@openrewrite/recipes-nodejs 0.37.0-20251224-170410 → 0.37.0-20260102-170441

package/dist/security/dependency-vulnerability-check.js

@@ -53,13 +53,15 @@ exports.extractVersionPrefix = extractVersionPrefix;
 exports.applyVersionPrefix = applyVersionPrefix;
 const rewrite_1 = require("@openrewrite/rewrite");
 const json_1 = require("@openrewrite/rewrite/json");
-const rewrite_2 = require("@openrewrite/rewrite");
 const text_1 = require("@openrewrite/rewrite/text");
 const yaml_1 = require("@openrewrite/rewrite/yaml");
 const javascript_1 = require("@openrewrite/rewrite/javascript");
 const semver = __importStar(require("semver"));
 const path = __importStar(require("path"));
 const vulnerability_1 = require("./vulnerability");
+const ALL_DEPENDENCY_SCOPES = [
+    'dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'
+];
 class VulnerabilityReportRow {
     constructor(sourcePath, cve, packageName, version, fixedVersion, lastAffectedVersion, upgradeable, summary, severity, depth, cwes, isDirect, dependencyPath) {
         this.sourcePath = sourcePath;
@@ -156,8 +158,9 @@ __decorate([
     })
 ], VulnerabilityReportRow.prototype, "dependencyPath", void 0);
 class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
-    constructor() {
-        super(...arguments);
+    constructor(options) {
+        var _a, _b, _c;
+        super(options);
         this.name = "org.openrewrite.node.dependency-vulnerability-check";
         this.displayName = "Find and fix vulnerable npm dependencies";
         this.description = "This software composition analysis (SCA) tool detects and upgrades dependencies with publicly " +
@@ -166,30 +169,31 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             "If a minor or major upgrade is required to reach the fixed version, this can be controlled using the `maximumUpgradeDelta` option. " +
             "Vulnerability information comes from the GitHub Security Advisory Database.";
         this.vulnerabilityReport = new rewrite_1.DataTable("org.openrewrite.nodejs.table.VulnerabilityReport", "Vulnerability Report", "Lists all vulnerabilities found in project dependencies.", VulnerabilityReportRow);
+        (_a = this.maximumUpgradeDelta) !== null && _a !== void 0 ? _a : (this.maximumUpgradeDelta = 'patch');
+        (_b = this.minimumSeverity) !== null && _b !== void 0 ? _b : (this.minimumSeverity = vulnerability_1.Severity.LOW);
+        (_c = this.fixDeclaredVersions) !== null && _c !== void 0 ? _c : (this.fixDeclaredVersions = false);
+        if (options === null || options === void 0 ? void 0 : options.minimumSeverity) {
+            this.minimumSeverity = (0, vulnerability_1.parseSeverity)(options.minimumSeverity);
+        }
+        if (this.cvePattern) {
+            try {
+                this.cvePatternRegex = new RegExp(this.cvePattern);
+            }
+            catch (_d) {
+            }
+        }
     }
     initialValue(_ctx) {
-        return Object.assign(Object.assign({}, (0, javascript_1.createDependencyRecipeAccumulator)()), { db: vulnerability_1.VulnerabilityDatabase.load(), vulnerableByProject: new Map(), fixesByProject: new Map() });
-    }
-    getMinimumSeverity() {
-        return this.minimumSeverity ? (0, vulnerability_1.parseSeverity)(this.minimumSeverity) : vulnerability_1.Severity.LOW;
-    }
-    getMaximumUpgradeDelta() {
-        return this.maximumUpgradeDelta || 'patch';
+        return Object.assign(Object.assign({}, (0, javascript_1.createDependencyRecipeAccumulator)()), { db: vulnerability_1.VulnerabilityDatabase.load(), vulnerableByProject: new Map(), fixesByProject: new Map(), originalLockFiles: new Map(), allPackageJsonContents: new Map(), workspaceRoots: new Map(), modifiedWorkspaceMemberContents: new Map(), workspaceDetectionComplete: false });
     }
     isReportOnly() {
-        return this.getMaximumUpgradeDelta() === 'none';
+        return this.maximumUpgradeDelta === 'none';
     }
     matchesCvePattern(vulnerability) {
-        if (!this.cvePattern) {
-            return true;
-        }
-        try {
-            const regex = new RegExp(this.cvePattern);
-            return regex.test(vulnerability.cve);
-        }
-        catch (_a) {
+        if (!this.cvePatternRegex) {
             return true;
         }
+        return this.cvePatternRegex.test(vulnerability.cve);
     }
     isVersionAffected(version, vulnerability) {
         try {
@@ -230,7 +234,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             const current = semver.parse(currentVersion);
             if (!current)
                 return false;
-            const delta = this.getMaximumUpgradeDelta();
+            const delta = this.maximumUpgradeDelta;
             if (vulnerability.fixedVersion) {
                 const fixed = semver.parse(vulnerability.fixedVersion);
                 if (!fixed)
@@ -274,6 +278,17 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         return undefined;
     }
+    getVersionPrefixForDelta() {
+        switch (this.maximumUpgradeDelta) {
+            case 'patch':
+                return '~';
+            case 'minor':
+            case 'major':
+                return '^';
+            default:
+                return '';
+        }
+    }
     renderPath(scope, path) {
         const parts = [];
         if (scope) {
@@ -292,7 +307,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         const currentPath = [...path, { name: resolved.name, version: resolved.version }];
         const vulns = db.getVulnerabilities(resolved.name);
         for (const vuln of vulns) {
-            if ((0, vulnerability_1.severityOrdinal)(vuln.severity) < (0, vulnerability_1.severityOrdinal)(this.getMinimumSeverity())) {
+            if ((0, vulnerability_1.severityOrdinal)(vuln.severity) < (0, vulnerability_1.severityOrdinal)(this.minimumSeverity)) {
                 continue;
             }
             if (!this.matchesCvePattern(vuln)) {
@@ -323,30 +338,171 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             }
         }
     }
-    computeFixes(vulnerabilities) {
+    findPreventiveFixes(marker, scopes, db) {
+        const fixes = [];
+        for (const scope of scopes) {
+            const deps = marker[scope] || [];
+            for (const dep of deps) {
+                if (!dep.resolved)
+                    continue;
+                const declaredMinVersion = this.extractMinimumVersion(dep.versionConstraint);
+                if (!declaredMinVersion)
+                    continue;
+                if (declaredMinVersion === dep.resolved.version)
+                    continue;
+                const vulns = db.getVulnerabilities(dep.name);
+                const affectedCves = [];
+                let highestFixVersion;
+                for (const vuln of vulns) {
+                    if ((0, vulnerability_1.severityOrdinal)(vuln.severity) < (0, vulnerability_1.severityOrdinal)(this.minimumSeverity)) {
+                        continue;
+                    }
+                    if (!this.matchesCvePattern(vuln)) {
+                        continue;
+                    }
+                    if (this.isVersionAffected(declaredMinVersion, vuln) &&
+                        !this.isVersionAffected(dep.resolved.version, vuln)) {
+                        affectedCves.push(vuln.cve);
+                        const fixVersion = vuln.fixedVersion;
+                        if (fixVersion && (!highestFixVersion || semver.gt(fixVersion, highestFixVersion))) {
+                            highestFixVersion = fixVersion;
+                        }
+                    }
+                }
+                if (affectedCves.length > 0 && highestFixVersion) {
+                    if (this.isUpgradeWithinDelta(declaredMinVersion, highestFixVersion)) {
+                        const majorVersion = semver.major(declaredMinVersion);
+                        fixes.push({
+                            packageName: dep.name,
+                            newVersion: highestFixVersion,
+                            scope,
+                            isTransitive: false,
+                            cves: affectedCves,
+                            originalMajorVersion: majorVersion
+                        });
+                    }
+                }
+            }
+        }
+        return fixes;
+    }
+    isUpgradeWithinDelta(fromVersion, toVersion) {
+        if (this.isReportOnly()) {
+            return false;
+        }
+        return this.isVersionWithinDelta(fromVersion, toVersion);
+    }
+    extractMinimumVersion(constraint) {
+        if (!constraint)
+            return undefined;
+        if (semver.valid(constraint)) {
+            return constraint;
+        }
+        const match = constraint.match(/^[~^>=<]*\s*(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/);
+        if (match && semver.valid(match[1])) {
+            return match[1];
+        }
+        const coerced = semver.coerce(constraint);
+        return coerced === null || coerced === void 0 ? void 0 : coerced.version;
+    }
+    findHighestSafeVersion(packageName, originalVersion, initialFixVersion, db, visited = new Set()) {
+        if (visited.has(initialFixVersion)) {
+            return initialFixVersion;
+        }
+        visited.add(initialFixVersion);
+        const vulnsInFixVersion = db.getVulnerabilities(packageName)
+            .filter(v => this.isVersionAffected(initialFixVersion, v));
+        if (vulnsInFixVersion.length === 0) {
+            return initialFixVersion;
+        }
+        let highestFixVersion = initialFixVersion;
+        for (const vuln of vulnsInFixVersion) {
+            const fixVersion = this.getUpgradeVersion(vuln);
+            if (fixVersion && semver.valid(fixVersion)) {
+                if (this.isVersionWithinDelta(originalVersion, fixVersion)) {
+                    if (semver.gt(fixVersion, highestFixVersion)) {
+                        highestFixVersion = fixVersion;
+                    }
+                }
+            }
+        }
+        if (highestFixVersion !== initialFixVersion) {
+            return this.findHighestSafeVersion(packageName, originalVersion, highestFixVersion, db, visited);
+        }
+        return initialFixVersion;
+    }
+    isVersionWithinDelta(originalVersion, targetVersion) {
+        try {
+            const original = semver.parse(originalVersion);
+            const target = semver.parse(targetVersion);
+            if (!original || !target)
+                return false;
+            switch (this.maximumUpgradeDelta) {
+                case 'patch':
+                    return original.major === target.major && original.minor === target.minor;
+                case 'minor':
+                    return original.major === target.major;
+                case 'major':
+                    return true;
+                case 'none':
+                    return false;
+                default:
+                    return false;
+            }
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+    computeFixes(vulnerabilities, db) {
+        var _a, _b, _c, _d, _e, _f, _g;
         if (this.isReportOnly()) {
             return [];
         }
-        const byPackage = new Map();
+        const byPackageAndMajor = new Map();
         for (const vuln of vulnerabilities) {
-            const existing = byPackage.get(vuln.resolved.name) || [];
+            const parsed = semver.parse(vuln.resolved.version);
+            const major = (_a = parsed === null || parsed === void 0 ? void 0 : parsed.major) !== null && _a !== void 0 ? _a : 0;
+            const key = `${vuln.resolved.name}@${major}`;
+            const existing = byPackageAndMajor.get(key) || [];
             existing.push(vuln);
-            byPackage.set(vuln.resolved.name, existing);
+            byPackageAndMajor.set(key, existing);
+        }
+        const majorVersionsByPackage = new Map();
+        for (const vuln of vulnerabilities) {
+            const parsed = semver.parse(vuln.resolved.version);
+            const major = (_b = parsed === null || parsed === void 0 ? void 0 : parsed.major) !== null && _b !== void 0 ? _b : 0;
+            const existing = majorVersionsByPackage.get(vuln.resolved.name) || new Set();
+            existing.add(major);
+            majorVersionsByPackage.set(vuln.resolved.name, existing);
         }
         const fixes = [];
-        for (const [packageName, vulns] of byPackage) {
+        for (const [key, vulns] of byPackageAndMajor) {
+            const packageName = vulns[0].resolved.name;
+            const originalMajor = (_d = (_c = semver.parse(vulns[0].resolved.version)) === null || _c === void 0 ? void 0 : _c.major) !== null && _d !== void 0 ? _d : 0;
+            const hasMultipleMajorVersions = ((_f = (_e = majorVersionsByPackage.get(packageName)) === null || _e === void 0 ? void 0 : _e.size) !== null && _f !== void 0 ? _f : 0) > 1;
             let highestFixVersion;
             const cves = [];
             let isTransitive = true;
             let scope;
+            let originalVersion;
             for (const vuln of vulns) {
+                if (!originalVersion) {
+                    originalVersion = vuln.resolved.version;
+                }
                 if (!this.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability)) {
                     continue;
                 }
                 const fixVersion = this.getUpgradeVersion(vuln.vulnerability);
                 if (fixVersion) {
-                    if (!highestFixVersion || semver.gt(fixVersion, highestFixVersion)) {
-                        highestFixVersion = fixVersion;
+                    const fixMajor = (_g = semver.parse(fixVersion)) === null || _g === void 0 ? void 0 : _g.major;
+                    const shouldConsiderFix = hasMultipleMajorVersions
+                        ? fixMajor === originalMajor
+                        : true;
+                    if (shouldConsiderFix) {
+                        if (!highestFixVersion || semver.gt(fixVersion, highestFixVersion)) {
+                            highestFixVersion = fixVersion;
+                        }
                     }
                 }
                 cves.push(vuln.vulnerability.cve);
@@ -355,13 +511,15 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     scope = vuln.scope;
                 }
             }
-            if (highestFixVersion && cves.length > 0) {
+            if (highestFixVersion && cves.length > 0 && originalVersion) {
+                const safeVersion = this.findHighestSafeVersion(packageName, originalVersion, highestFixVersion, db);
                 fixes.push({
                     packageName,
-                    newVersion: highestFixVersion,
+                    newVersion: safeVersion || highestFixVersion,
                     isTransitive,
                     cves,
-                    scope
+                    scope,
+                    originalMajorVersion: originalMajor
                 });
             }
         }
@@ -370,22 +528,47 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     scanner(acc) {
         return __awaiter(this, void 0, void 0, function* () {
             const recipe = this;
-            return new class extends json_1.JsonVisitor {
-                visitDocument(doc, _ctx) {
+            const LOCK_FILE_NAMES = ['pnpm-lock.yaml', 'yarn.lock', 'package-lock.json', 'bun.lock'];
+            return new class extends rewrite_1.TreeVisitor {
+                accept(tree, ctx) {
                     return __awaiter(this, void 0, void 0, function* () {
-                        var _a;
+                        if ((0, json_1.isJson)(tree) && tree.kind === json_1.Json.Kind.Document) {
+                            return this.handleJsonDocument(tree, ctx);
+                        }
+                        if ((0, yaml_1.isYaml)(tree) && (0, yaml_1.isDocuments)(tree)) {
+                            return this.handleYamlDocument(tree, ctx);
+                        }
+                        if ((0, text_1.isPlainText)(tree)) {
+                            return this.handlePlainTextDocument(tree, ctx);
+                        }
+                        return tree;
+                    });
+                }
+                handleJsonDocument(doc, _ctx) {
+                    return __awaiter(this, void 0, void 0, function* () {
+                        var _a, _b;
+                        const basename = path.basename(doc.sourcePath);
+                        if (LOCK_FILE_NAMES.includes(basename)) {
+                            acc.originalLockFiles.set(doc.sourcePath, yield rewrite_1.TreePrinters.print(doc));
+                            return doc;
+                        }
                         if (!doc.sourcePath.endsWith('package.json')) {
                             return doc;
                         }
+                        const packageJsonContent = yield rewrite_1.TreePrinters.print(doc);
+                        acc.allPackageJsonContents.set(doc.sourcePath, packageJsonContent);
                         const marker = (0, javascript_1.findNodeResolutionResult)(doc);
                         if (!marker) {
                             return doc;
                         }
+                        if (marker.workspacePackagePaths && marker.workspacePackagePaths.length > 0) {
+                            acc.workspaceRoots.set(doc.sourcePath, [...marker.workspacePackagePaths]);
+                        }
                         const vulnerabilities = [];
                         const visited = new Set();
                         const scopesToCheck = recipe.scope
                             ? [recipe.scope]
-                            : ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+                            : ALL_DEPENDENCY_SCOPES;
                         for (const scope of scopesToCheck) {
                             const deps = marker[scope] || [];
                             for (const dep of deps) {
@@ -394,37 +577,81 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                                 }
                             }
                         }
+                        const pm = (_a = marker.packageManager) !== null && _a !== void 0 ? _a : "Npm";
+                        const configFiles = {};
+                        const projectNpmrc = (_b = marker.npmrcConfigs) === null || _b === void 0 ? void 0 : _b.find(c => c.scope === "Project");
+                        if (projectNpmrc) {
+                            const lines = Object.entries(projectNpmrc.properties)
+                                .map(([key, value]) => `${key}=${value}`);
+                            configFiles['.npmrc'] = lines.join('\n');
+                        }
+                        const storedContent = acc.allPackageJsonContents.get(doc.sourcePath);
+                        let isWorkspaceRoot = false;
+                        if (storedContent) {
+                            try {
+                                isWorkspaceRoot = JSON.parse(storedContent).workspaces !== undefined;
+                            }
+                            catch (_c) {
+                            }
+                        }
+                        let fixes = [];
                         if (vulnerabilities.length > 0) {
                             acc.vulnerableByProject.set(doc.sourcePath, vulnerabilities);
-                            const fixes = recipe.computeFixes(vulnerabilities);
-                            if (fixes.length > 0) {
-                                acc.fixesByProject.set(doc.sourcePath, fixes);
-                                const projectDir = path.dirname(path.resolve(doc.sourcePath));
-                                const pm = (_a = marker.packageManager) !== null && _a !== void 0 ? _a : "Npm";
-                                acc.projectsToUpdate.set(doc.sourcePath, {
-                                    projectDir,
-                                    packageJsonPath: doc.sourcePath,
-                                    originalPackageJson: yield this.printDocument(doc),
-                                    packageManager: pm
-                                });
+                            fixes = recipe.computeFixes(vulnerabilities, acc.db);
+                        }
+                        if (recipe.fixDeclaredVersions) {
+                            const preventiveFixes = recipe.findPreventiveFixes(marker, scopesToCheck, acc.db);
+                            const existingPackages = new Set(fixes.map(f => `${f.packageName}@${f.scope}`));
+                            for (const fix of preventiveFixes) {
+                                const key = `${fix.packageName}@${fix.scope}`;
+                                if (!existingPackages.has(key)) {
+                                    fixes.push(fix);
+                                    existingPackages.add(key);
+                                }
                             }
                         }
+                        if (fixes.length > 0) {
+                            acc.fixesByProject.set(doc.sourcePath, fixes);
+                            acc.projectsToUpdate.set(doc.sourcePath, {
+                                packageJsonPath: doc.sourcePath,
+                                originalPackageJson: yield rewrite_1.TreePrinters.print(doc),
+                                packageManager: pm,
+                                configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined
+                            });
+                        }
+                        else if (isWorkspaceRoot && !acc.projectsToUpdate.has(doc.sourcePath)) {
+                            acc.projectsToUpdate.set(doc.sourcePath, {
+                                packageJsonPath: doc.sourcePath,
+                                originalPackageJson: yield rewrite_1.TreePrinters.print(doc),
+                                packageManager: pm,
+                                configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined
+                            });
+                        }
                         return doc;
                     });
                 }
-                printDocument(doc) {
+                handleYamlDocument(docs, _ctx) {
                     return __awaiter(this, void 0, void 0, function* () {
-                        return rewrite_2.TreePrinters.print(doc);
+                        const basename = path.basename(docs.sourcePath);
+                        if (LOCK_FILE_NAMES.includes(basename)) {
+                            acc.originalLockFiles.set(docs.sourcePath, yield rewrite_1.TreePrinters.print(docs));
+                        }
+                        return docs;
+                    });
+                }
+                handlePlainTextDocument(text, _ctx) {
+                    return __awaiter(this, void 0, void 0, function* () {
+                        const basename = path.basename(text.sourcePath);
+                        if (LOCK_FILE_NAMES.includes(basename)) {
+                            acc.originalLockFiles.set(text.sourcePath, yield rewrite_1.TreePrinters.print(text));
+                        }
+                        return text;
                     });
                 }
             };
         });
     }
-    getRecipeList() {
-        return __awaiter(this, void 0, void 0, function* () {
-            return [];
-        });
-    }
+    ;
     editorWithData(acc) {
         return __awaiter(this, void 0, void 0, function* () {
             const recipe = this;
@@ -498,14 +725,65 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                 handlePackageJson(doc, ctx) {
                     return __awaiter(this, void 0, void 0, function* () {
                         const vulnerabilities = acc.vulnerableByProject.get(doc.sourcePath);
-                        if (!vulnerabilities || vulnerabilities.length === 0) {
+                        if (vulnerabilities && vulnerabilities.length > 0) {
+                            for (const vuln of vulnerabilities) {
+                                const upgradeable = recipe.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability);
+                                recipe.vulnerabilityReport.insertRow(ctx, new VulnerabilityReportRow(doc.sourcePath, vuln.vulnerability.cve, vuln.resolved.name, vuln.resolved.version, vuln.vulnerability.fixedVersion || '', vuln.vulnerability.lastAffectedVersion || '', upgradeable, vuln.vulnerability.summary, vuln.vulnerability.severity, vuln.depth, vuln.vulnerability.cwes, vuln.isDirect, recipe.renderPath(vuln.scope, vuln.path)));
+                            }
+                        }
+                        if (recipe.isReportOnly()) {
                             return doc;
                         }
-                        for (const vuln of vulnerabilities) {
-                            const upgradeable = recipe.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability);
-                            recipe.vulnerabilityReport.insertRow(ctx, new VulnerabilityReportRow(doc.sourcePath, vuln.vulnerability.cve, vuln.resolved.name, vuln.resolved.version, vuln.vulnerability.fixedVersion || '', vuln.vulnerability.lastAffectedVersion || '', upgradeable, vuln.vulnerability.summary, vuln.vulnerability.severity, vuln.depth, vuln.vulnerability.cwes, vuln.isDirect, recipe.renderPath(vuln.scope, vuln.path)));
+                        if (!acc.workspaceDetectionComplete) {
+                            this.detectWorkspacesFromContents();
+                            acc.workspaceDetectionComplete = true;
                         }
-                        if (recipe.isReportOnly()) {
+                        const preModifiedContent = acc.modifiedWorkspaceMemberContents.get(doc.sourcePath)
+                            || acc.updatedPackageJsons.get(doc.sourcePath);
+                        if (preModifiedContent) {
+                            return this.applyModifiedContent(doc, preModifiedContent);
+                        }
+                        const isWorkspaceRoot = acc.workspaceRoots.has(doc.sourcePath);
+                        const workspaceRootPath = this.findWorkspaceRootFor(doc.sourcePath);
+                        const isWorkspaceMember = workspaceRootPath !== undefined;
+                        if (isWorkspaceMember && !isWorkspaceRoot) {
+                            const needsProcessing = this.workspaceNeedsProcessing(workspaceRootPath);
+                            if (needsProcessing && !acc.processedProjects.has(workspaceRootPath)) {
+                                const rootUpdateInfo = acc.projectsToUpdate.get(workspaceRootPath);
+                                if (rootUpdateInfo) {
+                                    const failureMessage = yield (0, javascript_1.runInstallIfNeeded)(workspaceRootPath, acc, () => recipe.runWorkspacePackageManagerInstall(acc, workspaceRootPath, rootUpdateInfo));
+                                    if (failureMessage) {
+                                        return (0, rewrite_1.markupWarn)(doc, `Failed to fix vulnerabilities in workspace`, failureMessage);
+                                    }
+                                }
+                            }
+                            const modifiedContent = acc.modifiedWorkspaceMemberContents.get(doc.sourcePath);
+                            if (modifiedContent) {
+                                return this.applyModifiedContent(doc, modifiedContent);
+                            }
+                            return doc;
+                        }
+                        if (isWorkspaceRoot) {
+                            const updateInfo = acc.projectsToUpdate.get(doc.sourcePath);
+                            if (!updateInfo) {
+                                return doc;
+                            }
+                            const needsProcessing = this.workspaceNeedsProcessing(doc.sourcePath);
+                            if (!needsProcessing) {
+                                return doc;
+                            }
+                            const failureMessage = yield (0, javascript_1.runInstallIfNeeded)(doc.sourcePath, acc, () => recipe.runWorkspacePackageManagerInstall(acc, doc.sourcePath, updateInfo));
+                            if (failureMessage) {
+                                return (0, rewrite_1.markupWarn)(doc, `Failed to fix vulnerabilities in ${doc.sourcePath}`, failureMessage);
+                            }
+                            const rootFixes = acc.fixesByProject.get(doc.sourcePath) || [];
+                            if (rootFixes.length > 0) {
+                                const modifiedContent = acc.updatedPackageJsons.get(doc.sourcePath);
+                                if (modifiedContent) {
+                                    const result = yield this.applyModifiedContent(doc, modifiedContent);
+                                    return (0, javascript_1.updateNodeResolutionMarker)(result, updateInfo, acc);
+                                }
+                            }
                             return doc;
                         }
                         const fixes = acc.fixesByProject.get(doc.sourcePath);
@@ -517,28 +795,159 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         if (failureMessage) {
                             return (0, rewrite_1.markupWarn)(doc, `Failed to fix vulnerabilities in ${doc.sourcePath}`, failureMessage);
                         }
-                        let result = doc;
-                        for (const fix of fixes) {
-                            if (!fix.isTransitive && fix.scope) {
-                                const visitor = new UpdateVersionVisitor(fix.packageName, fix.newVersion, fix.scope);
-                                result = (yield visitor.visit(result, undefined));
-                            }
+                        const modifiedPackageJson = acc.updatedPackageJsons.get(doc.sourcePath);
+                        if (!modifiedPackageJson) {
+                            return doc;
                         }
+                        const result = yield this.applyModifiedContent(doc, modifiedPackageJson);
                         return (0, javascript_1.updateNodeResolutionMarker)(result, updateInfo, acc);
                     });
                 }
+                findWorkspaceRootFor(packageJsonPath) {
+                    for (const [rootPath, memberPaths] of acc.workspaceRoots) {
+                        if (memberPaths.includes(packageJsonPath)) {
+                            return rootPath;
+                        }
+                    }
+                    return undefined;
+                }
+                workspaceNeedsProcessing(rootPath) {
+                    if (acc.fixesByProject.has(rootPath)) {
+                        return true;
+                    }
+                    const memberPaths = acc.workspaceRoots.get(rootPath) || [];
+                    for (const memberPath of memberPaths) {
+                        if (acc.fixesByProject.has(memberPath)) {
+                            return true;
+                        }
+                    }
+                    return false;
+                }
+                detectWorkspacesFromContents() {
+                    for (const [pkgPath, content] of acc.allPackageJsonContents) {
+                        if (acc.workspaceRoots.has(pkgPath)) {
+                            continue;
+                        }
+                        try {
+                            const pkgJson = JSON.parse(content);
+                            if (!pkgJson.workspaces) {
+                                continue;
+                            }
+                            const patterns = Array.isArray(pkgJson.workspaces)
+                                ? pkgJson.workspaces
+                                : pkgJson.workspaces.packages || [];
+                            if (patterns.length === 0) {
+                                continue;
+                            }
+                            const rootDir = path.dirname(pkgPath);
+                            const memberPaths = [];
+                            for (const [otherPath] of acc.allPackageJsonContents) {
+                                if (otherPath === pkgPath)
+                                    continue;
+                                const relativePath = rootDir === '.'
+                                    ? otherPath
+                                    : otherPath.startsWith(rootDir + '/')
+                                        ? otherPath.slice(rootDir.length + 1)
+                                        : null;
+                                if (relativePath && this.matchesWorkspacePattern(relativePath, patterns)) {
+                                    memberPaths.push(otherPath);
+                                }
+                            }
+                            if (memberPaths.length > 0) {
+                                acc.workspaceRoots.set(pkgPath, memberPaths);
+                            }
+                        }
+                        catch (_a) {
+                        }
+                    }
+                }
+                matchesWorkspacePattern(relativePath, patterns) {
+                    for (const pattern of patterns) {
+                        if (pattern.endsWith('/*')) {
+                            const baseDir = pattern.slice(0, -2);
+                            const pathParts = relativePath.split('/');
+                            if (pathParts.length === 3 &&
+                                pathParts[0] === baseDir &&
+                                pathParts[2] === 'package.json') {
+                                return true;
+                            }
+                        }
+                        else if (!pattern.includes('*')) {
+                            if (relativePath === `${pattern}/package.json`) {
+                                return true;
+                            }
+                        }
+                    }
+                    return false;
+                }
+                applyModifiedContent(doc, content) {
+                    return __awaiter(this, void 0, void 0, function* () {
+                        const parsedModified = yield new json_1.JsonParser({}).parseOne({
+                            text: content,
+                            sourcePath: doc.sourcePath
+                        });
+                        return Object.assign(Object.assign({}, doc), { value: parsedModified.value, eof: parsedModified.eof });
+                    });
+                }
             };
         });
     }
     runPackageManagerInstall(acc, updateInfo, fixes) {
         return __awaiter(this, void 0, void 0, function* () {
-            const modifiedPackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, fixes);
-            const result = yield (0, javascript_1.runInstallInTempDir)(updateInfo.projectDir, updateInfo.packageManager, modifiedPackageJson);
+            const modifiedPackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, fixes, updateInfo.packageManager);
+            const result = yield (0, javascript_1.runInstallInTempDir)(updateInfo.packageManager, modifiedPackageJson, {
+                configFiles: updateInfo.configFiles
+            });
             (0, javascript_1.storeInstallResult)(result, acc, updateInfo, modifiedPackageJson);
         });
     }
-    createModifiedPackageJson(originalContent, fixes) {
-        const packageJson = JSON.parse(originalContent);
+    runWorkspacePackageManagerInstall(acc, rootPath, rootUpdateInfo) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const memberPaths = acc.workspaceRoots.get(rootPath) || [];
+            const pm = rootUpdateInfo.packageManager;
+            const allTransitiveFixes = [];
+            const rootFixes = acc.fixesByProject.get(rootPath) || [];
+            const rootDirectFixes = rootFixes.filter(f => !f.isTransitive);
+            const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive);
+            allTransitiveFixes.push(...rootTransitiveFixes);
+            const memberDirectFixes = new Map();
+            for (const memberPath of memberPaths) {
+                const memberFixes = acc.fixesByProject.get(memberPath) || [];
+                const directFixes = memberFixes.filter(f => !f.isTransitive);
+                const transitiveFixes = memberFixes.filter(f => f.isTransitive);
+                if (directFixes.length > 0) {
+                    memberDirectFixes.set(memberPath, directFixes);
+                }
+                allTransitiveFixes.push(...transitiveFixes);
+            }
+            const rootOriginalContent = acc.allPackageJsonContents.get(rootPath) || rootUpdateInfo.originalPackageJson;
+            const modifiedRootPackageJson = this.createModifiedPackageJson(rootOriginalContent, [...rootDirectFixes, ...allTransitiveFixes], pm);
+            const workspacePackages = {};
+            for (const memberPath of memberPaths) {
+                const originalContent = acc.allPackageJsonContents.get(memberPath);
+                if (!originalContent) {
+                    continue;
+                }
+                const directFixes = memberDirectFixes.get(memberPath);
+                let modifiedContent;
+                if (directFixes && directFixes.length > 0) {
+                    modifiedContent = this.createModifiedPackageJsonDirectOnly(originalContent, directFixes);
+                    acc.modifiedWorkspaceMemberContents.set(memberPath, modifiedContent);
+                }
+                else {
+                    modifiedContent = originalContent;
+                }
+                workspacePackages[memberPath] = modifiedContent;
+            }
+            const result = yield (0, javascript_1.runWorkspaceInstallInTempDir)(pm, modifiedRootPackageJson, {
+                configFiles: rootUpdateInfo.configFiles,
+                workspacePackages
+            });
+            (0, javascript_1.storeInstallResult)(result, acc, rootUpdateInfo, modifiedRootPackageJson);
+        });
+    }
+    createModifiedPackageJsonDirectOnly(originalContent, fixes) {
+        let packageJson = JSON.parse(originalContent);
         for (const fix of fixes) {
             if (!fix.isTransitive && fix.scope) {
                 if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
@@ -549,6 +958,75 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         return JSON.stringify(packageJson, null, 2);
     }
+    createModifiedPackageJson(originalContent, fixes, packageManager) {
+        var _a, _b, _c;
+        let packageJson = JSON.parse(originalContent);
+        const fixesByPackage = new Map();
+        for (const fix of fixes) {
+            const existing = fixesByPackage.get(fix.packageName) || [];
+            existing.push(fix);
+            fixesByPackage.set(fix.packageName, existing);
+        }
+        for (const fix of fixes) {
+            if (!fix.isTransitive && fix.scope) {
+                if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
+                    const originalVersion = packageJson[fix.scope][fix.packageName];
+                    packageJson[fix.scope][fix.packageName] = applyVersionPrefix(originalVersion, fix.newVersion);
+                }
+            }
+            else if (fix.isTransitive) {
+                const directDepScope = findDirectDependencyScope(packageJson, fix.packageName);
+                if (directDepScope) {
+                    const directVersion = packageJson[directDepScope][fix.packageName];
+                    const directMajor = semver.major(semver.coerce(directVersion) || '0.0.0');
+                    if (fix.originalMajorVersion !== undefined && directMajor !== fix.originalMajorVersion) {
+                        const isYarn = packageManager === "YarnClassic" ||
+                            packageManager === "YarnBerry";
+                        if (!isYarn) {
+                            const versionSpecificKey = `${fix.packageName}@^${fix.originalMajorVersion}`;
+                            packageJson = (0, javascript_1.applyOverrideToPackageJson)(packageJson, packageManager, versionSpecificKey, fix.newVersion);
+                        }
+                        else {
+                        }
+                        continue;
+                    }
+                    packageJson[directDepScope][fix.packageName] = applyVersionPrefix(directVersion, fix.newVersion);
+                    continue;
+                }
+                const packageFixes = fixesByPackage.get(fix.packageName) || [];
+                const hasMultipleMajorVersions = packageFixes.length > 1 &&
+                    new Set(packageFixes.map(f => f.originalMajorVersion)).size > 1;
+                const existingOverrides = getOverridesFromPackageJson(packageJson, packageManager);
+                const hasExistingVersionSpecificOverrides = existingOverrides &&
+                    Object.keys(existingOverrides).some(key => key.startsWith(`${fix.packageName}@`));
+                const isYarn = packageManager === "YarnClassic" ||
+                    packageManager === "YarnBerry";
+                const useVersionSpecificOverride = !isYarn &&
+                    (hasMultipleMajorVersions || hasExistingVersionSpecificOverrides) &&
+                    fix.originalMajorVersion !== undefined;
+                if (useVersionSpecificOverride) {
+                    const versionSpecificKey = `${fix.packageName}@^${fix.originalMajorVersion}`;
+                    packageJson = (0, javascript_1.applyOverrideToPackageJson)(packageJson, packageManager, versionSpecificKey, fix.newVersion);
+                }
+                else {
+                    packageJson = (0, javascript_1.applyOverrideToPackageJson)(packageJson, packageManager, fix.packageName, fix.newVersion);
+                }
+                if (packageManager === "Pnpm") {
+                    if (!packageJson.devDependencies) {
+                        packageJson.devDependencies = {};
+                    }
+                    if (!((_a = packageJson.dependencies) === null || _a === void 0 ? void 0 : _a[fix.packageName]) &&
+                        !packageJson.devDependencies[fix.packageName] &&
+                        !((_b = packageJson.peerDependencies) === null || _b === void 0 ? void 0 : _b[fix.packageName]) &&
+                        !((_c = packageJson.optionalDependencies) === null || _c === void 0 ? void 0 : _c[fix.packageName])) {
+                        const prefix = this.getVersionPrefixForDelta();
+                        packageJson.devDependencies[fix.packageName] = prefix + fix.newVersion;
+                    }
+                }
+            }
+        }
+        return JSON.stringify(packageJson, null, 2);
+    }
 }
 exports.DependencyVulnerabilityCheck = DependencyVulnerabilityCheck;
 __decorate([
@@ -606,6 +1084,18 @@ __decorate([
         example: "CVE-2023-.*"
     })
 ], DependencyVulnerabilityCheck.prototype, "cvePattern", void 0);
+__decorate([
+    (0, rewrite_1.Option)({
+        displayName: "Fix declared versions",
+        description: "When enabled, also upgrades version specifiers declared in package.json that specify vulnerable versions, " +
+            "even if the lock file already resolves to a safe version. This is a preventive measure to ensure that " +
+            "future installs (e.g., on a different machine or after lock file changes) won't install vulnerable versions. " +
+            "These preventive upgrades are NOT reported in the vulnerability data table since there's no actual vulnerability. " +
+            "Default is false.",
+        required: false,
+        example: "true"
+    })
+], DependencyVulnerabilityCheck.prototype, "fixDeclaredVersions", void 0);
 function extractVersionPrefix(versionString) {
     const match = versionString.match(/^([~^]|>=?|<=?|=)?(.*)$/);
     if (match) {
@@ -620,41 +1110,28 @@ function applyVersionPrefix(originalVersion, newVersion) {
     const { prefix } = extractVersionPrefix(originalVersion);
     return prefix + newVersion;
 }
-class UpdateVersionVisitor extends json_1.JsonVisitor {
-    constructor(packageName, newVersion, targetScope) {
-        super();
-        this.inTargetScope = false;
-        this.packageName = packageName;
-        this.newVersion = newVersion;
-        this.targetScope = targetScope;
-    }
-    visitMember(member, p) {
-        const _super = Object.create(null, {
-            visitMember: { get: () => super.visitMember }
-        });
-        return __awaiter(this, void 0, void 0, function* () {
-            const keyName = (0, json_1.getMemberKeyName)(member);
-            if (keyName === this.targetScope) {
-                this.inTargetScope = true;
-                const result = yield _super.visitMember.call(this, member, p);
-                this.inTargetScope = false;
-                return result;
-            }
-            if (this.inTargetScope && keyName === this.packageName) {
-                return this.updateVersion(member);
-            }
-            return _super.visitMember.call(this, member, p);
-        });
+function findDirectDependencyScope(packageJson, packageName) {
+    var _a;
+    for (const scope of ALL_DEPENDENCY_SCOPES) {
+        if ((_a = packageJson[scope]) === null || _a === void 0 ? void 0 : _a[packageName]) {
+            return scope;
+        }
     }
-    updateVersion(member) {
-        const value = member.value;
-        if (!(0, json_1.isLiteral)(value)) {
-            return member;
-        }
-        const originalVersion = String(value.value);
-        const newVersionWithPrefix = applyVersionPrefix(originalVersion, this.newVersion);
-        const newLiteral = Object.assign(Object.assign({}, value), { source: `"${newVersionWithPrefix}"`, value: newVersionWithPrefix });
-        return Object.assign(Object.assign({}, member), { value: newLiteral });
+    return undefined;
+}
+function getOverridesFromPackageJson(packageJson, packageManager) {
+    var _a;
+    switch (packageManager) {
+        case "Npm":
+        case "Bun":
+            return packageJson.overrides;
+        case "Pnpm":
+            return (_a = packageJson.pnpm) === null || _a === void 0 ? void 0 : _a.overrides;
+        case "YarnClassic":
+        case "YarnBerry":
+            return packageJson.resolutions;
+        default:
+            return undefined;
     }
 }
 //# sourceMappingURL=dependency-vulnerability-check.js.map