@coana-tech/cli 14.0.11 → 14.0.13

package/cli.js

@@ -89011,7 +89011,10 @@ var init_nuget_fixing_manager = __esm({
           async (wsPath) => {
             const fixesWithId = fixes[wsPath];
             const dependencyTree = fixingInfo.dependencyTrees[wsPath];
-            const projectFilePath = (0, import_path10.join)(this.getAbsWsPath(wsPath), fixingInfo.projectFiles[wsPath]);
+            const projectFiles = fixingInfo.projectFiles[wsPath];
+            if (projectFiles.length !== 1)
+              throw new Error("Applying fixes to workspaces with more than 1 project file currently not supported");
+            const projectFilePath = (0, import_path10.join)(this.getAbsWsPath(wsPath), projectFiles[0]);
             const initialProjectFile = await (0, import_promises9.readFile)(projectFilePath, "utf-8");
             const initialLockFile = await this.restoreWorkspaceAndParseLockFile(wsPath);
             await applySeries(fixesWithId, async ({ fixId, vulnerabilityFixes }) => {
@@ -89028,7 +89031,10 @@ var init_nuget_fixing_manager = __esm({
         await applySeries(workspacePaths, async (wsPath) => {
           const finalProjectFile = workspaceToResults[wsPath].projectFile;
           const finalLockFile = workspaceToResults[wsPath].lockFile;
-          await (0, import_promises9.writeFile)((0, import_path10.join)(this.getAbsWsPath(wsPath), fixingInfo.projectFiles[wsPath]), finalProjectFile);
+          const projectFiles = fixingInfo.projectFiles[wsPath];
+          if (projectFiles.length !== 1)
+            throw new Error("Applying fixes to workspaces with more than 1 project file currently not supported");
+          await (0, import_promises9.writeFile)((0, import_path10.join)(this.getAbsWsPath(wsPath), projectFiles[0]), finalProjectFile);
           await (0, import_promises9.writeFile)(this.getLockFilePath(wsPath), JSON.stringify(finalLockFile, null, 2));
         });
         if (solutionFiles) {
@@ -89060,24 +89066,20 @@ var init_nuget_fixing_manager = __esm({
         });
         const conflictCache = new Cache();
         await applySeries(vulnFixes, async ({ dependencyIdentifier, dependencyName, fixedVersion }) => {
-          await applySeries(
-            dependencyTree.transitiveDependencies[dependencyIdentifier].frameworks?.filter(
-              (framework) => typeCache.get(framework)?.get(dependencyName) === "Direct"
-            ) ?? [],
-            async (framework) => {
-              const nugetRange = NuGetRange.parse(requestedCache.get(framework)?.get(dependencyName) ?? "0.0.0");
-              const nugetFixedVersion = NuGetVersion.parse(fixedVersion);
-              conflictCache.computeIfAbsent(framework, Cache.create).putIfAbsent(dependencyName, !nugetRange.contains(nugetFixedVersion));
-              const updatedNugetRange = NuGetRange.combineRanges(nugetRange, NuGetRange.combineVersions(nugetFixedVersion));
-              requestedCache.computeIfAbsent(framework, Cache.create).set(dependencyName, updatedNugetRange.toString());
-            }
-          );
+          const framework = dependencyTree.transitiveDependencies[dependencyIdentifier].framework;
+          if (framework && typeCache.get(framework)?.get(dependencyName) === "Direct") {
+            const nugetRange = NuGetRange.parse(requestedCache.get(framework)?.get(dependencyName) ?? "0.0.0");
+            const nugetFixedVersion = NuGetVersion.parse(fixedVersion);
+            conflictCache.computeIfAbsent(framework, Cache.create).putIfAbsent(dependencyName, !nugetRange.contains(nugetFixedVersion));
+            const updatedNugetRange = NuGetRange.combineRanges(nugetRange, NuGetRange.combineVersions(nugetFixedVersion));
+            requestedCache.computeIfAbsent(framework, Cache.create).set(dependencyName, updatedNugetRange.toString());
+          }
         });
         await applySeries(vulnFixes, async ({ dependencyIdentifier, dependencyName, fixedVersion }) => {
-          await applySeries(
-            dependencyTree.transitiveDependencies[dependencyIdentifier].frameworks ?? [],
-            async (framework) => await this.addPackage(dependencyName, fixedVersion, framework, wsPath)
-          );
+          const framework = dependencyTree.transitiveDependencies[dependencyIdentifier].framework;
+          if (framework) {
+            await this.addPackage(dependencyName, fixedVersion, framework, wsPath);
+          }
         });
         const lockFileWithFixes = await this.restoreWorkspaceAndParseLockFile(wsPath);
         Object.entries(lockFileWithFixes.dependencies).forEach(([framework, nameToDetails]) => {
@@ -89097,29 +89099,16 @@ var init_nuget_fixing_manager = __esm({
         });
         await (0, import_promises9.writeFile)(projectFilePath, initialProjectFile);
         await applySeries(vulnFixes, async ({ dependencyIdentifier, dependencyName }) => {
-          await applySeries(
-            dependencyTree.transitiveDependencies[dependencyIdentifier].frameworks?.filter(
-              (framework) => conflictCache.get(framework)?.get(dependencyName)
-            ) ?? [],
-            // Add dependency with the updated version range that accomodates the fixed version.
-            // Using this range, instead of 'fixedVersion' or '[fixedVersion]' avoids .NET downgrade error.
-            // A downgrade error happens in the following case:
-            // - Project file for workspace A specifies dependency D at version range r1
-            // - Project file for workspace B specifies dependency on workspace A and on dependency D at range r2
-            // - The lower bound for r2 is less than the lower bound for r1
-            // Assuming the fix version is an upgrade, using the updated requested range will keep the lower
-            // bound on r1 after applying a fix to workspace A.
-            // Note, if fixed version can be a downgrade, applying a fix to workspace B *can* introduce a downgrade error!
-            async (framework) => {
-              const updatedRange = requestedCache.get(framework)?.get(dependencyName);
-              if (!updatedRange) {
-                throw new Error(
-                  `unexpected empty requested cache for dependency ${dependencyName}, framework ${framework}, workspace ${wsPath}`
-                );
-              }
-              await this.addPackage(dependencyName, updatedRange.toString(), framework, wsPath);
+          const framework = dependencyTree.transitiveDependencies[dependencyIdentifier].framework;
+          if (framework && conflictCache.get(framework)?.get(dependencyName)) {
+            const updatedRange = requestedCache.get(framework)?.get(dependencyName);
+            if (!updatedRange) {
+              throw new Error(
+                `unexpected empty requested cache for dependency ${dependencyName}, framework ${framework}, workspace ${wsPath}`
+              );
             }
-          );
+            await this.addPackage(dependencyName, updatedRange.toString(), framework, wsPath);
+          }
         });
         await (0, import_promises9.writeFile)(this.getLockFilePath(wsPath), JSON.stringify(lockFileWithFixes, null, 2));
       }
@@ -193993,7 +193982,7 @@ var require_version = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.version = void 0;
-    exports2.version = "14.0.11";
+    exports2.version = "14.0.13";
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.0.11",
+  "version": "14.0.13",
   "description": "Coana CLI",
   "bin": {
     "@coana-tech/cli": "./cli.js"