C#: Use NuGet version sorting instead of lexicographic directory name sorting for finding newest package version.

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/BUILD.bazel

@@ -16,5 +16,6 @@ codeql_csharp_library(
         "//csharp/extractor/Semmle.Extraction.CSharp",
         "//csharp/extractor/Semmle.Util",
         "@paket.main//newtonsoft.json",
+        "@paket.main//nuget.versioning",
     ],
 )

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

@@ -10,6 +10,7 @@
 using System.Text.RegularExpressions;
 using System.Threading;
 using System.Threading.Tasks;
+using NuGet.Versioning;
 using Semmle.Util;
 using Semmle.Util.Logging;
 
@@ -89,9 +90,12 @@ public string GetNewestNugetPackageVersionFolder(string packagePath, string pack
 
         public static DirectoryInfo[] GetOrderedPackageVersionSubDirectories(string packagePath)
         {
+            // Only consider directories with valid NuGet version names.
             return new DirectoryInfo(packagePath)
                 .EnumerateDirectories("*", new EnumerationOptions { MatchCasing = MatchCasing.CaseInsensitive, RecurseSubdirectories = false })
-                .OrderByDescending(d => d.Name) // TODO: Improve sorting to handle pre-release versions.
+                .SelectMany(d => NuGetVersion.TryParse(d.Name, out var version) ? new[] { new { Directory = d, NuGetVersion = version } } : [])
+                .OrderByDescending(dw => dw.NuGetVersion)
+                .Select(dw => dw.Directory)
                 .ToArray();
         }
 

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/paket.references

@@ -1 +1,2 @@
 Newtonsoft.Json
+NuGet.Versioning

csharp/paket.dependencies

@@ -7,6 +7,7 @@ strategy: max
 nuget Basic.CompilerLog.Util 0.9.21
 nuget Mono.Posix.NETStandard
 nuget Newtonsoft.Json
+nuget NuGet.Versioning
 nuget xunit
 nuget xunit.runner.visualstudio
 nuget xunit.runner.utility