dependabot-nuget 0.383.0 → 0.384.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9faecb2b58ddfb0ef2f7199364aaf92d894dc30cb222b649688278f03ad7db23
-  data.tar.gz: a41a8ebdd8d8301739d30b922971bd3492be935aec49c6fe09a2f1d97deb6b98
+  metadata.gz: b77dedc63031536f0a500698857e46afbc14f3f5ea80a0e8300a52e27d4d3d46
+  data.tar.gz: 5794be271db14c64c9d3e72adb259bbd52e78fa79ed796943595598395fe3ed6
 SHA512:
-  metadata.gz: d792e017824a47f5e0ff713b8ced7b76ae459c833d815139ccc98bb45ab97b3f4af96f77b035536a3c28237ac26afad0c6d9a3103897651d7ed9070898dc788f
-  data.tar.gz: 899acdbff1b55fda3bd97c2b1591c282dcd659b872ce46ef8901b69430bb74e1188c2fb4211e1b6dc402918fe5e497048eaa17442fa553f753a678f5fec5f593
+  metadata.gz: bf66e0d54541539ac5fe228db99426b8f15b8a7e7253e2a62b61d25cee3ddf6a86c9ce1a51a2206f01b4ba3559ed69191bcf8ca7e81eb9b71950576c79002b5b
+  data.tar.gz: 5227b2387092e94a359eff0c3a0f08608d6a559b007b59caeb6c9016ff760712c6ab684dbc455ced2211835000ed2d8a2fc3b4f53f4638828d1ee01b705c66a0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Clone/CloneWorker.cs

@@ -34,7 +34,7 @@ public class CloneWorker
         JobErrorBase? parseError = null;
         try
         {
-            jobFile = RunWorker.Deserialize(jobFileContent);
+            jobFile = RunWorker.Deserialize(jobFileContent, _logger);
             if (jobFile is null)
             {
                 parseError = new UnknownError(new Exception("Job file could not be deserialized"), _jobId);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DiscoveryWorker.cs

@@ -88,10 +88,20 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         ImmutableArray<ProjectDiscoveryResult> projectResults = [];
         WorkspaceDiscoveryResult result;
 
+        // if the workspace directory directly contains a solution file, capture its directory so that the MSBuild
+        // `SolutionDir` property can be faked during discovery; this allows project files that reference
+        // `$(SolutionDir)` to be evaluated correctly
+        string? solutionDir = null;
+
         if (Directory.Exists(workspacePath))
         {
             _logger.Info($"Discovering build files in workspace [{workspacePath}].");
 
+            if (DirectoryContainsSolutionFile(workspacePath))
+            {
+                solutionDir = workspacePath;
+            }
+
             dotNetToolsJsonDiscovery = DotNetToolsJsonDiscovery.Discover(repoRootPath, workspacePath, _logger);
             globalJsonDiscovery = GlobalJsonDiscovery.Discover(repoRootPath, workspacePath, _logger);
 
@@ -101,7 +111,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
             }
 
             // this next line should throw or something
-            projectResults = await RunForDirectoryAsync(repoRootPath, workspacePath);
+            projectResults = await RunForDirectoryAsync(repoRootPath, workspacePath, solutionDir);
         }
         else
         {
@@ -149,6 +159,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                 DotNetToolsJson = null,
                 GlobalJson = null,
                 Projects = projectResults.Where(p => p.IsSuccess).OrderBy(p => p.FilePath).ToImmutableArray(),
+                SolutionDirectory = GetRelativeSolutionDirectory(repoRootPath, solutionDir),
                 Error = failedProjectResult.Error,
                 IsSuccess = false,
             };
@@ -162,6 +173,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
             DotNetToolsJson = dotNetToolsJsonDiscovery,
             GlobalJson = globalJsonDiscovery,
             Projects = projectResults.OrderBy(p => p.FilePath).ToImmutableArray(),
+            SolutionDirectory = GetRelativeSolutionDirectory(repoRootPath, solutionDir),
         };
 
         _logger.Info("Discovery complete.");
@@ -196,7 +208,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         return await NuGetHelper.DownloadNuGetPackagesAsync(repoRootPath, workspacePath, msbuildSdks, logger);
     }
 
-    private async Task<ImmutableArray<ProjectDiscoveryResult>> RunForDirectoryAsync(string repoRootPath, string workspacePath)
+    private async Task<ImmutableArray<ProjectDiscoveryResult>> RunForDirectoryAsync(string repoRootPath, string workspacePath, string? solutionDir)
     {
         _logger.Info($"  Discovering projects beneath [{Path.GetRelativePath(repoRootPath, workspacePath)}].");
         var entryPoints = FindEntryPoints(workspacePath);
@@ -227,7 +239,24 @@ public partial class DiscoveryWorker : IDiscoveryWorker
             return [];
         }
 
-        return await RunForProjectPathsAsync(repoRootPath, workspacePath, projects);
+        return await RunForProjectPathsAsync(repoRootPath, workspacePath, projects, solutionDir);
+    }
+
+    private static bool DirectoryContainsSolutionFile(string directoryPath)
+    {
+        return Directory.EnumerateFiles(directoryPath)
+            .Any(path =>
+            {
+                string extension = Path.GetExtension(path).ToLowerInvariant();
+                return extension is ".sln" or ".slnx";
+            });
+    }
+
+    private static string? GetRelativeSolutionDirectory(string repoRootPath, string? solutionDir)
+    {
+        return solutionDir is null
+            ? null
+            : Path.GetRelativePath(repoRootPath, solutionDir).NormalizePathToUnix();
     }
 
     private static ImmutableArray<string> FindEntryPoints(string workspacePath)
@@ -378,7 +407,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         return foundItems;
     }
 
-    private async Task<ImmutableArray<ProjectDiscoveryResult>> RunForProjectPathsAsync(string repoRootPath, string workspacePath, IEnumerable<string> projectPaths)
+    private async Task<ImmutableArray<ProjectDiscoveryResult>> RunForProjectPathsAsync(string repoRootPath, string workspacePath, IEnumerable<string> projectPaths, string? solutionDir)
     {
         var normalizedProjectPaths = projectPaths.SelectMany(p => PathHelper.ResolveCaseInsensitivePathsInsideRepoRoot(p, repoRootPath) ?? []).Distinct().ToImmutableArray();
 
@@ -437,7 +466,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                 _processedProjectPaths.Add(projectPath);
 
                 var relativeProjectPath = Path.GetRelativePath(workspacePath, projectPath).NormalizePathToUnix();
-                var projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, projectPath, _experimentsManager, _logger);
+                var projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, projectPath, _experimentsManager, solutionDir, _logger);
 
                 // Determine if there were unrestored MSBuildSdks
                 var msbuildSdks = projectResults.SelectMany(p => p.Dependencies.Where(d => d.Type == DependencyType.MSBuildSdk)).ToImmutableArray();
@@ -446,7 +475,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                     // If new SDKs were restored, then we need to rerun SdkProjectDiscovery.
                     if (await TryRestoreMSBuildSdksAsync(repoRootPath, workspacePath, msbuildSdks, _logger))
                     {
-                        projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, projectPath, _experimentsManager, _logger);
+                        projectResults = await SdkProjectDiscovery.DiscoverAsync(repoRootPath, workspacePath, projectPath, _experimentsManager, solutionDir, _logger);
                     }
                 }
 

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -71,7 +71,7 @@ internal static class SdkProjectDiscovery
     // this seems to be the maximum number of TFMs that can be restored in parallel without running into race conditions
     private const int MaximumParallelTargetFrameworkRestores = 2;
 
-    public static async Task<ImmutableArray<ProjectDiscoveryResult>> DiscoverAsync(string repoRootPath, string workspacePath, string startingProjectPath, ExperimentsManager experimentsManager, ILogger logger)
+    public static async Task<ImmutableArray<ProjectDiscoveryResult>> DiscoverAsync(string repoRootPath, string workspacePath, string startingProjectPath, ExperimentsManager experimentsManager, string? solutionDir, ILogger logger)
     {
         var extension = Path.GetExtension(startingProjectPath)?.ToLowerInvariant();
         switch (extension)
@@ -190,6 +190,15 @@ internal static class SdkProjectDiscovery
                     args.Add($"/p:TargetFramework={tfm}");
                 }
 
+                // if the project lives alongside a solution file, fake the MSBuild `SolutionDir` property so that
+                // project files referencing `$(SolutionDir)` can be evaluated correctly; MSBuild expects this value
+                // to end with a directory separator so that `$(SolutionDir)foo` concatenations form valid paths
+                if (solutionDir is not null)
+                {
+                    var normalizedSolutionDir = $"{solutionDir.TrimEnd('/', Path.DirectorySeparatorChar)}/";
+                    args.Add($"/p:SolutionDir={normalizedSolutionDir}");
+                }
+
                 // if using CPM and a project also sets TreatWarningsAsErrors to true, this can cause discovery to fail; explicitly don't allow that
                 args.Add("/p:TreatWarningsAsErrors=false");
                 args.Add("/p:MSBuildTreatWarningsAsErrors=false");
@@ -446,6 +455,7 @@ internal static class SdkProjectDiscovery
                 packagesPerProject,
                 explicitPackageVersionsPerProject,
                 experimentsManager,
+                solutionDir,
                 logger
             );
         }
@@ -809,6 +819,7 @@ internal static class SdkProjectDiscovery
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject,
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> explicitPackageVersionsPerProject,
         ExperimentsManager experimentsManager,
+        string? solutionDir,
         ILogger logger
     )
     {
@@ -831,7 +842,7 @@ internal static class SdkProjectDiscovery
 
             var tempProjectPath = await MSBuildHelper.CreateTempProjectAsync(tempDirectory, repoRootPath, projectPath, targetFrameworks, topLevelDependencies, logger);
             var tempProjectDirectory = Path.GetDirectoryName(tempProjectPath)!;
-            var rediscoveredDependencies = await DiscoverAsync(tempProjectDirectory, tempProjectDirectory, tempProjectPath, experimentsManager, logger);
+            var rediscoveredDependencies = await DiscoverAsync(tempProjectDirectory, tempProjectDirectory, tempProjectPath, experimentsManager, solutionDir, logger);
             var tempProjectFileName = Path.GetFileName(tempProjectPath);
             var rediscoveredDependenciesForThisProject = rediscoveredDependencies.FirstOrDefault(r => PathComparer.Instance.Equals(r.FilePath, tempProjectFileName));
             if (rediscoveredDependenciesForThisProject is null)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/WorkspaceDiscoveryResult.cs

@@ -10,6 +10,10 @@ public sealed record WorkspaceDiscoveryResult : NativeResult
     public GlobalJsonDiscoveryResult? GlobalJson { get; init; }
     public DotNetToolsJsonDiscoveryResult? DotNetToolsJson { get; init; }
 
+    // when the workspace directly contains a solution file, this is the directory that was used to fake the MSBuild
+    // `SolutionDir` property during discovery; it is `null` when no solution file was present
+    public string? SolutionDirectory { get; init; }
+
     public ProjectDiscoveryResult? GetProjectDiscoveryFromPath(string repoPath)
     {
         var projectDiscovery = Projects.FirstOrDefault(p => System.IO.Path.Join(Path, p.FilePath).FullyNormalizedRootedPath().Equals(repoPath, StringComparison.OrdinalIgnoreCase));

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Graph/GraphWorker.cs

@@ -28,7 +28,7 @@ public class GraphWorker : IGraphWorker
     {
         // Deserialize the job file
         var jobFileContent = await File.ReadAllTextAsync(jobFilePath.FullName);
-        var jobWrapper = RunWorker.Deserialize(jobFileContent);
+        var jobWrapper = RunWorker.Deserialize(jobFileContent, _logger);
         var job = jobWrapper.Job;
 
         // Use the case-insensitive repo contents path if provided, otherwise use the original

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/Job.cs

@@ -14,6 +14,9 @@ namespace NuGetUpdater.Core.Run.ApiModel;
 public sealed record Job
 {
     public string PackageManager { get; init; } = "nuget";
+
+    public JobCommand Command { get; init; } = JobCommand.None;
+
     public ImmutableArray<AllowedUpdate> AllowedUpdates { get; init; } = [new AllowedUpdate()];
 
     [JsonConverter(typeof(NullAsBoolConverter))]

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/JobCommand.cs

@@ -0,0 +1,11 @@
+namespace NuGetUpdater.Core.Run.ApiModel;
+
+public enum JobCommand
+{
+    None,
+    Version,
+    Update,
+    Recreate,
+    Security,
+    Graph,
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/JobCommandConverter.cs

@@ -0,0 +1,61 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace NuGetUpdater.Core.Run.ApiModel;
+
+public class JobCommandConverter : JsonConverter<JobCommand>
+{
+    private readonly ILogger _logger;
+
+    public JobCommandConverter(ILogger logger)
+    {
+        _logger = logger;
+    }
+
+    public override JobCommand Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+    {
+        if (reader.TokenType == JsonTokenType.Null)
+        {
+            return JobCommand.None;
+        }
+
+        if (reader.TokenType != JsonTokenType.String)
+        {
+            _logger.Warn($"Unexpected JSON token type for job command: {reader.TokenType}; defaulting to None.");
+            reader.Skip();
+            return JobCommand.None;
+        }
+
+        var value = reader.GetString();
+        return value switch
+        {
+            "" => JobCommand.None,
+            "version" => JobCommand.Version,
+            "update" => JobCommand.Update,
+            "recreate" => JobCommand.Recreate,
+            "security" => JobCommand.Security,
+            "graph" => JobCommand.Graph,
+            _ => LogAndDefault(value),
+        };
+    }
+
+    private JobCommand LogAndDefault(string? value)
+    {
+        _logger.Warn($"Unknown job command value: \"{value}\"; defaulting to None.");
+        return JobCommand.None;
+    }
+
+    public override void Write(Utf8JsonWriter writer, JobCommand value, JsonSerializerOptions options)
+    {
+        var str = value switch
+        {
+            JobCommand.Version => "version",
+            JobCommand.Update => "update",
+            JobCommand.Recreate => "recreate",
+            JobCommand.Security => "security",
+            JobCommand.Graph => "graph",
+            _ => "",
+        };
+        writer.WriteStringValue(str);
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ModifiedFilesTracker.cs

@@ -18,27 +18,56 @@ public class ModifiedFilesTracker
     private readonly Dictionary<string, EOLType> _originalDependencyFileEOFs = [];
     private readonly Dictionary<string, bool> _originalDependencyFileBOMs = [];
     private string[] _nonProjectFiles = [];
-    private readonly HashSet<string> _initiallyExistingLockFiles;
+    private readonly HashSet<string> _initiallyExistingFiles;
+
+    /// <summary>
+    /// The set of file name patterns (case-insensitive) that are allowed to be edited during an update run.
+    /// Files matching these patterns are tracked for pre-existence; any file not present before discovery
+    /// will not be reported as modified.
+    /// </summary>
+    internal static readonly string[] AllowedEditableFilePatterns =
+    [
+        "global.json",
+        "dotnet-tools.json",
+        "*.csproj",
+        "*.fsproj",
+        "*.vbproj",
+        "*.props",
+        "*.targets",
+        "app.config",
+        "web.config",
+        "packages.config",
+        "packages.lock.json",
+    ];
 
     public IReadOnlyDictionary<string, string> OriginalDependencyFileContents => _originalDependencyFileContents;
     //public IReadOnlyDictionary<string, EOLType> OriginalDependencyFileEOFs => _originalDependencyFileEOFs;
     public IReadOnlyDictionary<string, bool> OriginalDependencyFileBOMs => _originalDependencyFileBOMs;
 
-    public ModifiedFilesTracker(DirectoryInfo repoContentsPath, HashSet<string> initiallyExistingLockFiles, ILogger logger)
+    public ModifiedFilesTracker(DirectoryInfo repoContentsPath, HashSet<string> initiallyExistingFiles, ILogger logger)
     {
         RepoContentsPath = repoContentsPath;
-        _initiallyExistingLockFiles = initiallyExistingLockFiles;
+        _initiallyExistingFiles = initiallyExistingFiles;
         _logger = logger;
     }
 
     /// <summary>
-    /// Returns the set of lock file paths (relative to repo root, unix-style) that currently exist on disk.
+    /// Returns the set of editable file paths (relative to repo root, unix-style) that currently exist on disk
+    /// and match the allowed editable file patterns.
     /// </summary>
-    public static HashSet<string> GetExistingLockFiles(DirectoryInfo repoContentsPath)
+    public static HashSet<string> GetInitiallyExistingFiles(DirectoryInfo repoContentsPath)
     {
-        return Directory.EnumerateFiles(repoContentsPath.FullName, ProjectHelper.PackagesLockJsonFileName, SearchOption.AllDirectories)
-            .Select(f => Path.GetRelativePath(repoContentsPath.FullName, f).NormalizePathToUnix())
-            .ToHashSet(StringComparer.OrdinalIgnoreCase);
+        var result = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var file in Directory.EnumerateFiles(repoContentsPath.FullName, "*", SearchOption.AllDirectories))
+        {
+            var fileName = Path.GetFileName(file);
+            if (MatchesAllowedEditablePattern(fileName))
+            {
+                result.Add(Path.GetRelativePath(repoContentsPath.FullName, file).NormalizePathToUnix());
+            }
+        }
+
+        return result;
     }
 
     public async Task StartTrackingAsync(WorkspaceDiscoveryResult discoveryResult)
@@ -65,11 +94,16 @@ public class ModifiedFilesTracker
         foreach (var project in _currentDiscoveryResult.Projects)
         {
             var projectDirectory = Path.GetDirectoryName(project.FilePath);
+            if (IsFileNotInitiallyPresent(Path.Join(_currentDiscoveryResult.Path, project.FilePath).NormalizePathToUnix()))
+            {
+                continue;
+            }
+
             await TrackOriginalContentsAsync(_currentDiscoveryResult.Path, project.FilePath);
             foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
             {
                 var extraFilePath = Path.Join(projectDirectory, extraFile);
-                if (IsLockFileNotInitiallyPresent(Path.Join(_currentDiscoveryResult.Path, extraFilePath).NormalizePathToUnix()))
+                if (IsFileNotInitiallyPresent(Path.Join(_currentDiscoveryResult.Path, extraFilePath).NormalizePathToUnix()))
                 {
                     continue;
                 }
@@ -82,7 +116,9 @@ public class ModifiedFilesTracker
         {
             _currentDiscoveryResult.GlobalJson?.FilePath,
             _currentDiscoveryResult.DotNetToolsJson?.FilePath,
-        }.Where(f => f is not null).Cast<string>().ToArray();
+        }.Where(f => f is not null).Cast<string>()
+         .Where(f => !IsFileNotInitiallyPresent(Path.Join(_currentDiscoveryResult.Path, f).NormalizePathToUnix()))
+         .ToArray();
         foreach (var nonProjectFile in _nonProjectFiles)
         {
             await TrackOriginalContentsAsync(_currentDiscoveryResult.Path, nonProjectFile);
@@ -138,12 +174,17 @@ public class ModifiedFilesTracker
 
         foreach (var project in _currentDiscoveryResult.Projects)
         {
+            if (IsFileNotInitiallyPresent(Path.Join(_currentDiscoveryResult.Path, project.FilePath).NormalizePathToUnix()))
+            {
+                continue;
+            }
+
             await AddUpdatedFileIfDifferentAsync(_currentDiscoveryResult.Path, project.FilePath);
             var projectDirectory = Path.GetDirectoryName(project.FilePath);
             foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
             {
                 var extraFilePath = Path.Join(projectDirectory, extraFile);
-                if (IsLockFileNotInitiallyPresent(Path.Join(_currentDiscoveryResult.Path, extraFilePath).NormalizePathToUnix()))
+                if (IsFileNotInitiallyPresent(Path.Join(_currentDiscoveryResult.Path, extraFilePath).NormalizePathToUnix()))
                 {
                     continue;
                 }
@@ -173,20 +214,46 @@ public class ModifiedFilesTracker
         return correctedRepoFullPath;
     }
 
-    private bool IsLockFileNotInitiallyPresent(string repoRelativePath)
+    private bool IsFileNotInitiallyPresent(string repoRelativePath)
     {
-        return IsLockFileNotInitiallyPresent(repoRelativePath, _initiallyExistingLockFiles);
+        return IsFileNotInitiallyPresent(repoRelativePath, _initiallyExistingFiles);
     }
 
-    public static bool IsLockFileNotInitiallyPresent(string repoRelativePath, HashSet<string> initiallyExistingLockFiles)
+    public static bool IsFileNotInitiallyPresent(string repoRelativePath, HashSet<string> initiallyExistingFiles)
     {
         var normalizedPath = repoRelativePath.NormalizePathToUnix().NormalizeUnixPathParts().TrimStart('/');
-        if (!Path.GetFileName(normalizedPath).Equals(ProjectHelper.PackagesLockJsonFileName, StringComparison.OrdinalIgnoreCase))
+        var fileName = Path.GetFileName(normalizedPath);
+
+        if (!MatchesAllowedEditablePattern(fileName))
         {
             return false;
         }
 
-        return !initiallyExistingLockFiles.Contains(normalizedPath);
+        return !initiallyExistingFiles.Contains(normalizedPath);
+    }
+
+    internal static bool MatchesAllowedEditablePattern(string fileName)
+    {
+        foreach (var pattern in AllowedEditableFilePatterns)
+        {
+            if (pattern.StartsWith("*"))
+            {
+                var extension = pattern[1..]; // e.g., ".csproj"
+                if (fileName.EndsWith(extension, StringComparison.OrdinalIgnoreCase))
+                {
+                    return true;
+                }
+            }
+            else
+            {
+                if (fileName.Equals(pattern, StringComparison.OrdinalIgnoreCase))
+                {
+                    return true;
+                }
+            }
+        }
+
+        return false;
     }
 
     public static ImmutableArray<DependencyFile> MergeUpdatedFileSet(ImmutableArray<DependencyFile> setA, ImmutableArray<DependencyFile> setB)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/RunWorker.cs

@@ -44,7 +44,7 @@ public class RunWorker
     public async Task<int> RunAsync(FileInfo jobFilePath, DirectoryInfo repoContentsPath, DirectoryInfo? caseInsensitiveRepoContentsPath, string baseCommitSha)
     {
         var jobFileContent = await File.ReadAllTextAsync(jobFilePath.FullName);
-        var jobWrapper = Deserialize(jobFileContent);
+        var jobWrapper = Deserialize(jobFileContent, _logger);
         var experimentsManager = ExperimentsManager.GetExperimentsManager(jobWrapper.Job.Experiments);
         var result = await RunAsync(jobWrapper.Job, repoContentsPath, caseInsensitiveRepoContentsPath, baseCommitSha, experimentsManager);
         return result;
@@ -96,6 +96,13 @@ public class RunWorker
 
         try
         {
+            // Register MSBuild up front so that the `Microsoft.Build` assembly is loadable for
+            // the rest of the job.  This is required even on the error-handling path:
+            // `JobErrorBase.ErrorFromException` references `Microsoft.Build` exception types, so
+            // if a failure occurs before MSBuild is registered, JIT-compiling the error handler
+            // would itself throw `FileNotFoundException` for `Microsoft.Build` and mask the real
+            // error.
+            MSBuildHelper.RegisterMSBuild(repoContentsPath.FullName, repoContentsPath.FullName, _logger);
             await PatchNuGetConfigFilesAsync(repoContentsPath);
             var handler = GetUpdateHandler(job);
             _logger.Info($"Starting update job of type {handler.TagName}");
@@ -264,7 +271,7 @@ public class RunWorker
         return relativeResolvedName;
     }
 
-    internal static UpdatedDependencyList GetUpdatedDependencyListFromDiscovery(WorkspaceDiscoveryResult discoveryResult, string repoRoot, ILogger logger, HashSet<string> initiallyExistingLockFiles)
+    internal static UpdatedDependencyList GetUpdatedDependencyListFromDiscovery(WorkspaceDiscoveryResult discoveryResult, string repoRoot, ILogger logger, HashSet<string> initiallyExistingFiles)
     {
         string GetFullRepoPath(string path)
         {
@@ -272,12 +279,17 @@ public class RunWorker
             return Path.Join(discoveryResult.Path, path).FullyNormalizedRootedPath();
         }
 
+        bool IsInitiallyPresent(string filePath)
+        {
+            return !ModifiedFilesTracker.IsFileNotInitiallyPresent(Path.Join(discoveryResult.Path, filePath).NormalizePathToUnix(), initiallyExistingFiles);
+        }
+
         var auxiliaryFiles = new List<string>();
-        if (discoveryResult.GlobalJson is not null)
+        if (discoveryResult.GlobalJson is not null && IsInitiallyPresent(discoveryResult.GlobalJson.FilePath))
         {
             auxiliaryFiles.Add(GetFullRepoPath(discoveryResult.GlobalJson.FilePath));
         }
-        if (discoveryResult.DotNetToolsJson is not null)
+        if (discoveryResult.DotNetToolsJson is not null && IsInitiallyPresent(discoveryResult.DotNetToolsJson.FilePath))
         {
             auxiliaryFiles.Add(GetFullRepoPath(discoveryResult.DotNetToolsJson.FilePath));
         }
@@ -288,7 +300,7 @@ public class RunWorker
             foreach (var extraFile in project.ImportedFiles.Concat(project.AdditionalFiles))
             {
                 var extraFileFullPath = Path.Join(projectDirectory, extraFile);
-                if (ModifiedFilesTracker.IsLockFileNotInitiallyPresent(Path.Join(discoveryResult.Path, extraFileFullPath).NormalizePathToUnix(), initiallyExistingLockFiles))
+                if (!IsInitiallyPresent(extraFileFullPath))
                 {
                     continue;
                 }
@@ -298,28 +310,30 @@ public class RunWorker
             }
         }
 
-        var allDependenciesWithFilePath = discoveryResult.Projects.SelectMany(p =>
-        {
-            return p.Dependencies
-                .Where(d => d.Version is not null)
-                .Select(d =>
-                    (p.FilePath, new ReportedDependency()
-                    {
-                        Name = d.Name,
-                        Requirements = [new ReportedRequirement()
-                            {
-                                File = GetFullRepoPath(p.FilePath),
-                                Requirement = d.Version!,
-                                Groups = ["dependencies"],
-                            }],
-                        Version = d.Version,
-                    }));
-        }).ToList();
+        var allDependenciesWithFilePath = discoveryResult.Projects
+            .Where(p => IsInitiallyPresent(p.FilePath))
+            .SelectMany(p =>
+            {
+                return p.Dependencies
+                    .Where(d => d.Version is not null)
+                    .Select(d =>
+                        (p.FilePath, new ReportedDependency()
+                        {
+                            Name = d.Name,
+                            Requirements = [new ReportedRequirement()
+                                {
+                                    File = GetFullRepoPath(p.FilePath),
+                                    Requirement = d.Version!,
+                                    Groups = ["dependencies"],
+                                }],
+                            Version = d.Version,
+                        }));
+            }).ToList();
 
         var nonProjectDependencySet = new (string?, IEnumerable<Dependency>)[]
         {
-            (discoveryResult.GlobalJson?.FilePath, discoveryResult.GlobalJson?.Dependencies ?? []),
-            (discoveryResult.DotNetToolsJson?.FilePath, discoveryResult.DotNetToolsJson?.Dependencies ?? []),
+            (discoveryResult.GlobalJson is not null && IsInitiallyPresent(discoveryResult.GlobalJson.FilePath) ? discoveryResult.GlobalJson.FilePath : null, discoveryResult.GlobalJson?.Dependencies ?? []),
+            (discoveryResult.DotNetToolsJson is not null && IsInitiallyPresent(discoveryResult.DotNetToolsJson.FilePath) ? discoveryResult.DotNetToolsJson.FilePath : null, discoveryResult.DotNetToolsJson?.Dependencies ?? []),
         };
 
         foreach (var (filePath, dependencies) in nonProjectDependencySet)
@@ -352,6 +366,7 @@ public class RunWorker
             .ToArray();
 
         var dependencyFiles = discoveryResult.Projects
+            .Where(p => IsInitiallyPresent(p.FilePath))
             .Select(p => GetFullRepoPath(p.FilePath))
             .Concat(auxiliaryFiles)
             .Select(p => EnsureCorrectFileCasing(p, repoRoot, logger))
@@ -367,9 +382,12 @@ public class RunWorker
         return updatedDependencyList;
     }
 
-    public static JobFile Deserialize(string json)
+    public static JobFile Deserialize(string json) => Deserialize(json, new ConsoleLogger());
+
+    public static JobFile Deserialize(string json, ILogger logger)
     {
-        var jobFile = JsonSerializer.Deserialize<JobFile>(json, SerializerOptions);
+        var options = GetDeserializerOptions(logger);
+        var jobFile = JsonSerializer.Deserialize<JobFile>(json, options);
         if (jobFile is null)
         {
             throw new InvalidOperationException("Unable to deserialize job wrapper.");
@@ -383,6 +401,13 @@ public class RunWorker
         return jobFile;
     }
 
+    internal static JsonSerializerOptions GetDeserializerOptions(ILogger logger)
+    {
+        var options = new JsonSerializerOptions(SerializerOptions);
+        options.Converters.Insert(0, new JobCommandConverter(logger));
+        return options;
+    }
+
     internal static string AddInsecureConnectionsAttribute(string nugetConfigContents)
     {
         try

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/UpdateHandlers/CreateSecurityUpdatePullRequestHandler.cs

@@ -31,7 +31,7 @@ internal class CreateSecurityUpdatePullRequestHandler : IUpdateHandler
     {
         var repoContentsPath = caseInsensitiveRepoContentsPath ?? originalRepoContentsPath;
         var jobDependencies = job.Dependencies.ToHashSet(StringComparer.OrdinalIgnoreCase);
-        var initialLockFiles = ModifiedFilesTracker.GetExistingLockFiles(repoContentsPath);
+        var initialFiles = ModifiedFilesTracker.GetInitiallyExistingFiles(repoContentsPath);
         foreach (var directory in job.GetAllDirectories(repoContentsPath.FullName))
         {
             var discoveryResult = await discoveryWorker.RunAsync(repoContentsPath.FullName, directory);
@@ -42,7 +42,7 @@ internal class CreateSecurityUpdatePullRequestHandler : IUpdateHandler
                 return;
             }
 
-            var updatedDependencyList = RunWorker.GetUpdatedDependencyListFromDiscovery(discoveryResult, originalRepoContentsPath.FullName, logger, initialLockFiles);
+            var updatedDependencyList = RunWorker.GetUpdatedDependencyListFromDiscovery(discoveryResult, originalRepoContentsPath.FullName, logger, initialFiles);
             await apiHandler.UpdateDependencyList(updatedDependencyList);
             await this.ReportUpdaterStarted(apiHandler);
 
@@ -62,7 +62,7 @@ internal class CreateSecurityUpdatePullRequestHandler : IUpdateHandler
 
             logger.Info($"Updating dependencies: {string.Join(", ", groupedUpdateOperationsToPerform.Select(g => g.Key).Distinct().OrderBy(d => d, StringComparer.OrdinalIgnoreCase))}");
 
-            var tracker = new ModifiedFilesTracker(originalRepoContentsPath, initialLockFiles, logger);
+            var tracker = new ModifiedFilesTracker(originalRepoContentsPath, initialFiles, logger);
             await tracker.StartTrackingAsync(discoveryResult);
             foreach (var dependencyGroupToUpdate in groupedUpdateOperationsToPerform)
             {