V0.10.0/dotnet nuget update

[gimlichael]

This pull request introduces the new dotnet-nuget-update skill, a deterministic tool for auditing and updating NuGet dependencies in .NET repositories. It ensures every declared package version is accounted for before any update, supports both central and project-level package management, preserves compatibility markers, and offers both interactive and automated update modes. The update also adds comprehensive documentation, test coverage, and offline-testable scripts.

New skill: dotnet-nuget-update

• Introduces the dotnet-nuget-update skill for complete NuGet dependency auditing and updating, supporting central and project-level versioning, TFM-band awareness, stable/prerelease intent inference, and two interactive modes (normal and yolo). [1] [2]
• Bundles deterministic scripts for dependency graph enumeration, package version resolution, TFM matrix discovery, and minimal XML edits that preserve comments and structure.
• Implements per-process memoization for NuGet feeds and supports deterministic offline testing via filesystem fixtures.
• Enforces a complete-audit invariant and preserves XML comments as update notes, requiring explicit attention for rationale-marked updates.
• Documents the skill in the README.md with catalog entry, installation instructions, and a detailed "Why dotnet-nuget-update?" section explaining its approach to dependency management. [1] [2] [3]

Release and documentation updates

• Adds a new 0.10.0 release entry in CHANGELOG.md describing the new skill and its features.
• Links the new release in the version history section.

[greptile-apps]

Greptile Summary

This PR introduces the dotnet-nuget-update skill and its deterministic PowerShell tooling for auditing, resolving, and applying NuGet dependency updates.

• Supports central and project-level package declarations.
• Adds TFM-band and stable/prerelease-aware resolution.
• Preserves targeted XML structure and formatting during updates.
• Adds offline fixtures, regression tests, documentation, and the 0.10.0 changelog entry.
• The change since the previous review decodes raw XML condition text before matching it against audit output.

Confidence Score: 4/5

The PR is not yet safe to merge because target-framework discovery can still resolve one project’s property-based TFM using properties collected from another project.

The outstanding previous finding in Get-TargetFrameworks.ps1 remains untouched: repository-wide merging of properties from unrelated .props and .targets files can produce an incorrect validation framework for multi-project repositories. Twelve other previous threads were manually resolved without explanatory replies and do not remain outstanding.

Files Needing Attention: skills/dotnet-nuget-update/scripts/Get-TargetFrameworks.ps1

Important Files Changed

Filename	Overview
skills/dotnet-nuget-update/scripts/Apply-PackageUpdates.ps1	Adds XML-entity decoding to align raw condition matching with XML-parsed audit conditions; no new defect was identified.
skills/dotnet-nuget-update/scripts/Get-DependencyAudit.ps1	Implements complete central and project-level declaration enumeration and update classification.
skills/dotnet-nuget-update/scripts/Get-TargetFrameworks.ps1	Discovers the validation TFM matrix, but the unresolved previous finding about globally shared project properties remains.
skills/dotnet-nuget-update/scripts/_common.ps1	Provides shared version, feed, TFM-band, XML-comment, and text-preservation helpers.
skills/dotnet-nuget-update/SKILL.md	Defines the complete-audit-first NuGet update workflow, operating modes, safeguards, validation, and reporting contract.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Enumerate package declarations] --> B[Complete dependency audit]
    B --> C[Resolve compatible versions]
    C --> D{Update class}
    D -->|Current| E[Report unchanged]
    D -->|Patch, minor, revision, prerelease| F[Apply targeted XML edit]
    D -->|Major| G[Approve or hold]
    D -->|Unresolved| H[Report manual follow-up]
    F --> I[Re-audit and validate]
    G --> I

Loading

_{Reviews (4): Last reviewed commit: "🐛 fix xml entity decoding in condition ..." | Re-trigger Greptile}

[greptile-apps]

Project Properties Leak Globally

In a multi-project repository with conflicting nested properties, this code merges properties from every .props and .targets file into one global map and applies it to every project, regardless of the project's actual imports. A property-based TFM can therefore resolve using another project's value, causing validation to omit the real framework or test the wrong one.

Prompt To Fix With AI

This is a comment left during a code review.
Path: skills/dotnet-nuget-update/scripts/Get-TargetFrameworks.ps1
Line: 135-145

Comment:
**Project Properties Leak Globally**

In a multi-project repository with conflicting nested properties, this code merges properties from every `.props` and `.targets` file into one global map and applies it to every project, regardless of the project's actual imports. A property-based TFM can therefore resolve using another project's value, causing validation to omit the real framework or test the wrong one.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.