C#: preserve declared dependency version ranges on ResolvedPackage - #8735
Open
macsux wants to merge 2 commits into
Open
C#: preserve declared dependency version ranges on ResolvedPackage#8735macsux wants to merge 2 commits into
macsux wants to merge 2 commits into
Conversation
The lock file records both a resolved version and the version range each package declared for its children. Only the resolved version was carried into the MSBuildProject marker, so consumers could not tell what range a dependency was originally declared with. Add a `dependencyRanges` map to `ResolvedPackage` on both the Java and C# sides, populate it from the NuGet lock file `dependencies` section, and send it over RPC as parallel key/value lists.
…nstances The RPC layer materializes 'before' skeletons without running the constructor, so dependencyRanges is null despite its default. The list fields already tolerate this via receiveList; the new map codec dereferenced the map directly and NPE'd on every marker round-trip (CSharpRecipeTest/CSharpParseProjectTest in integTest). Guard both the send and receive paths on both the Java and C# sides.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The NuGet lock file records both a resolved version and the version range each package declared for its children, but only the resolved version was carried into the
MSBuildProjectmarker — so consumers could not tell what range a dependency was originally declared with (needed for dependency vulnerability analysis).This adds a
dependencyRangesmap (child package id → normalized version range) toResolvedPackageon both the Java and C# sides, populates it from the lock filedependenciessection inMSBuildProjectHelper, and serializes it over RPC as parallel key/value lists. Tests were added on both sides covering a package with declared ranges and one without.:rewrite-csharp:test --tests "*MSBuildProjectTest*"and:rewrite-csharp:csharpTest(2363 tests) both pass locally.