Support .NET 9 (#10593)

* Support .NET 9

Support .NET 9 by installing both the STS and LTS releases of .NET.

* Fix NuGet audit warnings

Try to fix warnings building NuGetUpdater with the .NET 9 SDK from NuGet Audit.

* Disable NuGet audit

Disable NuGet audit when running the native C# tests, as they don't seem to otherwise obey the changes in Directory.Build.props of the project itself.

* Update expected test output
Update tests for the changes to the output format of `dotnet test` in .NET 9.

* Enable terminal logger
Forcibly enable the terminal logger in CI so the expected test output is present.

* Run tests with .NET 8 SDK
Attempt to run the tests with the .NET 8 SDK instead of .NET 9 to see if it fixes the failing tests.

* Fix type annotations
Add cwd.

* Update specs
Account for extra parameter.

* Revert expected output
Revert to the expected output for .NET 8 SDK.

* Fix tests
    - Fix tests broken by error about usage of CPVM.
    - Update Microsoft.Windows.SDK.NET.Ref version.

* Fix test
Add missing line to expected contents.

* Add C# Dev Kit
Add the C# Dev Kit extension to the devcontainers.

* Add .NET 9 to devcontainer
Install the .NET 9 SDK in the devcontainer.

* Update to .NET 9
Update NuGetUpdater to target .NET 9 so that tests can test compatibility with `net9.0`.

* Update target framework
Update script to build for .NET 9.

* Update assertion for terminal logger
Update the assertions for the Ruby tests for C# to account for the behaviour changes for the new terminal logger.

.devcontainer/core-dev/devcontainer.json

@@ -83,7 +83,8 @@
       "extensions": [
         "ms-vscode-remote.remote-containers",
         "rubocop.vscode-rubocop",
-        "shopify.ruby-extensions-pack"
+        "shopify.ruby-extensions-pack",
+        "ms-dotnettools.csdevkit"
       ],
       "settings": {
         "[ruby]": {

.devcontainer/devcontainer.json

@@ -35,7 +35,8 @@
       "extensions": [
         "ms-vscode-remote.remote-containers",
         "rubocop.vscode-rubocop",
-        "shopify.ruby-extensions-pack"
+        "shopify.ruby-extensions-pack",
+        "ms-dotnettools.csdevkit"
       ],
       "settings": {
         "[ruby]": {

.devcontainer/post-create.sh

@@ -4,10 +4,11 @@ tar xzvf ./*.tar.gz >/dev/null 2>&1
 sudo mv dependabot /usr/local/bin
 rm ./*.tar.gz
 
-# The image comes loaded with 8.0 preview SDK, but we need a stable 7.0 runtime for running tests
+# The image comes loaded with 8.0 SDK, but we need the 7.0 and 9.0 runtimes for running tests
 sudo wget https://dot.net/v1/dotnet-install.sh
 sudo chmod +x dotnet-install.sh
-sudo ./dotnet-install.sh -c 7.0 --runtime dotnet --install-dir /usr/local/dotnet/current
+sudo ./dotnet-install.sh -c 7.0 --runtime dotnet --install-dir /usr/share/dotnet/shared
+sudo ./dotnet-install.sh -c 9.0 --install-dir /usr/share/dotnet
 sudo rm ./dotnet-install.sh
 
 echo "export LOCAL_GITHUB_ACCESS_TOKEN=$GITHUB_TOKEN" >> ~/.bashrc

common/lib/dependabot/shared_helpers.rb

@@ -419,13 +419,15 @@ def self.find_safe_directories
       params(
         command: String,
         allow_unsafe_shell_command: T::Boolean,
+        cwd: T.nilable(String),
         env: T.nilable(T::Hash[String, String]),
         fingerprint: T.nilable(String),
         stderr_to_stdout: T::Boolean
       ).returns(String)
     end
     def self.run_shell_command(command,
                                allow_unsafe_shell_command: false,
+                               cwd: nil,
                                env: {},
                                fingerprint: nil,
                                stderr_to_stdout: true)
@@ -434,10 +436,13 @@ def self.run_shell_command(command,
 
       puts cmd if ENV["DEBUG_HELPERS"] == "true"
 
+      opts = {}
+      opts[:chdir] = cwd if cwd
+
       if stderr_to_stdout
-        stdout, process = Open3.capture2e(env || {}, cmd)
+        stdout, process = Open3.capture2e(env || {}, cmd, opts)
       else
-        stdout, stderr, process = Open3.capture3(env || {}, cmd)
+        stdout, stderr, process = Open3.capture3(env || {}, cmd, opts)
       end
 
       time_taken = Time.now - start

github_actions/spec/dependabot/github_actions/update_checker_spec.rb

@@ -486,14 +486,14 @@
         allow(Dir).to receive(:chdir).and_yield
 
         allow(Open3).to receive(:capture2e)
-          .with(anything, %r{git clone --no-recurse-submodules https://github\.com/actions/setup-node})
+          .with(anything, %r{git clone --no-recurse-submodules https://github\.com/actions/setup-node}, anything)
           .and_return(["", exit_status])
       end
 
       context "when it's in the current (default) branch" do
         before do
           allow(Open3).to receive(:capture2e)
-            .with(anything, "git branch --remotes --contains #{reference}")
+            .with(anything, "git branch --remotes --contains #{reference}", anything)
             .and_return(["  origin/HEAD -> origin/master\n  origin/master", exit_status])
         end
 
@@ -507,7 +507,7 @@
 
         before do
           allow(Open3).to receive(:capture2e)
-            .with(anything, "git branch --remotes --contains #{reference}")
+            .with(anything, "git branch --remotes --contains #{reference}", anything)
             .and_return(["  origin/releases/v1\n", exit_status])
         end
 
@@ -519,7 +519,7 @@
       context "when multiple branches include it and the current (default) branch among them" do
         before do
           allow(Open3).to receive(:capture2e)
-            .with(anything, "git branch --remotes --contains #{reference}")
+            .with(anything, "git branch --remotes --contains #{reference}", anything)
             .and_return(["  origin/HEAD -> origin/master\n  origin/master\n  origin/v1.1\n", exit_status])
         end
 
@@ -531,7 +531,7 @@
       context "when multiple branches include it and the current (default) branch NOT among them" do
         before do
           allow(Open3).to receive(:capture2e)
-            .with(anything, "git branch --remotes --contains #{reference}")
+            .with(anything, "git branch --remotes --contains #{reference}", anything)
             .and_return(["  origin/3.3-stable\n  origin/production\n", exit_status])
         end
 

nuget/Dockerfile

@@ -17,7 +17,8 @@ RUN apt-get update \
  && rm -rf /var/lib/apt/lists/*
 
 # Install .NET SDK
-ARG DOTNET_SDK_VERSION=8.0.303
+ARG DOTNET_LTS_SDK_VERSION=8.0.402
+ARG DOTNET_STS_SDK_VERSION=9.0.100-rc.1.24452.12
 ARG DOTNET_SDK_INSTALL_URL=https://dot.net/v1/dotnet-install.sh
 ENV DOTNET_INSTALL_DIR=/usr/local/dotnet/current
 ENV DOTNET_INSTALL_SCRIPT_PATH=/tmp/dotnet-install.sh
@@ -30,7 +31,8 @@ ENV NUGET_SCRATCH=/opt/nuget/helpers/tmp
 RUN curl --location --output "${DOTNET_INSTALL_SCRIPT_PATH}" "${DOTNET_SDK_INSTALL_URL}" \
  && chmod +x "${DOTNET_INSTALL_SCRIPT_PATH}" \
  && mkdir -p "${DOTNET_INSTALL_DIR}" \
- && "${DOTNET_INSTALL_SCRIPT_PATH}" --version "${DOTNET_SDK_VERSION}" --install-dir "${DOTNET_INSTALL_DIR}" \
+ && "${DOTNET_INSTALL_SCRIPT_PATH}" --version "${DOTNET_LTS_SDK_VERSION}" --install-dir "${DOTNET_INSTALL_DIR}" \
+ && "${DOTNET_INSTALL_SCRIPT_PATH}" --version "${DOTNET_STS_SDK_VERSION}" --install-dir "${DOTNET_INSTALL_DIR}" \
  && chown -R dependabot:dependabot "$DOTNET_INSTALL_DIR"
 ENV PATH="${PATH}:${DOTNET_INSTALL_DIR}"
 RUN dotnet --list-runtimes

nuget/helpers/build

@@ -32,7 +32,7 @@ cd "$install_dir/lib/NuGetUpdater/NuGetUpdater.Cli"
 dotnet publish \
     --configuration Release \
     --output "$install_dir/NuGetUpdater" \
-    --framework net8.0 \
+    --framework net9.0 \
     --runtime "$os-$arch"
 dotnet clean
 

nuget/helpers/lib/NuGetUpdater/Directory.Build.props

@@ -1,6 +1,7 @@
 <Project>
 
   <PropertyGroup>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <NoWarn>$(NoWarn);NU1701</NoWarn>
     <Nullable>enable</Nullable>
   </PropertyGroup>

nuget/helpers/lib/NuGetUpdater/Directory.Common.props

@@ -9,7 +9,7 @@
             NuGetUpdater\NuGetUpdater.Core\FrameworkChecker\SupportedFrameworks.cs
       2. Update tests as needed at `NuGetUpdater\NuGetUpdater.Core.Test\FrameworkChecker\CompatibilityCheckerFacts.cs`
     -->
-    <CommonTargetFramework>net8.0</CommonTargetFramework>
+    <CommonTargetFramework>net9.0</CommonTargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <UseArtifactsOutput>true</UseArtifactsOutput>
     <ArtifactsPath>$(MSBuildThisFileDirectory)artifacts</ArtifactsPath>

nuget/helpers/lib/NuGetUpdater/Directory.Packages.props

@@ -20,6 +20,11 @@
     <PackageVersion Include="NuGet.Core" Version="2.14.0-rtm-832" Aliases="CoreV2" />
 
     <PackageVersion Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
+    <PackageVersion Include="System.Net.Http" Version="4.3.4" />
+    <PackageVersion Include="System.Formats.Asn1" Version="8.0.1" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.0" />
+    <PackageVersion Include="System.Text.Json" Version="8.0.4" />
+    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
 
     <PackageVersion Include="xunit" Version="2.4.2" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="2.4.5" />

nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/MockNuGetPackage.cs

@@ -391,6 +391,7 @@ public static MockNuGetPackage WellKnownReferencePackage(string packageName, str
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net6.0"),
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net7.0"),
             WellKnownReferencePackage("Microsoft.AspNetCore.App", "net8.0"),
+            WellKnownReferencePackage("Microsoft.AspNetCore.App", "net9.0"),
             WellKnownReferencePackage("Microsoft.NETCore.App", "net6.0",
             [
                 ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
@@ -412,9 +413,17 @@ public static MockNuGetPackage WellKnownReferencePackage(string packageName, str
                     </FileList>
                     """))
             ]),
+            WellKnownReferencePackage("Microsoft.NETCore.App", "net9.0",
+            [
+                ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
+                    <FileList TargetFrameworkIdentifier=".NETCoreApp" TargetFrameworkVersion="9.0" FrameworkName="Microsoft.NETCore.App" Name=".NET Runtime">
+                    </FileList>
+                    """))
+            ]),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net6.0"),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net7.0"),
             WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net8.0"),
+            WellKnownReferencePackage("Microsoft.WindowsDesktop.App", "net9.0"),
         ];
     }
 }

nuget/helpers/lib/NuGetUpdater/NuGetUpdater.Core.Test/Update/UpdateWorkerTests.Sdk.cs

@@ -16,6 +16,7 @@ public class Sdk : UpdateWorkerTestBase
         [InlineData("net472")]
         [InlineData("net7.0")]
         [InlineData("net8.0")]
+        [InlineData("net9.0")]
         public async Task UpdateVersionAttribute_InProjectFile_ForPackageReferenceInclude(string tfm)
         {
             // update Some.Package from 9.0.1 to 13.0.1
@@ -186,6 +187,7 @@ await TestUpdateForProject("Some.Package", "12.0.1", "13.0.1",
                 projectContents: $"""
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
                       <ItemGroup>
@@ -199,6 +201,7 @@ await TestUpdateForProject("Some.Package", "12.0.1", "13.0.1",
                     (Path: "src/Project/Project.csproj", Content: """
                         <Project Sdk="Microsoft.NET.Sdk">
                           <PropertyGroup>
+                            <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                             <TargetFramework>net8.0</TargetFramework>
                           </PropertyGroup>
                           <ItemGroup>
@@ -211,6 +214,7 @@ await TestUpdateForProject("Some.Package", "12.0.1", "13.0.1",
                 expectedProjectContents: $"""
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
                       <ItemGroup>
@@ -224,6 +228,7 @@ await TestUpdateForProject("Some.Package", "12.0.1", "13.0.1",
                     (Path: "src/Project/Project.csproj", Content: """
                         <Project Sdk="Microsoft.NET.Sdk">
                           <PropertyGroup>
+                            <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                             <TargetFramework>net8.0</TargetFramework>
                           </PropertyGroup>
                           <ItemGroup>
@@ -244,7 +249,7 @@ await TestUpdateForProject("Some.Package", "9.0.1", "13.0.1",
                     MockNuGetPackage.CreateSimplePackage("Some.Package", "9.0.1", "net8.0"),
                     MockNuGetPackage.CreateSimplePackage("Some.Package", "13.0.1", "net8.0"),
                     // necessary for the `net8.0-windows10.0.19041.0` TFM
-                    new("Microsoft.Windows.SDK.NET.Ref", "10.0.19041.31", Files:
+                    new("Microsoft.Windows.SDK.NET.Ref", "10.0.19041.34", Files:
                     [
                         ("data/FrameworkList.xml", Encoding.UTF8.GetBytes("""
                             <FileList Name="Windows SDK .NET 6.0">
@@ -548,6 +553,7 @@ await TestUpdateForProject("Some.Transient.Dependency", "5.0.1", "5.0.2", isTran
                     <Project Sdk="Microsoft.NET.Sdk">
 
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
 
@@ -562,6 +568,7 @@ await TestUpdateForProject("Some.Transient.Dependency", "5.0.1", "5.0.2", isTran
                     <Project Sdk="Microsoft.NET.Sdk">
 
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
 
@@ -588,6 +595,7 @@ await TestUpdateForProject("Some.Transitive.Package", "1.0.0", "1.0.1", isTransi
                 projectContents: """
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
                       <ItemGroup>
@@ -608,6 +616,7 @@ await TestUpdateForProject("Some.Transitive.Package", "1.0.0", "1.0.1", isTransi
                 expectedProjectContents: """
                     <Project Sdk="Microsoft.NET.Sdk">
                       <PropertyGroup>
+                        <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
                         <TargetFramework>net8.0</TargetFramework>
                       </PropertyGroup>
                       <ItemGroup>

nuget/helpers/lib/NuGetUpdater/global.json

@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "8.0.300",
+    "version": "9.0.100-rc.1.24452.12",
     "rollForward": "latestMinor"
   }
 }

nuget/spec/dependabot/nuget/native_helpers_spec.rb

@@ -110,7 +110,7 @@
 
   describe "#native_csharp_tests" do
     subject(:dotnet_test) do
-      Dependabot::SharedHelpers.run_shell_command(command)
+      Dependabot::SharedHelpers.run_shell_command(command, cwd: cwd)
     end
 
     let(:command) do
@@ -123,14 +123,24 @@
       ].join(" ")
     end
 
+    let(:cwd) do
+      File.join(dependabot_home, "nuget", "helpers", "lib", "NuGetUpdater")
+    end
+
     context "when the output is from `dotnet test NuGetUpdater.Core.Test` output" do
       let(:project_path) do
         File.join(dependabot_home, "nuget", "helpers", "lib", "NuGetUpdater",
                   "NuGetUpdater.Core.Test", "NuGetUpdater.Core.Test.csproj")
       end
 
       it "contains the expected output" do
-        expect(dotnet_test).to include("Passed!")
+        # In CI when the terminal logger is disabled by default in .NET 9 there is no
+        # output from the test runner: https://github.com/dotnet/msbuild/issues/10682.
+        # Instead we have to rely on the cmd invocation failing with a non-zero exit code
+        # if any tests fail. Locally when the terminal logger is enabled we can check
+        # there is an absence of any evidence of test failures in the output.
+        # expect(dotnet_test).to include("Passed!")
+        expect(dotnet_test).not_to include("Build failed")
       end
     end
 
@@ -141,7 +151,13 @@
       end
 
       it "contains the expected output" do
-        expect(dotnet_test).to include("Passed!")
+        # In CI when the terminal logger is disabled by default in .NET 9 there is no
+        # output from the test runner: https://github.com/dotnet/msbuild/issues/10682.
+        # Instead we have to rely on the cmd invocation failing with a non-zero exit code
+        # if any tests fail. Locally when the terminal logger is enabled we can check
+        # there is an absence of any evidence of test failures in the output.
+        # expect(dotnet_test).to include("Passed!")
+        expect(dotnet_test).not_to include("Build failed")
       end
     end
   end