report the current version as latest if nothing can be found (#9234)

Co-authored-by: AbdulFattaah Popoola <abdulapopoola@github.com>

nuget/lib/dependabot/nuget/update_checker.rb

@@ -17,7 +17,8 @@ def latest_version
         # No need to find latest version for transitive dependencies unless they have a vulnerability.
         return dependency.version if !dependency.top_level? && !vulnerable?
 
-        @latest_version = latest_version_details&.fetch(:version)
+        # if no update sources have the requisite package, then we can only assume that the current version is correct
+        @latest_version = latest_version_details&.fetch(:version) || dependency.version
       end
 
       def latest_resolvable_version

nuget/spec/dependabot/nuget/update_checker_spec.rb

@@ -56,6 +56,10 @@ def nuspec_url(name, version)
     "https://api.nuget.org/v3-flatcontainer/#{name.downcase}/#{version}/#{name.downcase}.nuspec"
   end
 
+  def registration_index_url(name)
+    "https://api.nuget.org/v3/registration5-gz-semver2/#{name.downcase}/index.json"
+  end
+
   describe "up_to_date?" do
     subject(:up_to_date?) { checker.up_to_date? }
 
@@ -103,6 +107,17 @@ def nuspec_url(name, version)
 
       expect(checker.latest_version).to eq("dummy_version")
     end
+
+    context "the package could not be found on any source" do
+      before do
+        stub_request(:get, registration_index_url("microsoft.extensions.dependencymodel"))
+          .to_return(status: 404)
+      end
+
+      it "reports the current version" do
+        expect(checker.latest_version).to eq("1.1.1")
+      end
+    end
   end
 
   describe "#lowest_security_fix_version" do