@coana-tech/cli 14.6.2 → 14.6.3

package/cli.mjs

@@ -184343,20 +184343,24 @@ var NugetFixingManager = class {
     });
     const conflictCache = new Cache();
     await applySeries(vulnFixes, async ({ dependencyIdentifier, dependencyName, fixedVersion }) => {
-      const framework = dependencyTree.transitiveDependencies[dependencyIdentifier].framework;
-      if (framework && typeCache.get(framework)?.get(dependencyName) === "Direct") {
-        const nugetRange = NuGetRange.parse(requestedCache.get(framework)?.get(dependencyName) ?? "0.0.0");
-        const nugetFixedVersion = NuGetVersion.parse(fixedVersion);
-        conflictCache.computeIfAbsent(framework, Cache.create).putIfAbsent(dependencyName, !nugetRange.contains(nugetFixedVersion));
-        const updatedNugetRange = NuGetRange.combineRanges(nugetRange, NuGetRange.combineVersions(nugetFixedVersion));
-        requestedCache.computeIfAbsent(framework, Cache.create).set(dependencyName, updatedNugetRange.toString());
-      }
+      await applySeries(
+        dependencyTree.transitiveDependencies[dependencyIdentifier].frameworks?.filter(
+          (framework) => typeCache.get(framework)?.get(dependencyName) === "Direct"
+        ) ?? [],
+        async (framework) => {
+          const nugetRange = NuGetRange.parse(requestedCache.get(framework)?.get(dependencyName) ?? "0.0.0");
+          const nugetFixedVersion = NuGetVersion.parse(fixedVersion);
+          conflictCache.computeIfAbsent(framework, Cache.create).putIfAbsent(dependencyName, !nugetRange.contains(nugetFixedVersion));
+          const updatedNugetRange = NuGetRange.combineRanges(nugetRange, NuGetRange.combineVersions(nugetFixedVersion));
+          requestedCache.computeIfAbsent(framework, Cache.create).set(dependencyName, updatedNugetRange.toString());
+        }
+      );
     });
     await applySeries(vulnFixes, async ({ dependencyIdentifier, dependencyName, fixedVersion }) => {
-      const framework = dependencyTree.transitiveDependencies[dependencyIdentifier].framework;
-      if (framework) {
-        await this.addPackage(dependencyName, fixedVersion, framework, wsPath);
-      }
+      await applySeries(
+        dependencyTree.transitiveDependencies[dependencyIdentifier].frameworks ?? [],
+        async (framework) => await this.addPackage(dependencyName, fixedVersion, framework, wsPath)
+      );
     });
     const lockFileWithFixes = await this.restoreWorkspaceAndParseLockFile(wsPath);
     Object.entries(lockFileWithFixes.dependencies).forEach(([framework, nameToDetails]) => {
@@ -184376,16 +184380,29 @@ var NugetFixingManager = class {
     });
     await writeFile7(projectFilePath, initialProjectFile);
     await applySeries(vulnFixes, async ({ dependencyIdentifier, dependencyName }) => {
-      const framework = dependencyTree.transitiveDependencies[dependencyIdentifier].framework;
-      if (framework && conflictCache.get(framework)?.get(dependencyName)) {
-        const updatedRange = requestedCache.get(framework)?.get(dependencyName);
-        if (!updatedRange) {
-          throw new Error(
-            `unexpected empty requested cache for dependency ${dependencyName}, framework ${framework}, workspace ${wsPath}`
-          );
+      await applySeries(
+        dependencyTree.transitiveDependencies[dependencyIdentifier].frameworks?.filter(
+          (framework) => conflictCache.get(framework)?.get(dependencyName)
+        ) ?? [],
+        // Add dependency with the updated version range that accomodates the fixed version.
+        // Using this range, instead of 'fixedVersion' or '[fixedVersion]' avoids .NET downgrade error.
+        // A downgrade error happens in the following case:
+        // - Project file for workspace A specifies dependency D at version range r1
+        // - Project file for workspace B specifies dependency on workspace A and on dependency D at range r2
+        // - The lower bound for r2 is less than the lower bound for r1
+        // Assuming the fix version is an upgrade, using the updated requested range will keep the lower
+        // bound on r1 after applying a fix to workspace A.
+        // Note, if fixed version can be a downgrade, applying a fix to workspace B *can* introduce a downgrade error!
+        async (framework) => {
+          const updatedRange = requestedCache.get(framework)?.get(dependencyName);
+          if (!updatedRange) {
+            throw new Error(
+              `unexpected empty requested cache for dependency ${dependencyName}, framework ${framework}, workspace ${wsPath}`
+            );
+          }
+          await this.addPackage(dependencyName, updatedRange.toString(), framework, wsPath);
         }
-        await this.addPackage(dependencyName, updatedRange.toString(), framework, wsPath);
-      }
+      );
     });
     await writeFile7(this.getLockFilePath(wsPath), JSON.stringify(lockFileWithFixes, null, 2));
   }
@@ -202423,7 +202440,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version2 = "14.6.2";
+var version2 = "14.6.3";
 
 // dist/cli-core.js
 var { omit, partition, pick } = import_lodash12.default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.6.2",
+  "version": "14.6.3",
   "description": "Coana CLI",
   "type": "module",
   "bin": {