github · michaelnebel · Nov 25, 2025 · Nov 25, 2025 · Dec 4, 2025 · Dec 4, 2025
@@ -16,5 +16,6 @@ codeql_csharp_library(
         "//csharp/extractor/Semmle.Extraction.CSharp",
         "//csharp/extractor/Semmle.Util",
         "@paket.main//newtonsoft.json",
+        "@paket.main//nuget.versioning",
     ],
 )
@@ -283,7 +283,7 @@ private void AddNetFrameworkDlls(ISet<AssemblyLookupLocation> dllLocations, ISet
             {
                 foreach (var fp in frameworkPaths)
                 {
-                    dotnetFrameworkVersionVariantCount += NugetPackageRestorer.GetOrderedPackageVersionSubDirectories(fp.Path!).Length;
+                    dotnetFrameworkVersionVariantCount += nugetPackageRestorer.GetOrderedPackageVersionSubDirectories(fp.Path!).Length;
                 }
 
                 var folder = nugetPackageRestorer.GetNewestNugetPackageVersionFolder(frameworkPath.Path, ".NET Framework");

@@ -77,7 +77,7 @@ private string GetRestoreArgs(RestoreSettings restoreSettings)
                     Directory.CreateDirectory(path);
                 }
 
-                args += $" /p:TargetFrameworkRootPath=\"{path}\" /p:NetCoreTargetingPackRoot=\"{path}\"";
+                args += $" /p:TargetFrameworkRootPath=\"{path}\" /p:NetCoreTargetingPackRoot=\"{path}\" /p:AllowMissingPrunePackageData=true";
             }
 
             if (restoreSettings.PathToNugetConfig != null)

@@ -1,24 +1,16 @@
 using System;
 using System.IO;
+using NuGet.Versioning;
 
 namespace Semmle.Extraction.CSharp.DependencyFetching
 {
     internal record DotNetVersion : IComparable<DotNetVersion>
     {
         private readonly string dir;
-        private readonly Version version;
-        private readonly Version? preReleaseVersion;
-        private readonly string? preReleaseVersionType;
-        private bool IsPreRelease => preReleaseVersionType is not null && preReleaseVersion is not null;
+        private readonly NuGetVersion version;
 
-        private string FullVersion
-        {
-            get
-            {
-                var preRelease = IsPreRelease ? $"-{preReleaseVersionType}.{preReleaseVersion}" : "";
-                return this.version + preRelease;
-            }
-        }
+        private string FullVersion =>
+            version.ToString();
 
         public string FullPath => Path.Combine(dir, FullVersion);
 
@@ -48,37 +40,14 @@ public string? FullPathReferenceAssemblies
         }
 
 
-        public DotNetVersion(string dir, string version, string preReleaseVersionType, string preReleaseVersion)
+        public DotNetVersion(string dir, NuGetVersion version)
         {
             this.dir = dir;
-            this.version = Version.Parse(version);
-            if (!string.IsNullOrEmpty(preReleaseVersion) && !string.IsNullOrEmpty(preReleaseVersionType))
-            {
-                this.preReleaseVersionType = preReleaseVersionType;
-                this.preReleaseVersion = Version.Parse(preReleaseVersion);
-            }
+            this.version = version;
         }
 
-        public int CompareTo(DotNetVersion? other)
-        {
-            var c = version.CompareTo(other?.version);
-            if (c == 0 && IsPreRelease)
-            {
-                if (!other!.IsPreRelease)
-                {
-                    return -1;
-                }
-
-                // Both are pre-release like runtime versions.
-                // The pre-release version types are sorted alphabetically (e.g. alpha, beta, preview, rc)
-                // and the pre-release version types are more important that the pre-release version numbers.
-                return preReleaseVersionType != other!.preReleaseVersionType
-                    ? preReleaseVersionType!.CompareTo(other!.preReleaseVersionType)
-                    : preReleaseVersion!.CompareTo(other!.preReleaseVersion);
-            }
-
-            return c;
-        }
+        public int CompareTo(DotNetVersion? other) =>
+            version.CompareTo(other?.version);
 
         public override string ToString() => FullPath;
     }

@@ -10,6 +10,7 @@
 using System.Text.RegularExpressions;
 using System.Threading;
 using System.Threading.Tasks;
+using NuGet.Versioning;
 using Semmle.Util;
 using Semmle.Util.Logging;
 
@@ -87,11 +88,22 @@ public string GetNewestNugetPackageVersionFolder(string packagePath, string pack
             return selectedFrameworkFolder;
         }
 
-        public static DirectoryInfo[] GetOrderedPackageVersionSubDirectories(string packagePath)
+        public DirectoryInfo[] GetOrderedPackageVersionSubDirectories(string packagePath)
         {
+            // Only consider directories with valid NuGet version names.
             return new DirectoryInfo(packagePath)
                 .EnumerateDirectories("*", new EnumerationOptions { MatchCasing = MatchCasing.CaseInsensitive, RecurseSubdirectories = false })
-                .OrderByDescending(d => d.Name) // TODO: Improve sorting to handle pre-release versions.
+                .SelectMany(d =>
+                {
+                    if (NuGetVersion.TryParse(d.Name, out var version))
+                    {
+                        return new[] { new { Directory = d, NuGetVersion = version } };
+                    }
+                    logger.LogInfo($"Ignoring package directory '{d.FullName}' as it does not have a valid NuGet version name.");
+                    return [];
+                })
+                .OrderByDescending(dw => dw.NuGetVersion)
+                .Select(dw => dw.Directory)
                 .ToArray();
         }
 

@@ -4,6 +4,7 @@
 using System.Linq;
 using System.Runtime.InteropServices;
 using System.Text.RegularExpressions;
+using NuGet.Versioning;
 using Semmle.Util;
 using Semmle.Util.Logging;
 
@@ -27,7 +28,7 @@ public Runtime(IDotNet dotNet)
             this.newestRuntimes = new(GetNewestRuntimes);
         }
 
-        [GeneratedRegex(@"^(\S+)\s(\d+\.\d+\.\d+)(-([a-z]+)\.(\d+\.\d+\.\d+))?\s\[(.+)\]$")]
+        [GeneratedRegex(@"^(\S+)\s(\d+\.\d+\.\d+(-[a-z]+\.\d+\.\d+\.\d+)?)\s\[(.+)\]$")]
         private static partial Regex RuntimeRegex();
 
         /// <summary>
@@ -44,9 +45,9 @@ private static Dictionary<string, DotNetVersion> ParseRuntimes(IList<string> lis
             listed.ForEach(r =>
             {
                 var match = regex.Match(r);
-                if (match.Success)
+                if (match.Success && NuGetVersion.TryParse(match.Groups[2].Value, out var version))
                 {
-                    runtimes.AddOrUpdateToLatest(match.Groups[1].Value, new DotNetVersion(match.Groups[6].Value, match.Groups[2].Value, match.Groups[4].Value, match.Groups[5].Value));
+                    runtimes.AddOrUpdateToLatest(match.Groups[1].Value, new DotNetVersion(match.Groups[4].Value, version));
                 }
             });
 

@@ -3,6 +3,7 @@
 using System.IO;
 using System.Linq;
 using System.Text.RegularExpressions;
+using NuGet.Versioning;
 using Semmle.Util;
 using Semmle.Util.Logging;
 
@@ -27,7 +28,7 @@ public Sdk(IDotNet dotNet, ILogger logger)
             cscPath = new Lazy<string?>(GetCscPath);
         }
 
-        [GeneratedRegex(@"^(\d+\.\d+\.\d+)(-([a-z]+)\.(\d+\.\d+\.\d+))?\s\[(.+)\]$")]
+        [GeneratedRegex(@"^(\d+\.\d+\.\d+(-[a-z]+\.\d+\.\d+\.\d+)?)\s\[(.+)\]$")]
         private static partial Regex SdkRegex();
 
         private static HashSet<DotNetVersion> ParseSdks(IList<string> listed)
@@ -37,9 +38,9 @@ private static HashSet<DotNetVersion> ParseSdks(IList<string> listed)
             listed.ForEach(r =>
             {
                 var match = regex.Match(r);
-                if (match.Success)
+                if (match.Success && NuGetVersion.TryParse(match.Groups[1].Value, out var version))
                 {
-                    sdks.Add(new DotNetVersion(match.Groups[5].Value, match.Groups[1].Value, match.Groups[3].Value, match.Groups[4].Value));
+                    sdks.Add(new DotNetVersion(match.Groups[3].Value, version));
                 }
             });
 
@@ -73,4 +74,4 @@ private static HashSet<DotNetVersion> ParseSdks(IList<string> listed)
             return path;
         }
     }
-}
+}
@@ -1 +1,2 @@
 Newtonsoft.Json
+NuGet.Versioning
@@ -7,6 +7,7 @@ strategy: max
 nuget Basic.CompilerLog.Util 0.9.21
 nuget Mono.Posix.NETStandard
 nuget Newtonsoft.Json
+nuget NuGet.Versioning
 nuget xunit
 nuget xunit.runner.visualstudio
 nuget xunit.runner.utility