Contribute changes to NuGet updater from Azure team

[brettfo]

Contribute NuGet changes back to the community

Internally at Microsoft we've been making some updates to the NuGet dependabot updater and are now in a position to contribute those changes back to the community. We're excited to be able to do this and hope that it will help improve the experience for everyone.

This work was announced by Bryan Sullivan at Microsoft Build 2023 in May of this year.

Summary of improvements

• Rewrite core updater logic in C#. External contributors that want to make further improvements will likely be more comfortable working in a .NET environment with Visual Studio. Some Ruby code still exists to take advantage of the functionality offered in the base updaters.
• Use code from the NuGet project (via a submodule) to handle updates for packages.config scenarios. This ensures that we're using as close to the same logic as possible as the NuGet CLI to update the references.
• Use MSBuild to compute the complete list of .props and .targets files that are imported, regardless of any complicated path computations. This ensures that for each project file being analyzed, we can better determine the exact file that declares the package version. This can be particularly helpful in large monorepos.
• Propertly handle updates to implicit dependencies. This is particularly useful for SDK-style projects that may not explicitly list all of their dependencies.
• Propertly handle updates to peer dependencies. This will help reduce build failues in generated pull requests by ensuring that all applicable packages are updated together.
• Update binding redirect assembly versions in app.config/web.config files. Without these changes the user's app will likely fail to load the assemblies at runtime, making these errors hard to detect.

Notes

Part of the NuGet updater work (i.e., supporting packages.config) required code from the NuGet/NuGet.Client repo. The specific code required only exists as a Windows console app targeting net472 (see nuget.org/downloads) and the NuGet team does not want contributions back to allow this to build on Linux/net7.0 (I asked) so to avoid copying the entire repo, a submodule was added tied to the latest public release. To help make local development easier, the NuGet build script checks for a sentinel file in that submodule and if it's not present, will report the command the developer can use to fix the issue.

Related PRs

There were a number of other internal improvements that we made that have been split into separate PRs:

• report extra information if a repo can't be found #8191
• port Docker updater improvements from Azure DevOps #8192
• stop processing if updated_deps is empty #8193
• fix markdown header formatting #8194

Caveats

There will be a few more changes from our side that I'll add to this PR as appropriate, but wanted to get the ball rolling on review and feedback.

I'll separately be working on cleaning up the git history to remove duplicate commits. When that work is done I'll force-push to this branch to help ensure a clean merge when it's all complete.

As of internal commit 15e3b8d09374468e40d8d77bafc1c01178db444c

Closed issues

• Closes Leaf level dependencies should be updated first #6710.
• Closes NuGet: package update is offered that is incompatible with the target framework #8183.

[deivid-rodriguez]

I made a quick pass commenting on some stuff that seems general and not necessarily related to NuGet.

It'd be nice to discuss & merge those changes independently through separate PRs.

[2PintChristianN]

So this needs to be reverted or fixed, preferrably also with a unit test that makes sure wildcard version strings isn't broken again
#9442 (comment)