dependabot-nuget 0.393.0 → 0.394.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9a1c5805c694589281a1cc0397c9059d82152c07f92a1f92dc5cb8d4784f766
-  data.tar.gz: 7c3111d367c94ce6169ffa1001578477e972565c54d5c0233a4ae562cf72c692
+  metadata.gz: 4f87265e6a1903fa2d9a3ebf527ce5a2011050a3166b4dc38e0e5ed973047ed3
+  data.tar.gz: a34d83e590e6a578617e53ac28407412492c01c62c198f910929246c3af3b405
 SHA512:
-  metadata.gz: 5907f25c11a733215444381da841f4cebcd6090480a303fb8b560eea34ff3e1222cc7164d08bd0dfbd1466dadde76d2ee908170cdb645a3efe1e63c621cd41e9
-  data.tar.gz: 0067f9a4057bf56bf4d64396377565c3ae2a055ac68bc1ff90962877bd015d3b6bea96aab2893dbd00c56fd7cc9b03a2b22d88a4715cfc622f6e6010572467f4
+  metadata.gz: d3d30fb0420935c01ec7fa4d8d08538994cd51bc4c4e4875b717f85ede40bcbec970b0e127bc9d830c6bdc9de8ef3048340d49bc36efcd307c4d2c57a5e82e4c
+  data.tar.gz: 54406d1b180a7da9baf7fd61f9aba249d8eae142eda7404f96c6f9c364184f600d49b3ea61daa756f86f7ad005026560623522003712801a149a176c8863ec4b

data/helpers/lib/NuGetUpdater/Directory.Build.targets

@@ -13,5 +13,6 @@
     <PackageReference Include="Microsoft.Build" ExcludeAssets="runtime" PrivateAssets="all" />
     <PackageReference Include="Microsoft.Build.Framework" ExcludeAssets="runtime" PrivateAssets="all" />
     <PackageReference Include="Microsoft.Build.Utilities.Core" ExcludeAssets="runtime" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.NET.StringTools" ExcludeAssets="runtime" PrivateAssets="all" />
   </ItemGroup>
 </Project>

data/helpers/lib/NuGetUpdater/Directory.Packages.props

@@ -3,38 +3,40 @@
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
   </PropertyGroup>
   <PropertyGroup>
-    <MSBuildPackageVersion>18.3.3</MSBuildPackageVersion>
+    <!-- Match the MSBuild assemblies supplied by the SDK selected in global.json. -->
+    <MSBuildPackageVersion>18.9.6</MSBuildPackageVersion>
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="DiffPlex" Version="1.9.0" />
-    <PackageVersion Include="GuiLabs.Language.Xml" Version="1.2.93" />
-    <PackageVersion Include="Microsoft.Build.Locator" Version="1.9.1" />
+    <PackageVersion Include="GuiLabs.Language.Xml" Version="1.2.120" />
+    <PackageVersion Include="Microsoft.Build.Locator" Version="1.11.2" />
     <PackageVersion Include="Microsoft.Build" Version="$(MSBuildPackageVersion)" />
     <PackageVersion Include="Microsoft.Build.Framework" Version="$(MSBuildPackageVersion)" />
     <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="$(MSBuildPackageVersion)" />
     <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="$(MSBuildPackageVersion)" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.0.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
     <PackageVersion Include="Microsoft.CSharp" Version="4.7.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Abstractions" Version="10.0.3" />
-    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="10.0.3" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.3" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Abstractions" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.FileSystemGlobbing" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.NET.StringTools" Version="$(MSBuildPackageVersion)" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
     <PackageVersion Include="Microsoft.VisualStudio.Setup.Configuration.Interop" Version="3.14.2075" />
     <PackageVersion Include="Microsoft.VisualStudio.SolutionPersistence" Version="1.0.52" />
-    <PackageVersion Include="Microsoft.Web.Xdt" Version="3.2.3" />
-    <PackageVersion Include="MSBuild.StructuredLogger" Version="2.3.17" />
+    <PackageVersion Include="Microsoft.Web.Xdt" Version="3.2.11" />
+    <PackageVersion Include="MSBuild.StructuredLogger" Version="2.3.246" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
-    <PackageVersion Include="OpenTelemetry" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry" Version="1.18.0" />
     <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.15.3" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
-    <PackageVersion Include="packageurl-dotnet" Version="2.0.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
+    <PackageVersion Include="packageurl-dotnet" Version="2.0.1" />
     <PackageVersion Include="Semver" Version="3.0.0" />
     <PackageVersion Include="System.CommandLine" Version="2.0.3" />
     <PackageVersion Include="System.ComponentModel.Composition" Version="10.0.3" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <PackageVersion Include="System.Formats.Asn1" Version="10.0.3" />
-    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.3" />
-    <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.11" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.10" />
+    <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="10.0.8" />
     <PackageVersion Include="System.Text.Json" Version="10.0.3" />
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
     <PackageVersion Include="System.Threading.Tasks.Dataflow" Version="10.0.3" />

data/helpers/lib/NuGetUpdater/NuGetProjects/Directory.Build.props

@@ -11,7 +11,15 @@
     <SharedDirectory>$(NuGetSourceLocation)\build\Shared</SharedDirectory>
     <NoWarn>$(NoWarn);CA1416</NoWarn><!-- platform compatibility in vendored NuGet.Client code -->
     <NoWarn>$(NoWarn);CS0436</NoWarn><!-- type conflicts with imported types in vendored NuGet.Client code -->
-    <Version>6.8.0</Version>
+    <!--
+      These assemblies share the default load context with the copies bundled in the selected .NET SDK.
+      Keep this version aligned with both NuGet.Client/build/config.props and the SDK in ../global.json.
+    -->
+    <Version>7.9.0</Version>
+    <SignAssembly>true</SignAssembly>
+    <PublicSign>true</PublicSign>
+    <!-- NuGet.Core assemblies use Microsoft's public key, as do the copies bundled with the SDK. -->
+    <AssemblyOriginatorKeyFile>$(NuGetSourceLocation)\keys\35MSSharedLib1024.snk</AssemblyOriginatorKeyFile>
   </PropertyGroup>
 
   <Import Project="..\Directory.Common.props" />

data/helpers/lib/NuGetUpdater/NuGetProjects/Directory.Build.targets

@@ -1,7 +1,63 @@
 <Project>
 
   <ItemGroup>
-    <Compile Include="$(SharedDirectory)\*.cs" Exclude="bin\**;obj\**;**\*.xproj;packages\**" />
+    <!-- NuGetFeatureFlags depends on NuGet.Common and is included only by projects that use it upstream. -->
+    <Compile Include="$(SharedDirectory)\*.cs"
+             Exclude="bin\**;obj\**;**\*.xproj;packages\**;$(SharedDirectory)\NuGetFeatureFlags.cs" />
   </ItemGroup>
 
+  <!--
+    MSBuild and the updater load NuGet assemblies into the same process. Fail the build before a
+    mismatched assembly identity can become a runtime FileNotFoundException.
+  -->
+  <Target Name="ValidateNuGetAssemblyVersion"
+          BeforeTargets="CoreCompile"
+          Condition="'$(MSBuildProjectName)' == 'NuGet.Frameworks'">
+    <XmlPeek XmlInputPath="$(NuGetSourceLocation)\build\config.props"
+             Query="/Project/PropertyGroup/MajorNuGetVersion/text()">
+      <Output TaskParameter="Result" PropertyName="_VendoredNuGetMajorVersion" />
+    </XmlPeek>
+    <XmlPeek XmlInputPath="$(NuGetSourceLocation)\build\config.props"
+             Query="/Project/PropertyGroup/MinorNuGetVersion/text()">
+      <Output TaskParameter="Result" PropertyName="_VendoredNuGetMinorVersion" />
+    </XmlPeek>
+    <XmlPeek XmlInputPath="$(NuGetSourceLocation)\build\config.props"
+             Query="/Project/PropertyGroup/PatchNuGetVersion/text()">
+      <Output TaskParameter="Result" PropertyName="_VendoredNuGetPatchVersion" />
+    </XmlPeek>
+
+    <PropertyGroup>
+      <_VendoredNuGetVersion>$(_VendoredNuGetMajorVersion).$(_VendoredNuGetMinorVersion).$(_VendoredNuGetPatchVersion)</_VendoredNuGetVersion>
+      <_SdkNuGetFrameworksPath>$(MSBuildSDKsPath)\..\NuGet.Frameworks.dll</_SdkNuGetFrameworksPath>
+    </PropertyGroup>
+
+    <Error Condition="'$(_VendoredNuGetVersion)' != '$(Version)'"
+           Text="The NuGetProjects version ($(Version)) must match the vendored NuGet.Client version ($(_VendoredNuGetVersion)). Update the submodule and Directory.Build.props together." />
+    <Error Condition="!Exists('$(_SdkNuGetFrameworksPath)')"
+           Text="NuGet.Frameworks.dll was not found beside the selected SDK at '$(_SdkNuGetFrameworksPath)'." />
+
+    <GetAssemblyIdentity AssemblyFiles="$(_SdkNuGetFrameworksPath)"
+                         Condition="Exists('$(_SdkNuGetFrameworksPath)')">
+      <Output TaskParameter="Assemblies" ItemName="_SdkNuGetFrameworksAssembly" />
+    </GetAssemblyIdentity>
+
+    <Error Condition="'%(_SdkNuGetFrameworksAssembly.Version)' != '$(Version).0'"
+           Text="The selected SDK contains NuGet.Frameworks version %(_SdkNuGetFrameworksAssembly.Version), but NuGetProjects builds version $(Version).0. Keep global.json, the NuGet.Client submodule, and Directory.Build.props aligned." />
+  </Target>
+
+  <Target Name="ValidateNuGetAssemblyIdentity"
+          AfterTargets="CopyFilesToOutputDirectory"
+          DependsOnTargets="ValidateNuGetAssemblyVersion"
+          Condition="'$(MSBuildProjectName)' == 'NuGet.Frameworks'">
+    <GetAssemblyIdentity AssemblyFiles="$(TargetPath)">
+      <Output TaskParameter="Assemblies" ItemName="_BuiltNuGetFrameworksAssembly" />
+    </GetAssemblyIdentity>
+    <GetAssemblyIdentity AssemblyFiles="$(_SdkNuGetFrameworksPath)">
+      <Output TaskParameter="Assemblies" ItemName="_SdkNuGetFrameworksAssemblyForIdentity" />
+    </GetAssemblyIdentity>
+
+    <Error Condition="'@(_BuiltNuGetFrameworksAssembly)' != '@(_SdkNuGetFrameworksAssemblyForIdentity)'"
+           Text="The built NuGet.Frameworks identity '@(_BuiltNuGetFrameworksAssembly)' must match the selected SDK copy '@(_SdkNuGetFrameworksAssemblyForIdentity)'." />
+  </Target>
+
 </Project>

data/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.CommandLine/Commands/ProjectFactory.cs

@@ -38,6 +38,9 @@ namespace NuGet.CommandLine
 
         private IEnvironmentVariableReader _environmentVariableReader;
 
+        private bool _deterministic;
+        private string _deterministicTimestamp;
+
         // Files we want to always exclude from the resulting package
         private static readonly HashSet<string> ExcludeFiles = new HashSet<string>(StringComparer.OrdinalIgnoreCase) {
             NuGetConstants.PackageReferenceFile,
@@ -71,6 +74,8 @@ namespace NuGet.CommandLine
         {
             return new ProjectFactory(packArgs.MsBuildDirectory.Value, path, packArgs.Properties)
             {
+                _deterministic = packArgs.Deterministic,
+                _deterministicTimestamp = packArgs.DeterministicTimestamp,
                 IsTool = packArgs.Tool,
                 LogLevel = packArgs.LogLevel,
                 Logger = packArgs.Logger,
@@ -234,7 +239,10 @@ namespace NuGet.CommandLine
                 }
             }
 
-            builder = new PackageBuilder(false, Logger);
+            builder = new PackageBuilder(_deterministic, Logger)
+            {
+                DeterministicTimestamp = _deterministicTimestamp,
+            };
 
             try
             {

data/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.CommandLine/Commands/UpdateCommand.cs

@@ -84,7 +84,12 @@ namespace NuGet.CommandLine
                 throw new CommandException(NuGetResources.InvalidFile);
             }
 
-            _msbuildDirectory = MsBuildUtility.GetMsBuildDirectoryFromMsBuildPath(MSBuildPath, MSBuildVersion, Console).Value.Path;
+            // Upstream rejects SDK MSBuild paths because standalone NuGet.exe runs on .NET Framework and cannot load
+            // .NET SDK assemblies. Dependabot embeds this command in .NET and pre-registers the matching SDK with
+            // MSBuildLocator, so the supplied SDK path is both supported and required on Linux.
+            _msbuildDirectory = string.IsNullOrEmpty(MSBuildPath)
+                ? MsBuildUtility.GetMsBuildDirectoryFromMsBuildPath(MSBuildPath, MSBuildVersion, Console).Value.Path
+                : MSBuildPath;
             var context = new UpdateConsoleProjectContext(Console, FileConflictAction);
 
             var logger = new LoggerAdapter(context);

data/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.Packaging/PackageFolderReader.cs

@@ -237,7 +237,7 @@ namespace NuGet.Packaging
             // do nothing here
         }
 
-        public override Task<PrimarySignature> GetPrimarySignatureAsync(CancellationToken token)
+        public override Task<PrimarySignature?> GetPrimarySignatureAsync(CancellationToken token)
         {
             return TaskResult.Null<PrimarySignature>();
         }
@@ -262,7 +262,7 @@ namespace NuGet.Packaging
             return false;
         }
 
-        public override string GetContentHash(CancellationToken token, Func<string> GetUnsignedPackageHash = null)
+        public override string GetContentHash(CancellationToken token, Func<string>? GetUnsignedPackageHash = null)
         {
             throw new NotImplementedException();
         }

data/helpers/lib/NuGetUpdater/NuGetProjects/NuGet.Protocol/NuGet.Protocol.csproj

@@ -12,6 +12,7 @@
 
   <ItemGroup>
     <Compile Include="$(NuGetSourceLocation)\src\NuGet.Core\NuGet.Protocol\**\*.cs" />
+    <Compile Include="$(SharedDirectory)\NuGetFeatureFlags.cs" />
   </ItemGroup>
 
   <ItemGroup>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Cli.Test/EntryPointTestHelper.cs

@@ -41,6 +41,8 @@ internal static class EntryPointTestHelper
         // save packages
         await UpdateWorkerTestBase.MockNuGetPackagesInDirectory(packages, tempDirectory.DirectoryPath);
 
+        await GitTestHelper.InitializeRepositoryAsync(tempDirectory.DirectoryPath, files.Select(file => file.Path));
+
         var actualUrls = new List<string>();
         using var http = TestHttpServer.CreateTestStringServer((method, url) =>
         {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/NuGetContext.cs

@@ -20,8 +20,12 @@ internal record NuGetContext : IDisposable
     public IMachineWideSettings MachineWideSettings { get; }
     public ImmutableArray<PackageSource> PackageSources { get; }
     public NuGet.Common.ILogger Logger { get; }
+    private readonly Func<PackageSource, SourceRepository> _sourceRepositoryFactory;
 
-    public NuGetContext(string? currentDirectory = null, NuGet.Common.ILogger? logger = null)
+    public NuGetContext(
+        string? currentDirectory = null,
+        NuGet.Common.ILogger? logger = null,
+        Func<PackageSource, SourceRepository>? sourceRepositoryFactory = null)
     {
         SourceCacheContext = new SourceCacheContext();
         PackageDownloadContext = new PackageDownloadContext(SourceCacheContext);
@@ -36,6 +40,7 @@ internal record NuGetContext : IDisposable
             .Where(p => p.IsEnabled)
             .ToImmutableArray();
         Logger = logger ?? NullLogger.Instance;
+        _sourceRepositoryFactory = sourceRepositoryFactory ?? Repository.Factory.GetCoreV3;
     }
 
     public void Dispose()
@@ -83,7 +88,7 @@ internal record NuGetContext : IDisposable
         foreach (var source in sources)
         {
             message.AppendLine($"  checking {source.Name}");
-            var sourceRepository = Repository.Factory.GetCoreV3(source);
+            var sourceRepository = _sourceRepositoryFactory(source);
             var feed = await sourceRepository.GetResourceAsync<MetadataResource>(cancellationToken);
             if (feed is null)
             {
@@ -118,21 +123,24 @@ internal record NuGetContext : IDisposable
             }
 
             var downloadResource = await sourceRepository.GetResourceAsync<DownloadResource>(cancellationToken);
-            using var downloadResult = await downloadResource.GetDownloadResourceResultAsync(packageIdentity, PackageDownloadContext, globalPackagesFolder, Logger, cancellationToken);
-            if (downloadResult.Status == DownloadResourceResultStatus.Available)
+            if (downloadResource is not null)
             {
-                var repositoryMetadata = downloadResult.PackageReader.NuspecReader.GetRepositoryMetadata();
-                message.AppendLine($"    repometadata: type=[{repositoryMetadata.Type}], url=[{repositoryMetadata.Url}], branch=[{repositoryMetadata.Branch}], commit=[{repositoryMetadata.Commit}]");
-                if (!string.IsNullOrEmpty(repositoryMetadata.Url))
+                using var downloadResult = await downloadResource.GetDownloadResourceResultAsync(packageIdentity, PackageDownloadContext, globalPackagesFolder, Logger, cancellationToken);
+                if (downloadResult.Status == DownloadResourceResultStatus.Available &&
+                    downloadResult.PackageReader is not null)
                 {
-                    return repositoryMetadata.Url;
+                    var repositoryMetadata = downloadResult.PackageReader.NuspecReader.GetRepositoryMetadata();
+                    message.AppendLine($"    repometadata: type=[{repositoryMetadata.Type}], url=[{repositoryMetadata.Url}], branch=[{repositoryMetadata.Branch}], commit=[{repositoryMetadata.Commit}]");
+                    if (!string.IsNullOrEmpty(repositoryMetadata.Url))
+                    {
+                        return repositoryMetadata.Url;
+                    }
+                }
+                else
+                {
+                    message.AppendLine($"    download result status: {downloadResult.Status}");
                 }
             }
-            else
-            {
-                message.AppendLine($"    download result status: {downloadResult.Status}");
-            }
-
             var metadataResource = await sourceRepository.GetResourceAsync<PackageMetadataResource>(cancellationToken);
             if (metadataResource is not null)
             {

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/PackagesConfigBuildFile.cs

@@ -20,7 +20,9 @@ internal sealed class PackagesConfigBuildFile : XmlBuildFile
         }
     }
 
-    public IEnumerable<IXmlElementSyntax> Packages => Contents.RootSyntax.GetElements("package", StringComparison.OrdinalIgnoreCase);
+    public IEnumerable<IXmlElementSyntax> Packages => (Contents.RootSyntax
+        ?? throw new UnparseableFileException("packages.config does not contain a root element", Path))
+        .GetElements("package", StringComparison.OrdinalIgnoreCase);
 
     public IEnumerable<Dependency> GetDependencies() => Packages
         .Select(p => new Dependency(

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/ProjectBuildFile.cs

@@ -17,7 +17,8 @@ internal sealed class ProjectBuildFile : XmlBuildFile
 
     public static XmlDocumentSyntax Parse(string contents) => Parser.ParseText(contents);
 
-    public IXmlElementSyntax ProjectNode => Contents.RootSyntax;
+    public IXmlElementSyntax ProjectNode => Contents.RootSyntax
+        ?? throw new UnparseableFileException("Project file does not contain a root element", Path);
 
     public IEnumerable<IXmlElementSyntax> SdkNodes => ProjectNode
         .GetElements("Sdk", StringComparison.OrdinalIgnoreCase);
@@ -142,7 +143,9 @@ internal sealed class ProjectBuildFile : XmlBuildFile
         .Where(e =>
             e.Name.Equals("ProjectReference", StringComparison.OrdinalIgnoreCase) ||
             e.Name.Equals("ProjectFile", StringComparison.OrdinalIgnoreCase))
-        .Select(e => PathHelper.GetFullPathFromRelative(System.IO.Path.GetDirectoryName(Path)!, e.GetAttribute("Include").Value));
+        .Select(e => e.GetAttributeValueCaseInsensitive("Include")
+            ?? throw new UnparseableFileException($"`{e.Name}` element missing `Include` attribute", Path))
+        .Select(include => PathHelper.GetFullPathFromRelative(System.IO.Path.GetDirectoryName(Path)!, include));
 
     public void NormalizeDirectorySeparatorsInProject()
     {
@@ -169,11 +172,13 @@ internal sealed class ProjectBuildFile : XmlBuildFile
         updatedXml = Contents.ReplaceNodes(errorsWithConditions,
             (_, n) =>
             {
-                var conditionAttr = n.GetAttribute("Condition");
+                var conditionAttr = n.GetAttribute("Condition")
+                    ?? throw new InvalidOperationException("Expected Error element to have a Condition attribute");
                 var newConditionAttr = conditionAttr.WithValue(conditionAttr.Value.Replace("/", "\\"));
                 n = (XmlEmptyElementSyntax)n.ReplaceAttribute(conditionAttr, newConditionAttr).AsNode;
 
-                var textAttr = n.GetAttribute("Text");
+                var textAttr = n.GetAttribute("Text")
+                    ?? throw new InvalidOperationException("Expected Error element to have a Text attribute");
                 var newTextAttr = textAttr.WithValue(textAttr.Value.Replace("/", "\\"));
                 return n.ReplaceAttribute(textAttr, newTextAttr).AsNode;
             });
@@ -191,11 +196,13 @@ internal sealed class ProjectBuildFile : XmlBuildFile
         updatedXml = Contents.ReplaceNodes(importsWithConditions,
             (_, n) =>
             {
-                var projectAttr = n.GetAttribute("Project");
+                var projectAttr = n.GetAttribute("Project")
+                    ?? throw new InvalidOperationException("Expected Import element to have a Project attribute");
                 var newProjectAttr = projectAttr.WithValue(projectAttr.Value.Replace("/", "\\"));
                 n = (XmlEmptyElementSyntax)n.ReplaceAttribute(projectAttr, newProjectAttr).AsNode;
 
-                var conditionAttr = n.GetAttribute("Condition");
+                var conditionAttr = n.GetAttribute("Condition")
+                    ?? throw new InvalidOperationException("Expected Import element to have a Condition attribute");
                 var newConditionAttr = conditionAttr.WithValue(conditionAttr.Value.Replace("/", "\\"));
                 return n.ReplaceAttribute(conditionAttr, newConditionAttr).AsNode;
             });

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/CreatePullRequest.cs

@@ -8,7 +8,7 @@ namespace NuGetUpdater.Core.Run.ApiModel;
 
 public sealed record CreatePullRequest : MessageBase
 {
-    public required ReportedDependency[] Dependencies { get; init; }
+    public required ReportedDependencyWithDirectory[] Dependencies { get; init; }
 
     [JsonPropertyName("updated-dependency-files")]
     public required DependencyFile[] UpdatedDependencyFiles { get; init; }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/Job.cs

@@ -102,25 +102,34 @@ public sealed record Job
         return existingPullRequests;
     }
 
-    public Tuple<string?, ImmutableArray<PullRequestDependency>>? GetExistingPullRequestForDependencies(IEnumerable<Dependency> dependencies, bool considerVersions)
+    public Tuple<string?, ImmutableArray<PullRequestDependency>>? GetExistingPullRequestForDependencies(IEnumerable<ReportedDependencyWithDirectory> dependencies, bool considerVersions)
     {
-        if (dependencies.Any(d => d.Version is null))
+        var desiredDependencies = dependencies.ToArray();
+        if (desiredDependencies.Any(d => d.Version is null))
         {
             return null;
         }
 
-        string CreateIdentifier(string dependencyName, string dependencyVersion)
+        bool NamesAndVersionsMatch(ReportedDependencyWithDirectory desiredDependency, PullRequestDependency existingDependency)
         {
-            return $"{dependencyName}/{(considerVersions ? dependencyVersion : null)}";
+            return desiredDependency.Name.Equals(existingDependency.DependencyName, StringComparison.OrdinalIgnoreCase) &&
+                (!considerVersions ||
+                    desiredDependency.Version!.Equals(existingDependency.DependencyVersion.ToString(), StringComparison.OrdinalIgnoreCase));
+        }
+
+        bool DependenciesMatch(ReportedDependencyWithDirectory desiredDependency, PullRequestDependency existingDependency)
+        {
+            return NamesAndVersionsMatch(desiredDependency, existingDependency) &&
+                (existingDependency.Directory is null ||
+                    desiredDependency.Directory.Equals(existingDependency.Directory, StringComparison.Ordinal));
         }
 
-        var desiredDependencySet = dependencies.Select(d => CreateIdentifier(d.Name, d.Version!)).ToHashSet(StringComparer.OrdinalIgnoreCase);
         var existingPullRequests = GetAllExistingPullRequests();
         var existingPullRequest = existingPullRequests
             .FirstOrDefault(pr =>
             {
-                var prDependencySet = pr.Item2.Select(d => CreateIdentifier(d.DependencyName, d.DependencyVersion.ToString())).ToHashSet(StringComparer.OrdinalIgnoreCase);
-                return prDependencySet.SetEquals(desiredDependencySet);
+                return desiredDependencies.All(desired => pr.Item2.Any(existing => DependenciesMatch(desired, existing))) &&
+                    pr.Item2.All(existing => desiredDependencies.Any(desired => DependenciesMatch(desired, existing)));
             });
         return existingPullRequest;
     }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/ReportedDependency.cs

@@ -2,7 +2,7 @@ using System.Text.Json.Serialization;
 
 namespace NuGetUpdater.Core.Run.ApiModel;
 
-public sealed record ReportedDependency
+public record ReportedDependency
 {
     public required string Name { get; init; }
     public required string? Version { get; init; }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/ApiModel/ReportedDependencyWithDirectory.cs

@@ -0,0 +1,19 @@
+namespace NuGetUpdater.Core.Run.ApiModel;
+
+public sealed record ReportedDependencyWithDirectory : ReportedDependency
+{
+    public required string Directory { get; init; }
+
+    public static ReportedDependencyWithDirectory From(ReportedDependency dependency, string directory)
+    {
+        return new ReportedDependencyWithDirectory()
+        {
+            Name = dependency.Name,
+            Version = dependency.Version,
+            Requirements = dependency.Requirements,
+            PreviousVersion = dependency.PreviousVersion,
+            PreviousRequirements = dependency.PreviousRequirements,
+            Directory = directory,
+        };
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/GitEOLMetadataProvider.cs

@@ -0,0 +1,64 @@
+using static NuGetUpdater.Core.Utilities.EOLHandling;
+
+namespace NuGetUpdater.Core.Run;
+
+internal sealed class GitEOLMetadataProvider : IEOLMetadataProvider
+{
+    public async Task<Dictionary<string, EOLType>> GetIndexEOLsAsync(
+        DirectoryInfo repoContentsPath,
+        IReadOnlyCollection<string> repoRelativePaths)
+    {
+        if (repoRelativePaths.Count == 0)
+        {
+            return new Dictionary<string, EOLType>(StringComparer.Ordinal);
+        }
+
+        var arguments = new List<string>
+        {
+            "--literal-pathspecs",
+            "ls-files",
+            "--eol",
+            "-z",
+            "--",
+        };
+        arguments.AddRange(repoRelativePaths);
+
+        var (exitCode, stdout, stderr) = await ProcessEx.RunAsync("git", arguments, repoContentsPath.FullName);
+        if (exitCode != 0)
+        {
+            throw new InvalidOperationException($"Unable to determine Git index line endings:\n{stderr}");
+        }
+
+        return ParseOutput(stdout);
+    }
+
+    internal static Dictionary<string, EOLType> ParseOutput(string output)
+    {
+        var result = new Dictionary<string, EOLType>(StringComparer.Ordinal);
+        foreach (var record in output.Split('\0', StringSplitOptions.RemoveEmptyEntries))
+        {
+            var separatorIndex = record.IndexOf('\t');
+            if (separatorIndex < 0)
+            {
+                continue;
+            }
+
+            var metadata = record[..separatorIndex];
+            var path = record[(separatorIndex + 1)..].NormalizePathToUnix();
+            var indexMetadata = metadata.Split(' ', StringSplitOptions.RemoveEmptyEntries).FirstOrDefault();
+            var eol = indexMetadata switch
+            {
+                "i/lf" => EOLType.LF,
+                "i/crlf" => EOLType.CRLF,
+                _ => (EOLType?)null,
+            };
+
+            if (eol is not null)
+            {
+                result[path] = eol.Value;
+            }
+        }
+
+        return result;
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Run/IEOLMetadataProvider.cs

@@ -0,0 +1,10 @@
+using static NuGetUpdater.Core.Utilities.EOLHandling;
+
+namespace NuGetUpdater.Core.Run;
+
+internal interface IEOLMetadataProvider
+{
+    Task<Dictionary<string, EOLType>> GetIndexEOLsAsync(
+        DirectoryInfo repoContentsPath,
+        IReadOnlyCollection<string> repoRelativePaths);
+}