@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/ecosystems/parsers-dotnet.js

@@ -41,6 +41,252 @@ export function applyNugetVersion(pkg, version) {
   return applyPurl(pkg, nugetPurl(pkg.name, concrete));
 }
 
+/**
+ * Compare two NuGet versions: up to four numeric release parts (missing parts
+ * read as 0), then the prerelease label, with a release sorting after its own
+ * prereleases. Build metadata after `+` is ignored, as NuGet ignores it.
+ *
+ * @param {string} a Version
+ * @param {string} b Version
+ * @returns {number} Negative, zero or positive, like a sort comparator
+ */
+export function compareNugetVersions(a, b) {
+  const split = (version) => {
+    const withoutMetadata = `${version ?? ""}`.trim().split("+")[0];
+    const dash = withoutMetadata.indexOf("-");
+    const release =
+      dash >= 0 ? withoutMetadata.slice(0, dash) : withoutMetadata;
+    const prerelease = dash >= 0 ? withoutMetadata.slice(dash + 1) : "";
+    const parts = release.split(".").map((part) => Number.parseInt(part, 10));
+    return { parts, prerelease };
+  };
+  const left = split(a);
+  const right = split(b);
+  for (let index = 0; index < 4; index++) {
+    const l = Number.isNaN(left.parts[index]) ? 0 : (left.parts[index] ?? 0);
+    const r = Number.isNaN(right.parts[index]) ? 0 : (right.parts[index] ?? 0);
+    if (l !== r) {
+      return l < r ? -1 : 1;
+    }
+  }
+  if (left.prerelease === right.prerelease) {
+    return 0;
+  }
+  if (!left.prerelease) {
+    return 1;
+  }
+  if (!right.prerelease) {
+    return -1;
+  }
+  const leftLabels = left.prerelease.toLowerCase().split(".");
+  const rightLabels = right.prerelease.toLowerCase().split(".");
+  for (
+    let index = 0;
+    index < Math.max(leftLabels.length, rightLabels.length);
+    index++
+  ) {
+    const l = leftLabels[index];
+    const r = rightLabels[index];
+    if (l === undefined || r === undefined) {
+      return l === undefined ? -1 : 1;
+    }
+    if (l === r) {
+      continue;
+    }
+    const lNumeric = /^\d+$/.test(l);
+    const rNumeric = /^\d+$/.test(r);
+    if (lNumeric && rNumeric) {
+      return Number(l) < Number(r) ? -1 : 1;
+    }
+    if (lNumeric !== rNumeric) {
+      return lNumeric ? -1 : 1;
+    }
+    return l < r ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * Whether a NuGet version range allows a version. A bare version is a minimum
+ * (`1.0` means at least 1.0); brackets are inclusive and parentheses exclusive
+ * (`[1.0]`, `[1.0,2.0)`, `(,2.0]`). An empty or unparseable range allows
+ * anything.
+ *
+ * @param {string} range Range as a nuspec or lock file states it
+ * @param {string} version Version to test
+ * @returns {boolean} True when the range allows the version
+ */
+export function nugetRangeAllows(range, version) {
+  const text = `${range ?? ""}`.trim();
+  if (!text || !version) {
+    return true;
+  }
+  const opening = text[0];
+  if (opening !== "[" && opening !== "(") {
+    return compareNugetVersions(version, text) >= 0;
+  }
+  const closing = text[text.length - 1];
+  if (closing !== "]" && closing !== ")") {
+    return true;
+  }
+  const inner = text.slice(1, -1);
+  const comma = inner.indexOf(",");
+  if (comma < 0) {
+    return compareNugetVersions(version, inner.trim()) === 0;
+  }
+  const minimum = inner.slice(0, comma).trim();
+  const maximum = inner.slice(comma + 1).trim();
+  if (minimum) {
+    const order = compareNugetVersions(version, minimum);
+    if (order < 0 || (order === 0 && opening === "(")) {
+      return false;
+    }
+  }
+  if (maximum) {
+    const order = compareNugetVersions(version, maximum);
+    if (order > 0 || (order === 0 && closing === ")")) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * Choose the installed version a declared dependency resolves to: the lowest
+ * installed version the range allows, as NuGet picks the lowest applicable
+ * version; else the only installed version, which is what binding redirects
+ * unify a dependency onto. Undefined when nothing installed can be named.
+ *
+ * @param {string} range Declared range
+ * @param {string[]} installedVersions Versions installed for the package
+ * @returns {string|undefined} The chosen version
+ */
+export function resolveInstalledNugetVersion(range, installedVersions = []) {
+  const allowed = installedVersions
+    .filter((version) => nugetRangeAllows(range, version))
+    .sort(compareNugetVersions);
+  if (allowed.length) {
+    return allowed[0];
+  }
+  return installedVersions.length === 1 ? installedVersions[0] : undefined;
+}
+
+/**
+ * The project directory a .NET manifest belongs to. Restore output records its
+ * project file; otherwise project.assets.json sits in the project's `obj/`,
+ * and lock files, packages.config and project files sit in the project
+ * directory itself.
+ *
+ * @param {string} manifestFile Manifest path
+ * @param {string} [projectPath] Project file the manifest names, when it does
+ * @returns {string} Project directory
+ */
+export function dotnetManifestProjectDir(manifestFile, projectPath) {
+  if (projectPath) {
+    const projectDir = dirname(resolve(projectPath));
+    if (safeExistsSync(projectDir)) {
+      return projectDir;
+    }
+  }
+  const dir = dirname(resolve(manifestFile));
+  return basename(dir) === "obj" ? dirname(dir) : dir;
+}
+
+/**
+ * Index the MSBuild properties that props files define, by the directory each
+ * file sits in and across the whole scan, so the candidates for every project
+ * come from one read of each file.
+ *
+ * @param {string[]} propsFiles Props files of the scan
+ * @returns {{byDir: Object, treeWide: Object}} Property values per directory and
+ *          across the scan, each a map of property name to values
+ */
+export function indexPropsProperties(propsFiles = []) {
+  const byDir = {};
+  const treeWide = {};
+  for (const propsFile of propsFiles) {
+    if (!propsFile) {
+      continue;
+    }
+    const nodes = getPropertyGroupTextNodes([propsFile]);
+    const dir = dirname(resolve(propsFile));
+    byDir[dir] ??= {};
+    for (const [key, values] of Object.entries(nodes)) {
+      byDir[dir][key] ??= [];
+      treeWide[key] ??= [];
+      for (const value of values) {
+        if (!byDir[dir][key].includes(value)) {
+          byDir[dir][key].push(value);
+        }
+        if (!treeWide[key].includes(value)) {
+          treeWide[key].push(value);
+        }
+      }
+    }
+  }
+  return { byDir, treeWide };
+}
+
+/**
+ * The candidate values of MSBuild properties that can apply to a project file,
+ * from the props files beside it and above it: the nearest directory that
+ * defines a property wins, as the nearest Directory.Build.props is the one
+ * MSBuild imports. A property no such directory defines falls back to the
+ * values the whole scan's props files give it, which a caller only trusts when
+ * there is exactly one.
+ *
+ * @param {string} projFile Project file
+ * @param {{byDir: Object, treeWide: Object}} propsIndex Index built by {@link indexPropsProperties}
+ * @returns {Object} Map of property name to candidate values
+ */
+export function projectPropertyCandidates(projFile, propsIndex = {}) {
+  const candidates = { ...(propsIndex.treeWide || {}) };
+  const settled = new Set();
+  let dir = dirname(resolve(projFile));
+  for (;;) {
+    for (const [key, values] of Object.entries(propsIndex.byDir?.[dir] || {})) {
+      if (!settled.has(key)) {
+        candidates[key] = values;
+        settled.add(key);
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  return candidates;
+}
+
+/**
+ * The version of each package that every manifest of a scan agrees on, keyed by
+ * lowercased package id. A package that two manifests give different versions
+ * is left out: without knowing which project a declaration belongs to, picking
+ * one of them would be a guess.
+ *
+ * @param {Object[]} pkgList Components collected from the scan's manifests
+ * @returns {Object} Map of lowercased package id to version
+ */
+export function agreedNugetVersions(pkgList = []) {
+  const versions = {};
+  for (const p of pkgList) {
+    if (!p?.name || !p.version || ["application", "project"].includes(p.type)) {
+      continue;
+    }
+    const key = p.name.toLowerCase();
+    versions[key] ??= new Set();
+    versions[key].add(p.version);
+  }
+  const agreed = {};
+  for (const [key, values] of Object.entries(versions)) {
+    if (values.size === 1) {
+      agreed[key] = [...values][0];
+    }
+  }
+  return agreed;
+}
+
 /**
  * Method to parse .nupkg files
  *
@@ -70,9 +316,16 @@ export function parseNuspecData(nupkgFile, nuspecData) {
   const pkg = { group: "" };
   let npkg;
   const dependenciesMap = {};
+  // The version range each dependency accepts, per depending package, so a
+  // caller holding the installed packages can point an edge at one of them.
+  const dependencyRanges = {};
   const addedMap = {};
   try {
-    npkg = xml2js(nuspecData, {
+    // A nuspec written on Windows often starts with a UTF-8 byte order mark,
+    // which the XML parser rejects as text before the declaration.
+    const data =
+      nuspecData.charCodeAt(0) === 0xfeff ? nuspecData.slice(1) : nuspecData;
+    npkg = xml2js(data, {
       compact: true,
       alwaysArray: false,
       spaces: 4,
@@ -94,6 +347,7 @@ export function parseNuspecData(nupkgFile, nuspecData) {
     return {
       pkgList,
       dependenciesMap,
+      dependencyRanges,
     };
   }
   const m = npkg.metadata;
@@ -101,7 +355,12 @@ export function parseNuspecData(nupkgFile, nuspecData) {
   pkg.version = m.version._;
   pkg.description = m.description._;
   applyPurl(pkg, nugetPurl(pkg.name, pkg.version));
-  if (m.licenseUrl) {
+  // A licence expression is the machine-readable licence NuGet records; the
+  // licence URL is the older, often unresolvable form, so the expression wins.
+  if (m.license?.$?.type === "expression" && m.license?._?.trim()) {
+    pkg.license = findLicenseId(m.license._.trim()) || m.license._.trim();
+  }
+  if (!pkg.license && m.licenseUrl) {
     pkg.license = findLicenseId(m.licenseUrl._);
   }
   if (m.authors) {
@@ -128,18 +387,19 @@ export function parseNuspecData(nupkgFile, nuspecData) {
   };
   pkg.scope = "required";
   pkgList.push(pkg);
+  const ranges = {};
   if (m?.dependencies?.dependency) {
     const dependsOn = [];
-    if (Array.isArray(m.dependencies.dependency)) {
-      for (const adep of m.dependencies.dependency) {
-        const d = adep.$;
-        dependsOn.push(d.id);
-      }
-    } else {
-      const d = m.dependencies.dependency.$;
+    const declared = Array.isArray(m.dependencies.dependency)
+      ? m.dependencies.dependency
+      : [m.dependencies.dependency];
+    for (const adep of declared) {
+      const d = adep.$;
       dependsOn.push(d.id);
+      ranges[d.id] ??= d.version;
     }
     dependenciesMap[pkg["bom-ref"]] = dependsOn;
+    dependencyRanges[pkg["bom-ref"]] = ranges;
   } else if (m?.dependencies?.group) {
     let dependencyGroups;
     if (Array.isArray(m.dependencies.group)) {
@@ -168,6 +428,7 @@ export function parseNuspecData(nupkgFile, nuspecData) {
             continue;
           }
           groupPkg.name = agroupdep.id;
+          ranges[agroupdep.id] ??= agroupdep.version;
           let declaredRange;
           if (agroupdep?.version) {
             let versionStr = agroupdep.version;
@@ -225,11 +486,13 @@ export function parseNuspecData(nupkgFile, nuspecData) {
         } // for
       } // group dependency block
       dependenciesMap[pkg["bom-ref"]] = dependsOn;
+      dependencyRanges[pkg["bom-ref"]] = ranges;
     } // for
   }
   return {
     pkgList,
     dependenciesMap,
+    dependencyRanges,
   };
 }
 
@@ -289,7 +552,7 @@ export function parseCsPkgData(pkgData, pkgFile, pkgNameVersions = {}) {
       // Backfill from a version already resolved by a more precise manifest.
       // Concrete versions are never overridden - a disagreement means both
       // versions must be tracked.
-      pkg.version = pkgNameVersions[pkg.name];
+      pkg.version = lookupNugetVersion(pkgNameVersions, pkg.name);
     }
     applyNugetVersion(pkg, pkg.version);
     if (pkgFile) {
@@ -466,16 +729,130 @@ export function getPropertyGroupTextNodes(propsFiles) {
   return matches;
 }
 
+/**
+ * Read the trimmed text of an MSBuild property from a parsed PropertyGroup.
+ *
+ * @param {Object} propertyGroup PropertyGroup parsed by xml2js in compact mode
+ * @param {string} key Property name
+ * @returns {string|undefined} The text, or undefined when absent or empty
+ */
+function propertyGroupText(propertyGroup, key) {
+  const text = propertyGroup?.[key]?.[0]?._?.[0];
+  if (typeof text !== "string" || !text.trim().length) {
+    return undefined;
+  }
+  return text.trim();
+}
+
+/**
+ * Look up a package version in a name - version map. NuGet package ids are
+ * case-insensitive, so a map may be keyed by the id as written or lowercased.
+ *
+ * @param {Object} versions Map of package id to version
+ * @param {string} name Package id
+ * @returns {string|undefined} The version, or undefined when the map has none
+ */
+export function lookupNugetVersion(versions, name) {
+  if (!versions || !name) {
+    return undefined;
+  }
+  return versions[name] ?? versions[name.toLowerCase()];
+}
+
+/**
+ * Collect the MSBuild properties a project file defines itself, from every
+ * PropertyGroup, keyed by property name. A later definition wins, as it does
+ * when MSBuild evaluates the file.
+ *
+ * @param {Object} project Project element parsed by xml2js in compact mode
+ * @returns {Object} Map of property name to text value
+ */
+function projectOwnProperties(project) {
+  const properties = {};
+  for (const propertyGroup of project?.PropertyGroup || []) {
+    for (const key of Object.keys(propertyGroup)) {
+      if (key === "$" || key === "value") {
+        continue;
+      }
+      const text = propertyGroupText(propertyGroup, key);
+      if (text !== undefined) {
+        properties[key] = text;
+      }
+    }
+  }
+  return properties;
+}
+
+/**
+ * Evaluate MSBuild properties of one project with a single `dotnet msbuild`
+ * call. Asking for every property at once costs one evaluation per project,
+ * where one call per package reference evaluated the same project over and
+ * over.
+ *
+ * @param {string} projFile Project file
+ * @param {string[]} names Property names
+ * @returns {Object} Map of property name to evaluated value, without empty values
+ */
+function evaluateMsbuildProperties(projFile, names) {
+  const values = {};
+  if (!projFile || !names.length) {
+    return values;
+  }
+  const result = safeSpawnSync(
+    DOTNET_CMD,
+    [
+      "msbuild",
+      projFile,
+      "-nologo",
+      ...names.map((name) => `-getProperty:${name}`),
+    ],
+    { shell: isWin },
+  );
+  if (result.status !== 0 || result.error || !result.stdout?.trim()) {
+    return values;
+  }
+  const stdout = result.stdout.trim();
+  if (names.length === 1) {
+    values[names[0]] = stdout;
+    return values;
+  }
+  // Several properties come back as one JSON document.
+  try {
+    const evaluated = JSON.parse(stdout)?.Properties || {};
+    for (const name of names) {
+      if (typeof evaluated[name] === "string" && evaluated[name].trim()) {
+        values[name] = evaluated[name].trim();
+      }
+    }
+  } catch (_e) {
+    // Unexpected output: treat every property as unresolved.
+  }
+  return values;
+}
+
 /**
  * Method to parse .csproj like xml files
  *
+ * A version the project file does not state is taken, in order, from the
+ * versions this project restored, from central package management, and last
+ * from a version the whole scan agrees on. Two projects of one tree routinely
+ * restore different versions of a package, so a version taken from another
+ * project would describe a package this project does not use.
+ *
  * @param {String} csProjData Raw data
  * @param {String} projFile File name
- * @param {Object} pkgNameVersions Package name - version map object
+ * @param {Object} pkgNameVersions Versions this project restored (its project.assets.json,
+ *        packages.lock.json or packages.config), keyed by package id or lowercased id
  * @param {Boolean} msbuildInstalled Whether msbuild is available to resolve properties
- * @param {Object} pkgVersionLabelCandidates Candidate values for msbuild version properties
+ * @param {Object} pkgVersionLabelCandidates Candidate values for msbuild version properties,
+ *        from the props files that can apply to this project
  * @param {Object} centralVersions Versions declared centrally in Directory.Packages.props,
  *        keyed by lowercased package id. See {@link getCentralPackageVersions}.
+ * @param {Object} fallbackVersions Versions every project of the scan agrees on, keyed by
+ *        lowercased package id, used only when nothing closer states one
+ * @param {Object} restoredNames Package ids as this project's restore output spells them,
+ *        keyed by lowercased id. NuGet ids are case-insensitive, so a reference spelled
+ *        differently names the same package and takes the restored spelling.
  *
  * @returns {Object} Containing parent component, package, and dependencies
  */
@@ -486,6 +863,8 @@ export function parseCsProjData(
   msbuildInstalled = false,
   pkgVersionLabelCandidates = {},
   centralVersions = {},
+  fallbackVersions = {},
+  restoredNames = {},
 ) {
   const pkgList = [];
   const parentComponent = { type: "application", properties: [] };
@@ -514,6 +893,68 @@ export function parseCsProjData(
     return pkgList;
   }
   const project = projects[0];
+  const restoredName = (name) => restoredNames[name.toLowerCase()] || name;
+  const resolvedVersion = (name) =>
+    lookupNugetVersion(pkgNameVersions, name) ||
+    lookupNugetVersion(centralVersions, name) ||
+    lookupNugetVersion(fallbackVersions, name);
+  // `$(Name)` version labels: the project's own properties, then the props
+  // files that can apply to it, then (only for what neither settles) one
+  // msbuild evaluation of the project.
+  const ownProperties = projectOwnProperties(project);
+  const labelOf = (version) => version?.match(/^\$\((.*)\)$/)?.[1];
+  const staticLabelValue = (label) =>
+    ownProperties[label] ??
+    (pkgVersionLabelCandidates[label]?.length === 1
+      ? pkgVersionLabelCandidates[label][0]
+      : undefined);
+  let msbuildValues = {};
+  if (msbuildInstalled) {
+    const unresolved = new Set();
+    for (const item of project.ItemGroup || []) {
+      for (const reference of item.PackageReference || []) {
+        const label = labelOf(
+          reference.$?.VersionOverride ||
+            reference.VersionOverride?.[0]._?.[0] ||
+            reference.$?.Version ||
+            reference.Version?.[0]._?.[0],
+        );
+        if (label && staticLabelValue(label) === undefined) {
+          unresolved.add(label);
+        }
+      }
+    }
+    msbuildValues = evaluateMsbuildProperties(projFile, [...unresolved].sort());
+  }
+  // SDK-style projects declare their version through the MSBuild properties
+  // that `dotnet pack` reads: PackageVersion, which defaults to Version, which
+  // in turn defaults to VersionPrefix plus an optional `-VersionSuffix`. A
+  // property may be set in any PropertyGroup, so they are collected first.
+  const sdkVersionProps = {};
+  for (const apg of project?.PropertyGroup || []) {
+    for (const key of [
+      "PackageVersion",
+      "Version",
+      "VersionPrefix",
+      "VersionSuffix",
+    ]) {
+      const value = propertyGroupText(apg, key);
+      if (value !== undefined) {
+        sdkVersionProps[key] = value;
+      }
+    }
+  }
+  let sdkVersion =
+    sdkVersionProps.PackageVersion ||
+    sdkVersionProps.Version ||
+    (sdkVersionProps.VersionPrefix
+      ? `${sdkVersionProps.VersionPrefix}${sdkVersionProps.VersionSuffix ? `-${sdkVersionProps.VersionSuffix}` : ""}`
+      : undefined);
+  // An MSBuild property reference such as $(BuildNumber) is only known at
+  // build time, so a version that still contains one is not reported.
+  if (sdkVersion?.includes("$(")) {
+    sdkVersion = undefined;
+  }
   // First make up a parentcomponent name based on the .csproj file name
   if (projFile) {
     parentComponent.name = basename(projFile).replaceAll(
@@ -571,10 +1012,6 @@ export function parseCsProjData(
         if (outputType === "Library") {
           parentComponent.type = "library";
         }
-        applyPurl(
-          parentComponent,
-          nugetPurl(parentComponent.name, parentComponent.version || "latest"),
-        );
         // The MSBuild OutputType (Exe, WinExe, …) used to ride along as an
         // `output_type` purl qualifier, which nuget does not define — every such
         // purl was invalid. It is project metadata, so it belongs in properties.
@@ -686,53 +1123,30 @@ export function parseCsProjData(
         if (!pref.Include || pref.Include.includes(".csproj")) {
           continue;
         }
-        pkg.name = pref.Include;
+        pkg.name = restoredName(pref.Include);
         // Under central package management a PackageReference carries no Version at
         // all, and VersionOverride is the documented way for a project to opt out of
-        // the central version, so it wins over everything else. The central version
-        // is consulted only after pkgNameVersions, which holds versions already
-        // resolved from project.assets.json / packages.lock.json and is therefore
-        // more precise than a central declaration that may be a floating range.
+        // the central version, so it wins over everything else. Otherwise the version
+        // this project restored is more precise than a central declaration that may
+        // be a floating range.
         pkg.version =
           pref.VersionOverride ||
           item.PackageReference[j].VersionOverride?.[0]._?.[0] ||
           pref.Version ||
           item.PackageReference[j].Version?.[0]._?.[0] ||
-          pkgNameVersions[pkg.name] ||
-          centralVersions[pkg.name.toLowerCase()];
-        if (pkg.version) {
-          const version_label_match = pkg.version.match(/^\$\((.*)\)$/)?.[1];
-          if (version_label_match) {
-            let version_resolved = false;
-            if (msbuildInstalled) {
-              const result = safeSpawnSync(
-                DOTNET_CMD,
-                [
-                  `msbuild ${projFile} -nologo -getProperty:${version_label_match}`,
-                ],
-                { shell: isWin },
-              );
-              if (
-                result.status === 0 &&
-                !result.error &&
-                result.stdout.trim()
-              ) {
-                pkg.version = result.stdout.trim();
-                version_resolved = true;
-              }
-            }
-            if (!version_resolved) {
-              if (
-                pkgVersionLabelCandidates[version_label_match]?.length === 1
-              ) {
-                // Prioritizing correctness over completeness: reject resolved package version label if it has more than one possible values.
-                pkg.version = pkgVersionLabelCandidates[version_label_match][0];
-              } else if (DEBUG_MODE) {
-                console.log(
-                  `Could not resolve package version label ${version_label_match} for ${pkg.name}`,
-                );
-              }
-            }
+          resolvedVersion(pkg.name);
+        const versionLabel = labelOf(pkg.version);
+        if (versionLabel) {
+          // Prioritizing correctness over completeness: a label with more than one
+          // candidate value across the applicable props files stays unresolved.
+          const labelValue =
+            msbuildValues[versionLabel] ?? staticLabelValue(versionLabel);
+          if (labelValue !== undefined) {
+            pkg.version = labelValue;
+          } else if (DEBUG_MODE) {
+            console.log(
+              `Could not resolve package version label ${versionLabel} for ${pkg.name}`,
+            );
           }
         }
         // A `Version` attribute holds whatever the project declares, which may
@@ -749,9 +1163,7 @@ export function parseCsProjData(
             pkg.version = exactPin[1];
           } else if (!concreteVersion(pkg.version)) {
             declaredRange = pkg.version;
-            pkg.version =
-              pkgNameVersions[pkg.name] ||
-              centralVersions[pkg.name.toLowerCase()];
+            pkg.version = resolvedVersion(pkg.name);
           }
         }
         // A version that could not be resolved from any source must not be
@@ -826,21 +1238,20 @@ export function parseCsProjData(
             }
           }
         }
+        pkg.name = restoredName(pkg.name);
         let declaredAssemblyVersion;
         if (incParts.length > 1 && incParts[1].includes("Version")) {
           const declared = incParts[1].replace("Version=", "").trim();
-          // An assembly reference carries the version inline, and that value can
-          // be an MSBuild property such as `Version=$(TargetFSharpCoreVersion)`
-          // which only a build evaluates. Anything that is not a concrete
-          // version is resolved from the manifests that pin one, keeping the
-          // declaration as a property.
+          // An assembly reference carries the assembly's version inline, which is
+          // not the version of the package that ships it (Newtonsoft.Json 13.0.3
+          // ships assembly 13.0.0.0), and can be an MSBuild property such as
+          // `Version=$(TargetFSharpCoreVersion)` that only a build evaluates. A
+          // concrete one is kept as the assembly version; a property as a
+          // declaration.
           if (declared && !concreteVersion(declared)) {
             declaredAssemblyVersion = declared;
-            assemblyVersion =
-              pkgNameVersions[pkg.name] ||
-              centralVersions[pkg.name.toLowerCase()];
-          } else {
-            assemblyVersion = declared || pkgNameVersions[pkg.name];
+          } else if (declared) {
+            assemblyVersion = declared;
           }
         }
         if (declaredAssemblyVersion) {
@@ -849,7 +1260,11 @@ export function parseCsProjData(
             value: declaredAssemblyVersion,
           });
         }
-        const version = hintVersion ?? assemblyVersion;
+        // The package version comes from the HintPath's package folder, or from
+        // what this project restored; never from the assembly version, and not
+        // from a central pin, which applies to PackageReference items only.
+        const version =
+          hintVersion ?? lookupNugetVersion(pkgNameVersions, pkg.name);
         // An assembly reference that states no version anywhere - no HintPath to
         // read one from and no `Version=` on the Include - leaves the component
         // versionless in both fields. The registry's latest release is not a
@@ -877,7 +1292,7 @@ export function parseCsProjData(
             value: assemblyName,
           });
         }
-        if (hintVersion && assemblyVersion) {
+        if (assemblyVersion) {
           pkg.properties.push({
             name: "cdx:dotnet:assembly_version",
             value: assemblyVersion,
@@ -924,21 +1339,29 @@ export function parseCsProjData(
       }
     }
   }
-  // If the parent still lacks a purl, add one based on the name and version
-  if (parentComponent && !parentComponent.purl && parentComponent.name) {
-    applyPurl(
-      parentComponent,
-      nugetPurl(parentComponent.name, parentComponent.version || "latest"),
-    );
+  if (sdkVersion) {
+    parentComponent.version = sdkVersion;
+  } else if (
+    !parentComponent.version &&
+    !Object.keys(sdkVersionProps).length &&
+    (project.$?.Sdk || project.Sdk)
+  ) {
+    // An SDK-style project that sets no version builds as 1.0.0, the Version
+    // its project.assets.json records too, so both describe one component. A
+    // version set from a build-time property is unknown, not 1.0.0.
+    parentComponent.version = "1.0.0";
   }
-  if (parentComponent?.purl) {
-    parentComponent["bom-ref"] = parentComponent.purl;
+  // The purl is built once every PropertyGroup has been read, so a version
+  // declared after OutputType is not lost. A project that states no version
+  // gets a versionless purl: "latest" is not a version.
+  if (parentComponent.name) {
+    applyNugetVersion(parentComponent, parentComponent.version);
   }
   let dependencies = [];
   if (parentComponent?.["bom-ref"]) {
     dependencies = [
       {
-        ref: parentComponent.purl,
+        ref: parentComponent["bom-ref"],
         dependsOn: [...new Set(pkgList.map((p) => p["bom-ref"]))].sort(),
       },
     ];
@@ -950,6 +1373,41 @@ export function parseCsProjData(
   };
 }
 
+// The package folders a consuming project compiles against or loads at run
+// time. A DLL elsewhere in the package (build/, buildTransitive/, tools/,
+// analyzers/) is a build-time helper of the package itself, such as the
+// System.Formats.Asn1.dll coverlet.collector carries for its test-platform
+// collector: the project's code never calls it, so its name must not credit
+// the package with the project's framework calls (issue 4441).
+const DOTNET_REFERENCED_ASSET_FOLDERS = new Set(["lib", "ref", "runtimes"]);
+
+/**
+ * Whether a file of a NuGet package is an assembly a consuming project can
+ * reference: a .dll, .exe, or .so under lib/, ref/, or runtimes/.
+ *
+ * @param {string} packageFile Path of the file inside the package, as project.assets.json lists it
+ * @returns {boolean} true for a referenced assembly
+ */
+export function isReferencedDotnetPackageFile(packageFile) {
+  if (typeof packageFile !== "string") {
+    return false;
+  }
+  const lowerFile = packageFile.toLowerCase();
+  if (
+    !lowerFile.endsWith(".dll") &&
+    !lowerFile.endsWith(".exe") &&
+    !lowerFile.endsWith(".so")
+  ) {
+    return false;
+  }
+  const normalized = lowerFile.replaceAll("\\", "/");
+  const slashIndex = normalized.indexOf("/");
+  return (
+    slashIndex > 0 &&
+    DOTNET_REFERENCED_ASSET_FOLDERS.has(normalized.slice(0, slashIndex))
+  );
+}
+
 /**
  * Parse a .NET project.assets.json file and return the package list and dependency tree.
  *
@@ -959,7 +1417,8 @@ export function parseCsProjData(
  *
  * @param {string} csProjData Raw JSON string of the project.assets.json file
  * @param {string} assetsJsonFile Path to the project.assets.json file, used for evidence properties
- * @returns {{ pkgList: Object[], dependenciesList: Object[] }}
+ * @returns {{ pkgList: Object[], dependenciesList: Object[], projectPath: (string|undefined) }}
+ *          `projectPath` is the project file the restore output belongs to, as restore recorded it
  */
 export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
   // extract name, operator, version from .NET package representation
@@ -999,22 +1458,18 @@ export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
     return { pkgList, dependenciesList };
   }
   csProjData = JSON.parse(csProjData);
-  let purlString;
+  const projectPath = csProjData.project?.restore?.projectPath;
+  let rootRef;
   if (csProjData.project?.restore?.projectName) {
-    purlString = build({
-      type: "nuget",
-      namespace: "" || null,
-      name: csProjData.project?.restore?.projectName,
-      version: csProjData.project.version || "latest" || null,
-    });
+    // The project's own version as restore evaluated it; "latest" is not a
+    // version, so a project without one gets a versionless purl.
     rootPkg = {
       group: "",
       name: csProjData.project.restore.projectName,
-      version: csProjData.project.version || "latest",
       type: "application",
-      purl: purlString,
-      "bom-ref": decodeURIComponent(purlString),
     };
+    applyNugetVersion(rootPkg, csProjData.project.version);
+    rootRef = rootPkg["bom-ref"];
     pkgList.push(rootPkg);
   }
   const rootPkgDeps = new Set();
@@ -1028,53 +1483,42 @@ export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
         if (nameOperatorVersion == null) {
           continue;
         }
-        const targetNameVersion = `${nameOperatorVersion.name}/${nameOperatorVersion.version}`;
-        let nameToUse = nameOperatorVersion.name;
-        // Due to the difference in casing, we might arrive this case where a simple lookup doesn't succeed.
-        // Instead of skipping, let's work harder to find a match.
-        if (!csProjData.targets[frameworkTarget][targetNameVersion]) {
-          let matchFound = false;
-          for (const fkeys of Object.keys(
-            csProjData.targets[frameworkTarget],
-          )) {
-            const tmpParts = fkeys.split("/");
-            const tname = tmpParts[0];
-            const tversion = tmpParts[1];
-            if (
-              tname.toLowerCase() === nameOperatorVersion.name.toLowerCase() &&
-              tversion === nameOperatorVersion.version.replace("-*", "")
-            ) {
-              nameToUse = tname;
-              matchFound = true;
-              break;
-            }
-          }
-          if (!matchFound) {
-            if (DEBUG_MODE) {
-              console.log(
-                "Unable to match",
-                dependencyName,
-                "with a target name. The dependency tree will be imprecise.",
-              );
-            }
-            continue;
+        // A direct dependency is declared as a constraint (`Moq >= 4.17.6`,
+        // `X >= 7.0.0-*`, `[4.0.0, 5.0.0)`), and restore installs one version of
+        // each package per target: the edge points at that installed version,
+        // whatever the constraint's lower bound says.
+        const resolvedTarget = Object.keys(
+          csProjData.targets[frameworkTarget] || {},
+        ).find(
+          (targetKey) =>
+            targetKey.split("/")[0].toLowerCase() ===
+            nameOperatorVersion.name.toLowerCase(),
+        );
+        if (!resolvedTarget) {
+          if (DEBUG_MODE) {
+            console.log(
+              "Unable to match",
+              dependencyName,
+              "with a target name. The dependency tree will be imprecise.",
+            );
           }
+          continue;
         }
-
+        const [nameToUse, resolvedVersion] = resolvedTarget.split("/");
         const dpurl = decodeURIComponent(
           build({
             type: "nuget",
             namespace: "" || null,
             name: nameToUse,
-            version: nameOperatorVersion.version || null,
+            version: resolvedVersion || null,
           }),
         );
         rootPkgDeps.add(dpurl);
       }
     }
-    if (purlString && rootPkgDeps.size) {
+    if (rootRef && rootPkgDeps.size) {
       dependenciesList.push({
-        ref: purlString,
+        ref: rootRef,
         dependsOn: Array.from(rootPkgDeps).sort(),
       });
     }
@@ -1113,12 +1557,8 @@ export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
           if (lib[rootDep].files && Array.isArray(lib[rootDep].files)) {
             const dllFiles = new Set();
             lib[rootDep].files.forEach((f) => {
-              if (
-                f.endsWith(".dll") ||
-                f.endsWith(".exe") ||
-                f.endsWith(".so")
-              ) {
-                dllFiles.add(basename(f));
+              if (isReferencedDotnetPackageFile(f)) {
+                dllFiles.add(basename(f.replaceAll("\\", "/")));
               }
             });
             pkg.properties = [
@@ -1205,6 +1645,7 @@ export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
   return {
     pkgList,
     dependenciesList,
+    projectPath,
   };
 }
 
@@ -1280,39 +1721,55 @@ export function parseCsPkgLockData(csLockData, pkgLockFile) {
       }
       const dependsOn = new Set();
       if (libData.dependencies) {
-        for (let adep of Object.keys(libData.dependencies)) {
-          let adepResolvedVersion = libData.dependencies[adep];
-          const aversionNoRuntime = aversion.split("/")[0];
-          // Try to get the resolved version of the dependency. See #930 and #937
-          if (assetData.dependencies[aversion]?.[adep]?.resolved) {
-            adepResolvedVersion =
-              assetData.dependencies[aversion][adep].resolved;
-          } else if (
-            aversion.includes("/") &&
-            assetData.dependencies[aversionNoRuntime]?.[adep]?.resolved
-          ) {
-            adepResolvedVersion =
-              assetData.dependencies[aversionNoRuntime][adep].resolved;
-          } else if (
-            (assetData.dependencies[aversion]?.[adep.toLowerCase()] &&
-              assetData.dependencies[aversion][adep.toLowerCase()].type ===
-                "Project") ||
-            (assetData.dependencies[aversionNoRuntime]?.[adep.toLowerCase()] &&
-              assetData.dependencies[aversionNoRuntime][adep.toLowerCase()]
-                .type === "Project")
-          ) {
-            adepResolvedVersion = undefined;
-            adep = adep.toLowerCase();
-          } else if (DEBUG_MODE) {
-            console.warn(
-              `Unable to find the resolved version for ${adep} ${aversion}. Using ${adepResolvedVersion} which may be incorrect.`,
+        const aversionNoRuntime = aversion.split("/")[0];
+        // The entry for a dependency: in this target, the target without its
+        // runtime identifier, or a runtime-specific target of the same
+        // framework. Package ids are case-insensitive, and the lock file writes
+        // a dependency the way the depending package's nuspec spells it. See
+        // #930 and #937.
+        const sections = [
+          assetData.dependencies[aversion],
+          assetData.dependencies[aversionNoRuntime],
+          ...Object.keys(assetData.dependencies)
+            .filter((key) => key.startsWith(`${aversionNoRuntime}/`))
+            .map((key) => assetData.dependencies[key]),
+        ].filter(Boolean);
+        const entryFor = (name) => {
+          for (const section of sections) {
+            const key = Object.keys(section).find(
+              (candidate) => candidate.toLowerCase() === name.toLowerCase(),
             );
+            if (key) {
+              return { name: key, entry: section[key] };
+            }
+          }
+          return undefined;
+        };
+        for (const adep of Object.keys(libData.dependencies)) {
+          const found = entryFor(adep);
+          let depName;
+          let depVersion;
+          if (found?.entry?.type === "Project") {
+            depName = found.name;
+          } else if (found?.entry?.resolved) {
+            depName = found.name;
+            depVersion = found.entry.resolved;
+          } else {
+            // The dependency value is the declared range (`[6.0.0, )`), which
+            // names no package version: without a resolved entry there is no
+            // component to point at.
+            if (DEBUG_MODE) {
+              console.warn(
+                `Unable to find the resolved version for ${adep} ${aversion}. The dependency tree will be imprecise.`,
+              );
+            }
+            continue;
           }
           const adpurl = build({
             type: "nuget",
             namespace: "" || null,
-            name: adep,
-            version: adepResolvedVersion || null,
+            name: depName,
+            version: depVersion || null,
           });
           dependsOn.add(decodeURIComponent(adpurl));
         }