                    <add key="test-feed" value="http://localhost/test-feed" />
+                  </packageSources>
+                </configuration>
+                """)]);
+            var actualError = JobErrorBase.ErrorFromException(exception, "TEST-JOB-ID", tempDir.DirectoryPath);
+            if (actualError is DependencyFileNotFound notFound)
+            {
+                // normalize default message for the test
+                actualError = new DependencyFileNotFound(notFound.Details["file-path"].ToString()!, "test message");
+            }
+
+            var actualErrorJson = JsonSerializer.Serialize(actualError, RunWorker.SerializerOptions);
+            var expectedErrorJson = JsonSerializer.Serialize(expectedError, RunWorker.SerializerOptions);
+            Assert.Equal(expectedErrorJson, actualErrorJson);
+        }
+    }
+
+    public static IEnumerable<object?[]> GenerateErrorFromToolOutputTestData()
+    {
+        yield return
+        [
+            // output
+            "Everything was good.",
+            // expectedError
+            null,
+        ];
+
+        yield return
+        [
+            // output
+            "Response status code does not indicate success: 403",
+            // expectedError
+            new PrivateSourceAuthenticationFailure(["http://localhost/test-feed"]),
+        ];
+
+        yield return
+        [
+            // output
+            "The imported file \"some.file\" does not exist",
+            // expectedError
+            new DependencyFileNotFound("some.file", "test message"),
+        ];
+
+        yield return
+        [
+            // output
+            "Package 'Some.Package' is not found on source",
+            // expectedError
+            new UpdateNotPossible(["Some.Package"]),
+        ];
+
+        yield return
+        [
+            // output
+            "Unable to resolve dependencies. 'Some.Package 1.2.3' is not compatible with",
+            // expectedError
+            new UpdateNotPossible(["Some.Package.1.2.3"]),
+        ];
+    }
+
     public static IEnumerable<object[]> GetTopLevelPackageDependencyInfosTestData()
     {
         // simple case

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.294.0
+  version: 0.295.0
 platform: ruby
 authors:
 - Dependabot
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-23 00:00:00.000000000 Z
+date: 2025-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.294.0
+        version: 0.295.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.294.0
+        version: 0.295.0
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -351,6 +351,7 @@ files:
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/RunWorkerTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/SerializationTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/TestApiHandler.cs
+- helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/UpdateAllowedTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/UpdatedDependencyListTests.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/TemporaryDirectory.cs
 - helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/TemporaryEnvironment.cs
@@ -528,7 +529,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.294.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.295.0
 post_install_message:
 rdoc_options: []
 require_paths: