dependabot-nuget 0.359.0 → 0.360.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 37c8313017055e1840002707f6f97fbf09ed29c28df574327f188f33b5a5dfca
-  data.tar.gz: 651030c7a22e6743b54a594f93b41973d4ffd288d95145b07e744b87885e0375
+  metadata.gz: d191440d66bca7937ff8f8012de3869cc337bc132a696c015d67452f427071e3
+  data.tar.gz: 83a204114a2cc66bb7d0a64e9d806a8c81ab99e3401100f7fb1a1ac547dc596b
 SHA512:
-  metadata.gz: e5e9b92f11a473f8046b1925cf11a1fcae1cf3625d4510cf528a228615b18305f28fff320f9ce132de39ac7abb147f4234c8949a3ccb6841aa77e599e4ee54cc
-  data.tar.gz: 8652832c636b18da24146671415f1e4f582e8998329f8d2e16c523a97c3d1e59b64db2065548b13aae0fe73a383b8817dd97111959a121901d012e8c07312712
+  metadata.gz: 41ef96cd974364883124a59c532c426c77be31c434774d318e59ef32267ae19c5fb610d7411d46d8d4f1ffa4fe28cbe6488139be33165d215b5204f4f9444a57
+  data.tar.gz: 2d940963ea21e8b776dc8797a445d6044dd3e59d311da89da06db39d8c656763037878e0c0418e4ed0f7700bf57b8ea8aacefa1d6da4629da4b59dd3c67e68d8

data/helpers/lib/NuGetUpdater/Directory.Packages.props

@@ -39,6 +39,6 @@
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
     <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="9.0.7" />
     <PackageVersion Include="xunit.v3" Version="3.0.0" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.2" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 </Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/CompatabilityChecker.cs

@@ -114,12 +114,24 @@ internal static class CompatibilityChecker
             }
         }
 
-        var refItems = await readers.ContentReader.GetReferenceItemsAsync(cancellationToken);
+        var refItems = (await readers.ContentReader.GetReferenceItemsAsync(cancellationToken)).ToArray();
         foreach (var refItem in refItems)
         {
             tfms.Add(refItem.TargetFramework);
         }
 
+        var libItems = (await readers.ContentReader.GetLibItemsAsync(cancellationToken)).ToArray();
+        foreach (var libItem in libItems)
+        {
+            tfms.Add(libItem.TargetFramework);
+        }
+
+        // if a package contains no assemblies that need to be referenced, we can consider it compatible with all frameworks
+        if (refItems.Length == 0 && libItems.Length == 0)
+        {
+            tfms.Clear();
+        }
+
         if (!tfms.Any())
         {
             tfms.Add(NuGetFramework.AnyFramework);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -63,6 +63,9 @@ internal static class SdkProjectDiscovery
         "GenerateBuildDependencyFile"
     ];
 
+    // this seems to be the maximum number of TFMs that can be restored in parallel without running into race conditions
+    private const int MaximumParallelTargetFrameworkRestores = 2;
+
     public static async Task<ImmutableArray<ProjectDiscoveryResult>> DiscoverAsync(string repoRootPath, string workspacePath, string startingProjectPath, ExperimentsManager experimentsManager, ILogger logger)
     {
         var extension = Path.GetExtension(startingProjectPath)?.ToLowerInvariant();
@@ -113,8 +116,10 @@ internal static class SdkProjectDiscovery
 
         // due to how MSBuild handles multi-TFM projects with target platforms we may need to process each TFM separately
         // we detect that by determining if there are multiple target frameworks specified and if any of them have a platform suffix (e.g., `-windows`, `-android`, etc)
+        // alternately, if there are too many target frameworks specified, they must be handled individually
         var projectTfms = await MSBuildHelper.GetProjectTargetFrameworksAsync(startingProjectPath, logger);
-        var requiresIndividualRestores = projectTfms.Any(tfm => tfm.Contains('-'));
+        var hasPlatformTfms = projectTfms.Any(tfm => tfm.Contains('-'));
+        var requiresIndividualRestores = hasPlatformTfms || projectTfms.Length > MaximumParallelTargetFrameworkRestores;
         if (!requiresIndividualRestores)
         {
             projectTfms = [string.Empty]; // a single restore can handle everything, but we need to loop at least once and an empty TFM is our signal to not specify anything
@@ -122,7 +127,7 @@ internal static class SdkProjectDiscovery
 
         foreach (var tfm in projectTfms)
         {
-            var isSingleTfmRestore = !string.IsNullOrEmpty(tfm);
+            var isIndividualTfmRestore = !string.IsNullOrEmpty(tfm);
 
             // create a binlog
             var binLogPath = Path.Combine(Path.GetTempPath(), $"msbuild_{Guid.NewGuid():d}.binlog");
@@ -132,7 +137,7 @@ internal static class SdkProjectDiscovery
                 var args = new List<string>() { "msbuild", startingProjectPath };
                 var targets = await MSBuildHelper.GetProjectTargetsAsync(startingProjectPath, logger);
                 var useDirectRestore = SingleRestoreTargetNames.All(targets.Contains);
-                if (useDirectRestore || isSingleTfmRestore)
+                if (useDirectRestore || isIndividualTfmRestore)
                 {
                     // directly call the required targets
                     args.Add($"/t:{string.Join(",", SingleRestoreTargetNames)}");
@@ -151,7 +156,7 @@ internal static class SdkProjectDiscovery
                 args.Add($"/p:CustomAfterMicrosoftCommonCrossTargetingTargets={dependencyDiscoveryTargetsPath}");
                 args.Add($"/p:CustomAfterMicrosoftCommonTargets={dependencyDiscoveryTargetsPath}");
 
-                if (isSingleTfmRestore)
+                if (isIndividualTfmRestore)
                 {
                     args.Add($"/p:TargetFramework={tfm}");
                 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Updater/FileWriters/XmlFileWriter.cs

@@ -257,8 +257,8 @@ public class XmlFileWriter : IFileWriter
                     var (matchingPackageVersionElement, filePath) = matchingPackageVersionElementsAndPaths.First();
                     var versionAttribute = matchingPackageVersionElement.GetAttributeCaseInsensitive(VersionMetadataName);
                     if (versionAttribute is not null &&
-                        NuGetVersion.TryParse(versionAttribute.Value, out var existingVersion) &&
-                        existingVersion == requiredVersion)
+                        VersionRange.TryParse(versionAttribute.Value, out var existingVersionRange) &&
+                        existingVersionRange.MinVersion == requiredVersion)
                     {
                         // version matches; no update needed
                         _logger.Info($"Dependency {requiredPackageVersion.Name} already set to {requiredVersion}; no override needed.");

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Analyze/CompatibilityCheckerTests.cs

@@ -5,6 +5,7 @@ using NuGet.Packaging.Core;
 using NuGet.Versioning;
 
 using NuGetUpdater.Core.Analyze;
+using NuGetUpdater.Core.Test.Update;
 
 using Xunit;
 
@@ -143,6 +144,30 @@ public class CompatibilityCheckerTests
         Assert.False(result);
     }
 
+    [Fact]
+    public async Task CheckAsync_PackageWithFrameworkDependencyGroupButNoAssemblies_ReportsAsCompatible()
+    {
+        // package has an explicit dependency group that is incompatible with the project framework, but lib and ref directories are empty
+        // a real-world example is a project targeting `net9.0` and referencing `Microsoft.VisualStudio.Azure.Containers.Tools.Targets/1.22.1`
+        // depending on the project's properties, it's entirely possible for this to be a supported scenario
+
+        // arrange
+        using var tempDir = new TemporaryDirectory();
+        var package = new MockNuGetPackage("Some.Package", "1.0.0", DependencyGroups: [(".NETFramework4.7.2", [])]);
+        await UpdateWorkerTestBase.MockNuGetPackagesInDirectory([package], tempDir.DirectoryPath, includeCommonPackages: false);
+
+        var packageId = new PackageIdentity(package.Id, NuGetVersion.Parse(package.Version));
+        var projectFramework = NuGetFramework.Parse("net9.0");
+        var context = new NuGetContext(tempDir.DirectoryPath, NuGet.Common.NullLogger.Instance);
+        var logger = new TestLogger();
+
+        // act
+        var isCompatible = await CompatibilityChecker.CheckAsync(packageId, [projectFramework], context, logger, CancellationToken.None);
+
+        //assert
+        Assert.True(isCompatible);
+    }
+
     [Theory]
     [InlineData("netstandard2.0")]
     [InlineData("net472")]

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Discover/SdkProjectDiscoveryTests.cs

@@ -268,22 +268,28 @@ public class SdkProjectDiscoveryTests : DiscoveryWorkerTestBase
         );
     }
 
-    [Fact]
-    public async Task DiscoverWithMultipleTargetFrameworks()
+    [Theory]
+    [InlineData("net7.0")] // under the safe limit for parallel processing
+    [InlineData("net7.0", "net8.0")] // at the safe limit for parallel processing
+    [InlineData("net7.0", "net8.0", "net9.0")] // above the safe limit for parallel processing
+    [InlineData("netstandard2.0", "netstandard2.1", "net6.0", "net7.0", "net8.0", "net9.0", "net10.0")] // well above the safe limit for parallel processing
+    public async Task DiscoverWithMultipleTargetFrameworks(params string[] targetFrameworks)
     {
+        // tfms are sorted for reporting purposes
+        var sortedTargetFrameworks = targetFrameworks.OrderBy(t => t, StringComparer.Ordinal).ToArray();
         await TestDiscoverAsync(
             packages:
             [
-                MockNuGetPackage.CreateSimplePackage("Some.Dependency", "1.2.3", "net7.0"),
+                MockNuGetPackage.CreateSimplePackage("Some.Dependency", "1.2.3", "netstandard2.0"), // the lowest TFM this test uses
             ],
             startingDirectory: "src",
             projectPath: "src/library.csproj",
             files:
             [
-                ("src/library.csproj", """
+                ("src/library.csproj", $"""
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
-                        <TargetFrameworks>net7.0;net8.0</TargetFrameworks>
+                        <TargetFrameworks>{string.Join(";", targetFrameworks)}</TargetFrameworks>
                       </PropertyGroup>
                       <ItemGroup>
                         <PackageReference Include="Some.Dependency" Version="1.2.3" />
@@ -298,14 +304,14 @@ public class SdkProjectDiscoveryTests : DiscoveryWorkerTestBase
                     FilePath = "library.csproj",
                     Dependencies =
                     [
-                        new("Some.Dependency", "1.2.3", DependencyType.PackageReference, TargetFrameworks: ["net7.0", "net8.0"], IsDirect: true),
+                        new("Some.Dependency", "1.2.3", DependencyType.PackageReference, TargetFrameworks: [.. sortedTargetFrameworks], IsDirect: true),
                     ],
                     ImportedFiles = [],
                     Properties =
                     [
-                        new("TargetFrameworks", "net7.0;net8.0", "src/library.csproj"),
+                        new("TargetFrameworks", string.Join(";", targetFrameworks), "src/library.csproj"),
                     ],
-                    TargetFrameworks = ["net7.0", "net8.0"],
+                    TargetFrameworks = [.. sortedTargetFrameworks],
                     ReferencedProjectPaths = [],
                     AdditionalFiles = [],
                 },

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs

@@ -1137,6 +1137,116 @@ public class EndToEndTests
         );
     }
 
+    [Fact]
+    public async Task LockFilesAreRegeneratedThroughProjectReferences()
+    {
+        // this test needs to do some dynamic checks so we have to set it up manually
+        // job is started in `src/client` directory but ultimately the updater navigates through a `<ProjectReference>` element to make
+        // the update in `src/library` and both lock files are updated along the way _and_ included in the final PR
+
+        // arrange
+        using var tempDirectory = await TemporaryDirectory.CreateWithContentsAsync(
+            ("src/client/client.csproj", """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net9.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <ProjectReference Include="..\library\library.csproj" />
+                  </ItemGroup>
+                </Project>
+                """),
+            ("src/client/packages.lock.json", "{}"),
+            ("src/library/library.csproj", """
+                <Project Sdk="Microsoft.NET.Sdk">
+                  <PropertyGroup>
+                    <TargetFramework>net9.0</TargetFramework>
+                  </PropertyGroup>
+                  <ItemGroup>
+                    <PackageReference Include="Some.Package" Version="1.0.0" />
+                  </ItemGroup>
+                </Project>
+                """),
+            ("src/library/packages.lock.json", "{}")
+        );
+        var repoContentsPath = tempDirectory.DirectoryPath;
+        await UpdateWorkerTestBase.MockNuGetPackagesInDirectory([
+            MockNuGetPackage.CreateSimplePackage("Some.Package", "1.0.0", "net9.0", [(null, [("Transitive.Package", "2.0.0")])]),
+            MockNuGetPackage.CreateSimplePackage("Transitive.Package", "2.0.0", "net9.0"),
+            MockNuGetPackage.CreateSimplePackage("Transitive.Package", "2.1.0", "net9.0"),
+        ], repoContentsPath);
+        var jobId = "TEST-JOB-ID";
+        var experimentsManager = new ExperimentsManager();
+        var logger = new TestLogger();
+        var apiHandler = new TestApiHandler();
+        var discoveryWorker = new DiscoveryWorker(jobId, experimentsManager, logger);
+        var analyzeWorker = new AnalyzeWorker(jobId, experimentsManager, logger);
+        var updaterWorker = new UpdaterWorker(jobId, experimentsManager, logger);
+        var worker = new RunWorker(jobId, apiHandler, discoveryWorker, analyzeWorker, updaterWorker, logger);
+        var job = new Job()
+        {
+            Dependencies = ["Transitive.Package"],
+            SecurityAdvisories = [
+                new()
+                {
+                    DependencyName = "Transitive.Package",
+                    AffectedVersions = [Requirement.Parse("= 2.0.0")],
+                    PatchedVersions = [Requirement.Parse(">= 2.1.0")],
+                }
+            ],
+            SecurityUpdatesOnly = true,
+            Source = new()
+            {
+                Provider = "github",
+                Repo = "test/repo",
+                Directory = "src/client",
+            }
+        };
+
+        // act
+        await worker.RunAsync(job, new DirectoryInfo(repoContentsPath), null, "TEST-COMMIT-SHA", experimentsManager);
+
+        // assert
+        var createPr = (CreatePullRequest)apiHandler.ReceivedMessages.Single(m => m.Type == typeof(CreatePullRequest)).Object;
+        var updatedFiles = createPr.UpdatedDependencyFiles.ToDictionary(df => Path.Join(df.Directory, df.Name).NormalizePathToUnix(), df => df.Content.Replace("\r", ""));
+
+        // original project is unchanged
+        Assert.False(updatedFiles.ContainsKey("/src/client/client.csproj"));
+
+        // transitive project was updated
+        Assert.Equal("""
+            <Project Sdk="Microsoft.NET.Sdk">
+              <PropertyGroup>
+                <TargetFramework>net9.0</TargetFramework>
+              </PropertyGroup>
+              <ItemGroup>
+                <PackageReference Include="Some.Package" Version="1.0.0" />
+                <PackageReference Include="Transitive.Package" Version="2.1.0" />
+              </ItemGroup>
+            </Project>
+            """.Replace("\r", ""), updatedFiles["/src/library/library.csproj"]);
+
+        // client lock file reflects updated transitive dependency
+        var clientLockFileJson = JsonDocument.Parse(updatedFiles["/src/client/packages.lock.json"]);
+        var resolvedInClient = clientLockFileJson.RootElement
+            .GetProperty("dependencies")
+            .GetProperty("net9.0")
+            .GetProperty("Transitive.Package")
+            .GetProperty("resolved")
+            .GetString();
+        Assert.Equal("2.1.0", resolvedInClient);
+
+        // library lock file reflects updated transitive dependency
+        var libraryLockFileJson = JsonDocument.Parse(updatedFiles["/src/library/packages.lock.json"]);
+        var resolvedInLibrary = libraryLockFileJson.RootElement
+            .GetProperty("dependencies")
+            .GetProperty("net9.0")
+            .GetProperty("Transitive.Package")
+            .GetProperty("resolved")
+            .GetString();
+        Assert.Equal("2.1.0", resolvedInLibrary);
+    }
+
     public const string TestPullRequestCommitMessage = "test-pull-request-commit-message";
     public const string TestPullRequestTitle = "test-pull-request-title";
     public const string TestPullRequestBody = "test-pull-request-body";

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/FileWriters/XmlFileWriterTests.cs

@@ -260,6 +260,48 @@ public class XmlFileWriterTests : FileWriterTestsBase
         );
     }
 
+    [Fact]
+    public async Task SingleDependency_CentralPackageManagement_RangeContainsNewVersion()
+    {
+        // in this scenario, a prior pass updated `[1.0.0]` to `[1.1.0]` for a direct dependency and now in a higher
+        // level project we need to ensure the version matches when pinning a transitive dependency
+        await TestAsync(
+            files: [
+                ("project.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <ItemGroup>
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("Directory.Packages.props", """
+                    <Project>
+                      <ItemGroup>
+                        <PackageVersion Include="Some.Dependency" Version="[1.1.0]" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+            ],
+            initialProjectDependencyStrings: ["Some.Dependency/1.0.0"],
+            requiredDependencyStrings: ["Some.Dependency/1.1.0"],
+            expectedFiles: [
+                ("project.csproj", """
+                    <Project Sdk="Microsoft.NET.Sdk">
+                      <ItemGroup>
+                        <PackageReference Include="Some.Dependency" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+                ("Directory.Packages.props", """
+                    <Project>
+                      <ItemGroup>
+                        <PackageVersion Include="Some.Dependency" Version="[1.1.0]" />
+                      </ItemGroup>
+                    </Project>
+                    """),
+            ]
+        );
+    }
+
     [Fact]
     public async Task SingleDependency_SingleFile_AttributeDirectUpdate_ExactMatchVersionRangeFromPropertyValue()
     {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-nuget
 version: !ruby/object:Gem::Version
-  version: 0.359.0
+  version: 0.360.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.359.0
+        version: 0.360.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.359.0
+        version: 0.360.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -553,7 +553,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.359.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.360.0
 rdoc_options: []
 require_paths:
 - lib