dependabot-nuget 0.302.0 → 0.303.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa40dad694a6849be3c9da853f6d075f0db1f44f9cc9338e07586405e5f02bcc
-  data.tar.gz: 0f7ddac2d69e9a1dce70c7000b3159c0daf337816c93b9498678d58fa3753afc
+  metadata.gz: c0d78d1b91ae626712aaadfdc2f4d03f8f15247b88b869a7285e0b4ad75a36c6
+  data.tar.gz: 6bb59e2674de36c8fae8ee8172db65e6c64447a9f951bd9717bc5915b1a491b3
 SHA512:
-  metadata.gz: ee07bf8ca5e089cc11ec1e077e2982b0525ac071f77f1411c3f2fdda7ffe378e6ecfa9d00c2762dee45dc65dd5fd76bcea3f1e2688dae83a1e431470744695f3
-  data.tar.gz: 5f0837e22360fb06fca6271bbd335e921e72be1d79d1b36802ca7aa80cecfb92c0218ae7b1a1914de7b45bde64d5c5ff34c4f1450c2405c30ac981d0dd90ea67
+  metadata.gz: 0d71151a04b9a0ad457713832a763169027b9e24dc95366ffad4fa0011c7820f458410b288d4b85b3382f28923369cf56a60aa0d1970e66c91096c49c857b8b9
+  data.tar.gz: c041d7724ecfbf3dd2cd43064ff566eae5526ee5fe73f5b51df153b093f75b5fbc3a0600bbbe4b250bb1919de3e779f233f9a6100d20bfcc1f0b67cbbb82a503

data/helpers/lib/NuGetUpdater/Directory.Packages.props

@@ -19,7 +19,7 @@
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.12.0" />
     <PackageVersion Include="Microsoft.CSharp" Version="4.7.0" />
     <PackageVersion Include="Microsoft.Extensions.FileProviders.Abstractions" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="9.0.0" />
+    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="9.0.3" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
     <PackageVersion Include="Microsoft.VisualStudio.Setup.Configuration.Interop" Version="3.12.2149" />
     <PackageVersion Include="Microsoft.Web.Xdt" Version="3.1.0" />
@@ -28,16 +28,16 @@
     <PackageVersion Include="NuGet.Core" Version="2.14.0" Aliases="CoreV2" />
     <PackageVersion Include="Semver" Version="3.0.0" />
     <PackageVersion Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
-    <PackageVersion Include="System.ComponentModel.Composition" Version="9.0.0" />
+    <PackageVersion Include="System.ComponentModel.Composition" Version="9.0.3" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <PackageVersion Include="System.Formats.Asn1" Version="8.0.1" />
     <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.0" />
     <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.0" />
-    <PackageVersion Include="System.Text.Json" Version="8.0.4" />
+    <PackageVersion Include="System.Text.Json" Version="9.0.3" />
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
-    <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="9.0.0" />
+    <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="9.0.3" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.0" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.2" />
   </ItemGroup>
 
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyDiscoveryTargetingPacks.props

@@ -0,0 +1,10 @@
+<Project>
+  <PropertyGroup>
+    <!--
+    Suppress errors like:
+      error MSB3644: The reference assemblies for .NETFramework,Version=v4.7.2 were not found.
+    because that's irrelevant to dependency discovery.
+    -->
+    <NoWarn>$(NoWarn);MSB3644</NoWarn>
+  </PropertyGroup>
+</Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DiscoveryWorker.cs

@@ -304,129 +304,128 @@ public partial class DiscoveryWorker : IDiscoveryWorker
 
     private async Task<ImmutableArray<ProjectDiscoveryResult>> RunForProjectPathsAsync(string repoRootPath, string workspacePath, IEnumerable<string> projectPaths)
     {
+        var normalizedProjectPaths = projectPaths.SelectMany(p => PathHelper.ResolveCaseInsensitivePathsInsideRepoRoot(p, repoRootPath) ?? []).Distinct().ToImmutableArray();
+        var disposables = normalizedProjectPaths.Select(p => new SpecialImportsConditionPatcher(p)).ToImmutableArray();
         var results = new Dictionary<string, ProjectDiscoveryResult>(StringComparer.Ordinal);
-        foreach (var projectPath in projectPaths)
-        {
-            // If there is some MSBuild logic that needs to run to fully resolve the path skip the project
-            // Ensure file existence is checked case-insensitively
-            var actualProjectPaths = PathHelper.ResolveCaseInsensitivePathsInsideRepoRoot(projectPath, repoRootPath);
-
-            if (actualProjectPaths == null)
-            {
-                continue;
-            }
 
-            foreach (var actualProjectPath in actualProjectPaths)
+        try
+        {
+            foreach (var projectPath in normalizedProjectPaths)
             {
-                if (_processedProjectPaths.Contains(actualProjectPath))
+                if (_processedProjectPaths.Contains(projectPath))
                 {
                     continue;
                 }
 
-                _processedProjectPaths.Add(actualProjectPath);
+                _processedProjectPaths.Add(projectPath);
 
-                using (new SpecialImportsConditionPatcher(actualProjectPath))
+                var relativeProjectPath = Path.GetRelativePath(workspacePath, projectPath).NormalizePathToUnix();
+                var packagesConfigResult = await PackagesConfigDiscovery.Discover(repoRootPath, workspacePath, projectPath, _experimentsManager, _logger);
+                var projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, projectPath, _experimentsManager, _logger);
+
+                // Determine if there were unrestored MSBuildSdks
+                var msbuildSdks = projectResults.SelectMany(p => p.Dependencies.Where(d => d.Type == DependencyType.MSBuildSdk)).ToImmutableArray();
+                if (msbuildSdks.Length > 0)
                 {
-                    var relativeProjectPath = Path.GetRelativePath(workspacePath, actualProjectPath).NormalizePathToUnix();
-                    var packagesConfigResult = await PackagesConfigDiscovery.Discover(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
-                    var projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
+                    // If new SDKs were restored, then we need to rerun SdkProjectDiscovery.
+                    if (await TryRestoreMSBuildSdksAsync(repoRootPath, workspacePath, msbuildSdks, _logger))
+                    {
+                        projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, projectPath, _experimentsManager, _logger);
+                    }
+                }
 
-                    // Determine if there were unrestored MSBuildSdks
-                    var msbuildSdks = projectResults.SelectMany(p => p.Dependencies.Where(d => d.Type == DependencyType.MSBuildSdk)).ToImmutableArray();
-                    if (msbuildSdks.Length > 0)
+                foreach (var projectResult in projectResults)
+                {
+                    if (results.ContainsKey(projectResult.FilePath))
                     {
-                        // If new SDKs were restored, then we need to rerun SdkProjectDiscovery.
-                        if (await TryRestoreMSBuildSdksAsync(repoRootPath, workspacePath, msbuildSdks, _logger))
-                        {
-                            projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, actualProjectPath, _experimentsManager, _logger);
-                        }
+                        continue;
                     }
 
-                    foreach (var projectResult in projectResults)
+                    // If we had packages.config dependencies, merge them with the project dependencies
+                    if (projectResult.FilePath == relativeProjectPath && packagesConfigResult is not null)
                     {
-                        if (results.ContainsKey(projectResult.FilePath))
-                        {
-                            continue;
-                        }
+                        var packagesConfigDependencies = packagesConfigResult.Dependencies
+                            .Select(d => d with { TargetFrameworks = projectResult.TargetFrameworks })
+                            .ToImmutableArray();
 
-                        // If we had packages.config dependencies, merge them with the project dependencies
-                        if (projectResult.FilePath == relativeProjectPath && packagesConfigResult is not null)
+                        results[projectResult.FilePath] = projectResult with
                         {
-                            var packagesConfigDependencies = packagesConfigResult.Dependencies
-                                .Select(d => d with { TargetFrameworks = projectResult.TargetFrameworks })
-                                .ToImmutableArray();
+                            Dependencies = [.. projectResult.Dependencies, .. packagesConfigDependencies],
+                        };
+                    }
+                    else
+                    {
+                        results[projectResult.FilePath] = projectResult;
+                    }
+                }
 
-                            results[projectResult.FilePath] = projectResult with
+                if (packagesConfigResult is not null)
+                {
+                    // we might have to merge this dependency with some others
+                    if (results.TryGetValue(relativeProjectPath, out var existingProjectDiscovery))
+                    {
+                        // merge SDK and packages.config results
+                        var mergedDependencies = existingProjectDiscovery.Dependencies.Concat(packagesConfigResult.Dependencies)
+                            .DistinctBy(d => d.Name, StringComparer.OrdinalIgnoreCase)
+                            .OrderBy(d => d.Name)
+                            .ToImmutableArray();
+                        var mergedTargetFrameworks = existingProjectDiscovery.TargetFrameworks.Concat(packagesConfigResult.TargetFrameworks)
+                            .Select(t =>
                             {
-                                Dependencies = [.. projectResult.Dependencies, .. packagesConfigDependencies],
-                            };
-                        }
-                        else
+                                try
+                                {
+                                    var tfm = NuGetFramework.Parse(t);
+                                    return tfm.GetShortFolderName();
+                                }
+                                catch
+                                {
+                                    return string.Empty;
+                                }
+                            })
+                            .Where(tfm => !string.IsNullOrEmpty(tfm))
+                            .Distinct()
+                            .OrderBy(tfm => tfm)
+                            .ToImmutableArray();
+                        var mergedProperties = existingProjectDiscovery.Properties; // packages.config discovery doesn't produce properties
+                        var mergedImportedFiles = existingProjectDiscovery.ImportedFiles; // packages.config discovery doesn't produce imported files
+                        var mergedAdditionalFiles = existingProjectDiscovery.AdditionalFiles.Concat(packagesConfigResult.AdditionalFiles)
+                            .Distinct(StringComparer.OrdinalIgnoreCase)
+                            .OrderBy(f => f)
+                            .ToImmutableArray();
+                        var mergedResult = new ProjectDiscoveryResult()
                         {
-                            results[projectResult.FilePath] = projectResult;
-                        }
+                            FilePath = existingProjectDiscovery.FilePath,
+                            Dependencies = mergedDependencies,
+                            TargetFrameworks = mergedTargetFrameworks,
+                            Properties = mergedProperties,
+                            ImportedFiles = mergedImportedFiles,
+                            AdditionalFiles = mergedAdditionalFiles,
+                        };
+                        results[relativeProjectPath] = mergedResult;
                     }
-
-                    if (packagesConfigResult is not null)
+                    else
                     {
-                        // we might have to merge this dependency with some others
-                        if (results.TryGetValue(relativeProjectPath, out var existingProjectDiscovery))
+                        // add packages.config results
+                        results[relativeProjectPath] = new ProjectDiscoveryResult()
                         {
-                            // merge SDK and packages.config results
-                            var mergedDependencies = existingProjectDiscovery.Dependencies.Concat(packagesConfigResult.Dependencies)
-                                .DistinctBy(d => d.Name, StringComparer.OrdinalIgnoreCase)
-                                .OrderBy(d => d.Name)
-                                .ToImmutableArray();
-                            var mergedTargetFrameworks = existingProjectDiscovery.TargetFrameworks.Concat(packagesConfigResult.TargetFrameworks)
-                                .Select(t =>
-                                {
-                                    try
-                                    {
-                                        var tfm = NuGetFramework.Parse(t);
-                                        return tfm.GetShortFolderName();
-                                    }
-                                    catch
-                                    {
-                                        return string.Empty;
-                                    }
-                                })
-                                .Where(tfm => !string.IsNullOrEmpty(tfm))
-                                .Distinct()
-                                .OrderBy(tfm => tfm)
-                                .ToImmutableArray();
-                            var mergedProperties = existingProjectDiscovery.Properties; // packages.config discovery doesn't produce properties
-                            var mergedImportedFiles = existingProjectDiscovery.ImportedFiles; // packages.config discovery doesn't produce imported files
-                            var mergedAdditionalFiles = existingProjectDiscovery.AdditionalFiles.Concat(packagesConfigResult.AdditionalFiles)
-                                .Distinct(StringComparer.OrdinalIgnoreCase)
-                                .OrderBy(f => f)
-                                .ToImmutableArray();
-                            var mergedResult = new ProjectDiscoveryResult()
-                            {
-                                FilePath = existingProjectDiscovery.FilePath,
-                                Dependencies = mergedDependencies,
-                                TargetFrameworks = mergedTargetFrameworks,
-                                Properties = mergedProperties,
-                                ImportedFiles = mergedImportedFiles,
-                                AdditionalFiles = mergedAdditionalFiles,
-                            };
-                            results[relativeProjectPath] = mergedResult;
-                        }
-                        else
-                        {
-                            // add packages.config results
-                            results[relativeProjectPath] = new ProjectDiscoveryResult()
-                            {
-                                FilePath = relativeProjectPath,
-                                Dependencies = packagesConfigResult.Dependencies,
-                                TargetFrameworks = packagesConfigResult.TargetFrameworks,
-                                ImportedFiles = [], // no imported files resolved for packages.config scenarios
-                                AdditionalFiles = packagesConfigResult.AdditionalFiles,
-                            };
-                        }
+                            FilePath = relativeProjectPath,
+                            Dependencies = packagesConfigResult.Dependencies,
+                            TargetFrameworks = packagesConfigResult.TargetFrameworks,
+                            ImportedFiles = [], // no imported files resolved for packages.config scenarios
+                            AdditionalFiles = packagesConfigResult.AdditionalFiles,
+                        };
                     }
                 }
             }
         }
+        finally
+        {
+            foreach (var disposable in disposables)
+            {
+                // restore the original project file
+                disposable.Dispose();
+            }
+        }
 
         return [.. results.Values];
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -108,6 +108,7 @@ internal static class SdkProjectDiscovery
                 var (exitCode, stdOut, stdErr) = await MSBuildHelper.HandleGlobalJsonAsync(startingProjectDirectory, repoRootPath, experimentsManager, async () =>
                 {
                     // the built-in target `GenerateBuildDependencyFile` forces resolution of all NuGet packages, but doesn't invoke a full build
+                    var dependencyDiscoveryTargetingPacksPropsPath = MSBuildHelper.GetFileFromRuntimeDirectory("DependencyDiscoveryTargetingPacks.props");
                     var dependencyDiscoveryTargetsPath = MSBuildHelper.GetFileFromRuntimeDirectory("DependencyDiscovery.targets");
                     var args = new List<string>()
                     {
@@ -115,6 +116,7 @@ internal static class SdkProjectDiscovery
                         startingProjectPath,
                         "/t:_DiscoverDependencies",
                         $"/p:TargetFramework={tfm}",
+                        $"/p:CustomBeforeMicrosoftCommonProps={dependencyDiscoveryTargetingPacksPropsPath}",
                         $"/p:CustomAfterMicrosoftCommonCrossTargetingTargets={dependencyDiscoveryTargetsPath}",
                         $"/p:CustomAfterMicrosoftCommonTargets={dependencyDiscoveryTargetsPath}",
                         "/p:TreatWarningsAsErrors=false", // if using CPM and a project also sets TreatWarningsAsErrors to true, this can cause discovery to fail; explicitly don't allow that

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/ExperimentsManager.cs

@@ -8,6 +8,7 @@ namespace NuGetUpdater.Core;
 public record ExperimentsManager
 {
     public bool InstallDotnetSdks { get; init; } = false;
+    public bool NativeUpdater { get; init; } = false;
     public bool UseLegacyDependencySolver { get; init; } = false;
     public bool UseDirectDiscovery { get; init; } = false;
 
@@ -16,6 +17,7 @@ public record ExperimentsManager
         return new()
         {
             ["nuget_install_dotnet_sdks"] = InstallDotnetSdks,
+            ["nuget_native_updater"] = NativeUpdater,
             ["nuget_legacy_dependency_solver"] = UseLegacyDependencySolver,
             ["nuget_use_direct_discovery"] = UseDirectDiscovery,
         };
@@ -26,6 +28,7 @@ public record ExperimentsManager
         return new ExperimentsManager()
         {
             InstallDotnetSdks = IsEnabled(experiments, "nuget_install_dotnet_sdks"),
+            NativeUpdater = IsEnabled(experiments, "nuget_native_updater"),
             UseLegacyDependencySolver = IsEnabled(experiments, "nuget_legacy_dependency_solver"),
             UseDirectDiscovery = IsEnabled(experiments, "nuget_use_direct_discovery"),
         };

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/NuGetUpdater.Core.csproj

@@ -9,6 +9,7 @@
 
   <ItemGroup>
     <None Include="DependencyDiscovery.props" CopyToOutputDirectory="PreserveNewest" />
+    <None Include="DependencyDiscoveryTargetingPacks.props" CopyToOutputDirectory="PreserveNewest" />
     <None Include="DependencyDiscovery.targets" CopyToOutputDirectory="PreserveNewest" />
     <None Include="TargetFrameworkReporter.targets" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -10,6 +10,7 @@ using NuGet.Versioning;
 using NuGetUpdater.Core.Analyze;
 using NuGetUpdater.Core.Discover;
 using NuGetUpdater.Core.Run.ApiModel;
+using NuGetUpdater.Core.Updater;
 using NuGetUpdater.Core.Utilities;
 
 using static NuGetUpdater.Core.Utilities.EOLHandling;
@@ -158,6 +159,7 @@ public class RunWorker
         }
 
         // do update
+        var updateOperationsPerformed = new List<UpdateOperationBase>();
         var existingPullRequests = job.GetAllExistingPullRequests();
         var unhandledPullRequestDependenciesSet = existingPullRequests
             .Select(pr => pr.Item2.Select(d => d.DependencyName).ToHashSet(StringComparer.OrdinalIgnoreCase))
@@ -240,6 +242,8 @@ public class RunWorker
                 {
                     actualUpdatedDependencies.Add(updatedDependency);
                 }
+
+                updateOperationsPerformed.AddRange(updateResult.UpdateOperations);
             }
         }
 
@@ -317,6 +321,10 @@ public class RunWorker
             await SendApiMessage(new SecurityUpdateNotNeeded(depName));
         }
 
+        var normalizedUpdateOperationsPerformed = UpdateOperationBase.NormalizeUpdateOperationCollection(repoContentsPath.FullName, updateOperationsPerformed);
+        var report = UpdateOperationBase.GenerateUpdateOperationReport(normalizedUpdateOperationsPerformed);
+        _logger.Info(report);
+
         var result = new RunResult()
         {
             Base64DependencyFiles = originalDependencyFileContents.OrderBy(kvp => kvp.Key).Select(kvp =>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/BindingRedirectManager.cs

@@ -1,5 +1,6 @@
 extern alias CoreV2;
 
+using System.Collections.Immutable;
 using System.Xml.Linq;
 
 using CoreV2::NuGet.Runtime;
@@ -8,6 +9,7 @@ using Microsoft.Language.Xml;
 
 using NuGet.ProjectManagement;
 
+using NuGetUpdater.Core.Updater;
 using NuGetUpdater.Core.Utilities;
 
 using Runtime_AssemblyBinding = CoreV2::NuGet.Runtime.AssemblyBinding;
@@ -32,13 +34,14 @@ internal static class BindingRedirectManager
     /// <param name="projectBuildFile">The project build file (*.xproj) to be updated</param>
     /// <param name="updatedPackageName"/>The name of the package that was updated</param>
     /// <param name="updatedPackageVersion">The version of the package that was updated</param>
-    public static async ValueTask UpdateBindingRedirectsAsync(ProjectBuildFile projectBuildFile, string updatedPackageName, string updatedPackageVersion)
+    /// <returns>The updated files.</returns>
+    public static async ValueTask<ImmutableArray<string>> UpdateBindingRedirectsAsync(ProjectBuildFile projectBuildFile, string updatedPackageName, string updatedPackageVersion)
     {
         var configFile = await TryGetRuntimeConfigurationFile(projectBuildFile.Path);
         if (configFile is null)
         {
             // no runtime config file so no need to add binding redirects
-            return;
+            return [];
         }
 
         var references = ExtractReferenceElements(projectBuildFile);
@@ -48,7 +51,7 @@ internal static class BindingRedirectManager
         if (!bindings.Any())
         {
             // no bindings found in the project file, nothing to update
-            return;
+            return [];
         }
 
         // we need to detect what assembly references come from the newly updated package; the `HintPath` will look like
@@ -75,7 +78,7 @@ internal static class BindingRedirectManager
             AddConfigFileToProject(projectBuildFile, configFile);
         }
 
-        return;
+        return [configFile.Path];
 
         static List<(string Include, string HintPath)> ExtractReferenceElements(ProjectBuildFile projectBuildFile)
         {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/LockFileUpdater.cs

@@ -1,3 +1,5 @@
+using NuGetUpdater.Core.Updater;
+
 namespace NuGetUpdater.Core;
 
 internal static class LockFileUpdater