Skip to content

fix(nuget): fall back to nupkg metadata on nuspec 404#44388

Open
eugene-harold-krabs wants to merge 3 commits into
renovatebot:mainfrom
eugene-harold-krabs:fix/105-nuget-nupkg-fallback
Open

fix(nuget): fall back to nupkg metadata on nuspec 404#44388
eugene-harold-krabs wants to merge 3 commits into
renovatebot:mainfrom
eugene-harold-krabs:fix/105-nuget-nupkg-fallback

Conversation

@eugene-harold-krabs

Copy link
Copy Markdown

Changes

  • Fall back to extracting NuGet package metadata from the .nupkg when a v3 feed advertises PackageBaseAddress but the direct .nuspec endpoint returns 404.
  • Keep the existing direct .nuspec path for feeds such as nuget.org, including release notes extraction.
  • Add a regression test for a GitLab-like v3 feed where registration metadata has packageContent, the flat-container .nuspec URL is missing, and the .nupkg contains repository metadata.

Context

Please select one of the following:

  • This closes an existing Issue, Closes: #
  • This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

  • No — I did not use AI for this contribution.
  • Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
  • Yes — substantive assistance (AI-generated non-trivial portions of code, tests, or documentation). OpenAI Codex (GPT-5) analyzed the NuGet datasource path and authored the code/test changes.
  • Yes — other (please describe):

Documentation (please check one with an [x])

  • I have updated the documentation, or
  • No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

  • Code inspection only, or
  • Newly added/modified unit tests, or
  • No unit tests, but ran on a real repository, or
  • Both unit tests + ran on a real repository

Additional local checks:

  • pnpm exec vitest run --coverage=false lib/modules/datasource/nuget/index.spec.ts -t "can determine source URL from nupkg when nuspec endpoint returns 404"
  • pnpm exec vitest run --coverage=false lib/modules/datasource/nuget/index.spec.ts -t "feed is a nuget.org"
  • pnpm exec prettier --check lib/modules/datasource/nuget/v3.ts lib/modules/datasource/nuget/index.spec.ts
  • git diff --check

The public repository: https://github.com/eugene-harold-krabs/renovate/tree/fix/105-nuget-nupkg-fallback

@github-actions github-actions Bot requested a review from viceice July 6, 2026 14:53
@cla-assistant

cla-assistant Bot commented Jul 6, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@xrow

xrow commented Jul 6, 2026

Copy link
Copy Markdown

@viceice Sorry the pull came in so quick without validation from my end.... It auto assinged it to you. @eugene-harold-krabs is my codex. I havn`t validated it yet. From my review though it looks it will solve my problem I have with gitlab. https://gitlab.com/xrow-public/ci-tools/-/work_items/105

What do you think?

@eugene-harold-krabs eugene-harold-krabs force-pushed the fix/105-nuget-nupkg-fallback branch 2 times, most recently from 6a438cb to 80d07fb Compare July 7, 2026 18:02
@xrow

xrow commented Jul 9, 2026

Copy link
Copy Markdown

@viceice Do you need to approve to run the other pending checks? I am not that familiar with github. Please let me know what to do next.

Comment thread lib/modules/datasource/nuget/v3.ts Outdated
dep.sourceUrl = massageUrl(sourceUrl);
}
} catch (err) {
// istanbul ignore if: not easy testable with nock

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/* v8 ignore */

Comment thread lib/modules/datasource/nuget/v3.ts Outdated
Comment on lines +252 to +263
if (err instanceof ExternalHostError) {
throw err;
}
if (err instanceof HttpError && err.response?.statusCode === 404) {
shouldTryNupkg = true;
logger.debug(
{ registryUrl, pkgName, pkgVersion: latestStable },
`package manifest (.nuspec) not found`,
);
} else {
throw err;
}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this can be one if on err instanceof HttpError && err.response?.statusCode === 404 and else.

instea dof two if's and else

@eugene-harold-krabs eugene-harold-krabs force-pushed the fix/105-nuget-nupkg-fallback branch from 80d07fb to a57b87c Compare July 9, 2026 20:26
@eugene-harold-krabs

Copy link
Copy Markdown
Author

Addressed the review feedback in a57b87c: replaced the added Istanbul ignore marker with a V8 ignore marker and collapsed the nested error checks into a single HttpError 404 branch with an else rethrow.\n\nLocal checks run:\n- ./node_modules/.bin/prettier --check lib/modules/datasource/nuget/v3.ts lib/modules/datasource/nuget/index.spec.ts\n- ./node_modules/.bin/vitest run --coverage=false lib/modules/datasource/nuget/index.spec.ts -t "can determine source URL from nupkg when nuspec endpoint returns 404"\n- ./node_modules/.bin/vitest run --coverage=false lib/modules/datasource/nuget/index.spec.ts -t "feed is a nuget.org"\n- git diff --check

});

it('can determine source URL from nupkg when nuspec endpoint returns 404', async () => {
const nugetIndex = `

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wrap in codeBlock

]
}
`;
const nlogRegistration = `

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

codeBlock

Comment on lines +500 to +508
expect(logger.logger.debug).toHaveBeenCalledWith(
{
registryUrl: 'https://some-registry/v3/index.json',
pkgName: 'NLog',
pkgVersion: '4.7.3',
},
'package manifest (.nuspec) not found',
);
expect(logger.logger.debug).toHaveBeenCalledWith(

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

merge into one, i think it's possible using array

@eugene-harold-krabs eugene-harold-krabs force-pushed the fix/105-nuget-nupkg-fallback branch from a57b87c to f0565dd Compare July 10, 2026 08:02
@eugene-harold-krabs

Copy link
Copy Markdown
Author

Addressed the latest review feedback in f0565dd: wrapped the new JSON fixture strings with codeBlock and merged the debug logger expectations into one mock.calls array assertion.

Local checks run:

  • ./node_modules/.bin/prettier --check lib/modules/datasource/nuget/index.spec.ts lib/modules/datasource/nuget/v3.ts
  • ./node_modules/.bin/vitest run --coverage=false lib/modules/datasource/nuget/index.spec.ts -t "can determine source URL from nupkg when nuspec endpoint returns 404"
  • git diff --check

@eugene-harold-krabs

Copy link
Copy Markdown
Author

@RahulGautamSingh Did a review. I think your requests are fullfilled.

@RahulGautamSingh RahulGautamSingh left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants