diff --git a/nuget/lib/dependabot/nuget/update_checker.rb b/nuget/lib/dependabot/nuget/update_checker.rb index 054e6c20004..2fcbfd4f878 100644 --- a/nuget/lib/dependabot/nuget/update_checker.rb +++ b/nuget/lib/dependabot/nuget/update_checker.rb @@ -17,7 +17,8 @@ def latest_version # No need to find latest version for transitive dependencies unless they have a vulnerability. return dependency.version if !dependency.top_level? && !vulnerable? - @latest_version = latest_version_details&.fetch(:version) + # if no update sources have the requisite package, then we can only assume that the current version is correct + @latest_version = latest_version_details&.fetch(:version) || dependency.version end def latest_resolvable_version diff --git a/nuget/spec/dependabot/nuget/update_checker_spec.rb b/nuget/spec/dependabot/nuget/update_checker_spec.rb index 54481a7ddf8..aef2d6e4694 100644 --- a/nuget/spec/dependabot/nuget/update_checker_spec.rb +++ b/nuget/spec/dependabot/nuget/update_checker_spec.rb @@ -56,6 +56,10 @@ def nuspec_url(name, version) "https://api.nuget.org/v3-flatcontainer/#{name.downcase}/#{version}/#{name.downcase}.nuspec" end + def registration_index_url(name) + "https://api.nuget.org/v3/registration5-gz-semver2/#{name.downcase}/index.json" + end + describe "up_to_date?" do subject(:up_to_date?) { checker.up_to_date? } @@ -103,6 +107,17 @@ def nuspec_url(name, version) expect(checker.latest_version).to eq("dummy_version") end + + context "the package could not be found on any source" do + before do + stub_request(:get, registration_index_url("microsoft.extensions.dependencymodel")) + .to_return(status: 404) + end + + it "reports the current version" do + expect(checker.latest_version).to eq("1.1.1") + end + end end describe "#lowest_security_fix_version" do