@openrewrite/recipes-nodejs 0.37.0-20251224-170410 → 0.37.0-20260102-170441

package/src/security/dependency-vulnerability-check.ts

@@ -4,21 +4,33 @@
  * Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
  */
 
-import {Column, DataTable, ExecutionContext, Option, Recipe, ScanningRecipe, Tree, TreeVisitor, markupWarn} from "@openrewrite/rewrite";
-import {getMemberKeyName, isLiteral, Json, JsonParser, JsonVisitor, isJson} from "@openrewrite/rewrite/json";
-import {TreePrinters} from "@openrewrite/rewrite";
-import {PlainText, PlainTextParser, isPlainText} from "@openrewrite/rewrite/text";
+import {
+    Column,
+    DataTable,
+    ExecutionContext,
+    markupWarn,
+    Option,
+    ScanningRecipe,
+    Tree,
+    TreePrinters,
+    TreeVisitor
+} from "@openrewrite/rewrite";
+import {isJson, Json, JsonParser} from "@openrewrite/rewrite/json";
+import {isPlainText, PlainText, PlainTextParser} from "@openrewrite/rewrite/text";
 import {isDocuments, isYaml, Yaml, YamlParser} from "@openrewrite/rewrite/yaml";
 import {
-    DependencyScope,
-    findNodeResolutionResult,
-    ResolvedDependency,
-    PackageManager,
+    applyOverrideToPackageJson,
     createDependencyRecipeAccumulator,
     DependencyRecipeAccumulator,
+    DependencyScope,
+    findNodeResolutionResult,
     getUpdatedLockFileContent,
+    NpmrcScope,
+    PackageManager,
+    ResolvedDependency,
     runInstallIfNeeded,
     runInstallInTempDir,
+    runWorkspaceInstallInTempDir,
     storeInstallResult,
     updateNodeResolutionMarker
 } from "@openrewrite/rewrite/javascript";
@@ -26,6 +38,13 @@ import * as semver from "semver";
 import * as path from "path";
 import {parseSeverity, Severity, severityOrdinal, Vulnerability, VulnerabilityDatabase} from "./vulnerability";
 
+/**
+ * All dependency scopes that can contain dependencies in package.json.
+ */
+const ALL_DEPENDENCY_SCOPES: DependencyScope[] = [
+    'dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'
+];
+
 /**
  * Maximum upgrade delta for version upgrades.
  * Use 'none' to only report vulnerabilities without making any changes.
@@ -185,20 +204,22 @@ interface VulnerabilityFix {
     cves: string[];
     /** The scope where this dependency was found (for direct deps) */
     scope?: DependencyScope;
+    /** The original major version (for version-specific overrides) */
+    originalMajorVersion?: number;
 }
 
 /**
  * Project info for lock file updates.
  */
 interface ProjectUpdateInfo {
-    /** Absolute path to the project directory */
-    projectDir: string;
     /** Relative path to package.json (from source root) */
     packageJsonPath: string;
     /** Original package.json content */
     originalPackageJson: string;
     /** The package manager used by this project */
     packageManager: PackageManager;
+    /** Config file contents extracted from the project (e.g., .npmrc) */
+    configFiles?: Record<string, string>;
 }
 
 /**
@@ -211,6 +232,16 @@ interface Accumulator extends DependencyRecipeAccumulator<ProjectUpdateInfo> {
     vulnerableByProject: Map<string, VulnerableDependency[]>;
     /** Fixes to apply, grouped by package.json path */
     fixesByProject: Map<string, VulnerabilityFix[]>;
+    /** Original lock file content, keyed by lock file path */
+    originalLockFiles: Map<string, string>;
+    /** All original package.json contents by path (for workspace support) */
+    allPackageJsonContents: Map<string, string>;
+    /** Workspace roots with their member paths: root path -> member paths */
+    workspaceRoots: Map<string, string[]>;
+    /** Modified package.json contents after applying fixes (for workspace members) */
+    modifiedWorkspaceMemberContents: Map<string, string>;
+    /** Flag to track if workspace detection has been performed */
+    workspaceDetectionComplete: boolean;
 }
 
 /**
@@ -285,7 +316,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         example: "MODERATE",
         valid: ["LOW", "MODERATE", "HIGH", "CRITICAL"]
     })
-    minimumSeverity?: string;
+    minimumSeverity?: Severity;
 
     @Option({
         displayName: "CVE pattern",
@@ -298,42 +329,74 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
     })
     cvePattern?: string;
 
-    initialValue(_ctx: ExecutionContext): Accumulator {
+    @Option({
+        displayName: "Fix declared versions",
+        description: "When enabled, also upgrades version specifiers declared in package.json that specify vulnerable versions, " +
+            "even if the lock file already resolves to a safe version. This is a preventive measure to ensure that " +
+            "future installs (e.g., on a different machine or after lock file changes) won't install vulnerable versions. " +
+            "These preventive upgrades are NOT reported in the vulnerability data table since there's no actual vulnerability. " +
+            "Default is false.",
+        required: false,
+        example: "true"
+    })
+    fixDeclaredVersions?: boolean;
+
+    /** Cached compiled regex for CVE pattern matching */
+    private cvePatternRegex?: RegExp;
+
+    constructor(options?: {
+        scope?: DependencyScope;
+        overrideTransitive?: boolean;
+        maximumUpgradeDelta?: UpgradeDelta;
+        minimumSeverity?: string;
+        cvePattern?: string;
+        fixDeclaredVersions?: boolean;
+    }) {
+        super(options);
+        this.maximumUpgradeDelta ??= 'patch';
+        this.minimumSeverity ??= Severity.LOW;
+        this.fixDeclaredVersions ??= false;
+        if (options?.minimumSeverity) {
+            this.minimumSeverity = parseSeverity(options.minimumSeverity);
+        }
+        // Pre-compile CVE pattern regex for performance
+        if (this.cvePattern) {
+            try {
+                this.cvePatternRegex = new RegExp(this.cvePattern);
+            } catch {
+                // Invalid regex pattern - will match all CVEs
+            }
+        }
+    }
+
+    override initialValue(_ctx: ExecutionContext): Accumulator {
         return {
             // DependencyRecipeAccumulator fields
             ...createDependencyRecipeAccumulator<ProjectUpdateInfo>(),
             // Our custom fields
             db: VulnerabilityDatabase.load(),
             vulnerableByProject: new Map(),
-            fixesByProject: new Map()
+            fixesByProject: new Map(),
+            originalLockFiles: new Map(),
+            allPackageJsonContents: new Map(),
+            workspaceRoots: new Map(),
+            modifiedWorkspaceMemberContents: new Map(),
+            workspaceDetectionComplete: false
         };
     }
 
-    private getMinimumSeverity(): Severity {
-        return this.minimumSeverity ? parseSeverity(this.minimumSeverity) : Severity.LOW;
-    }
-
-    private getMaximumUpgradeDelta(): UpgradeDelta {
-        return this.maximumUpgradeDelta || 'patch';
-    }
-
     private isReportOnly(): boolean {
-        return this.getMaximumUpgradeDelta() === 'none';
+        return this.maximumUpgradeDelta === 'none';
     }
 
     /**
      * Checks if a vulnerability matches the CVE pattern filter.
      */
     private matchesCvePattern(vulnerability: Vulnerability): boolean {
-        if (!this.cvePattern) {
-            return true;
-        }
-        try {
-            const regex = new RegExp(this.cvePattern);
-            return regex.test(vulnerability.cve);
-        } catch {
-            return true; // Invalid regex, don't filter
+        if (!this.cvePatternRegex) {
+            return true; // No pattern or invalid pattern - match all
         }
+        return this.cvePatternRegex.test(vulnerability.cve);
     }
 
     /**
@@ -388,7 +451,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
             const current = semver.parse(currentVersion);
             if (!current) return false;
 
-            const delta = this.getMaximumUpgradeDelta();
+            const delta = this.maximumUpgradeDelta!;
 
             // If we have a fixed version, check if it's reachable within delta
             if (vulnerability.fixedVersion) {
@@ -416,7 +479,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                 switch (delta) {
                     case 'patch':
                         return current.major === lastAffected.major &&
-                               current.minor === lastAffected.minor;
+                            current.minor === lastAffected.minor;
                     case 'minor':
                         return current.major === lastAffected.major;
                     case 'major':
@@ -445,6 +508,26 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         return undefined;
     }
 
+    /**
+     * Gets the version prefix to use based on the maximum upgrade delta.
+     * This allows future patches that might fix additional vulnerabilities.
+     *
+     * - 'patch' → '~' (allows patch updates, e.g., ~1.2.3 matches 1.2.x)
+     * - 'minor' → '^' (allows minor and patch updates, e.g., ^1.2.3 matches 1.x.x)
+     * - 'major' → '^' (same as minor; ^ is reasonable even for major upgrades)
+     */
+    private getVersionPrefixForDelta(): string {
+        switch (this.maximumUpgradeDelta) {
+            case 'patch':
+                return '~';
+            case 'minor':
+            case 'major':
+                return '^';
+            default:
+                return '';
+        }
+    }
+
     /**
      * Renders a dependency path as a string.
      * Example: "dependencies > lodash@4.17.20 > vulnerable-pkg@1.0.0"
@@ -478,13 +561,13 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         visited.add(key);
 
         // Build current path
-        const currentPath = [...path, { name: resolved.name, version: resolved.version }];
+        const currentPath = [...path, {name: resolved.name, version: resolved.version}];
 
         // Check for vulnerabilities in this package
         const vulns = db.getVulnerabilities(resolved.name);
         for (const vuln of vulns) {
             // Filter by severity
-            if (severityOrdinal(vuln.severity) < severityOrdinal(this.getMinimumSeverity())) {
+            if (severityOrdinal(vuln.severity) < severityOrdinal(this.minimumSeverity!)) {
                 continue;
             }
 
@@ -532,33 +615,266 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         }
     }
 
+    /**
+     * Finds preventive fixes for declared versions that are vulnerable,
+     * even if the resolved version is safe. This ensures package.json
+     * specifies a safe version constraint for future installs.
+     */
+    private findPreventiveFixes(
+        marker: { [key: string]: any },
+        scopes: DependencyScope[],
+        db: VulnerabilityDatabase
+    ): VulnerabilityFix[] {
+        const fixes: VulnerabilityFix[] = [];
+
+        for (const scope of scopes) {
+            const deps = marker[scope] || [];
+            for (const dep of deps) {
+                // Skip if no resolved version (can't compare)
+                if (!dep.resolved) continue;
+
+                // Extract the minimum version from the version constraint
+                const declaredMinVersion = this.extractMinimumVersion(dep.versionConstraint);
+                if (!declaredMinVersion) continue;
+
+                // Skip if declared version equals resolved version (no discrepancy)
+                if (declaredMinVersion === dep.resolved.version) continue;
+
+                // Check if the declared minimum version is vulnerable
+                const vulns = db.getVulnerabilities(dep.name);
+                const affectedCves: string[] = [];
+                let highestFixVersion: string | undefined;
+
+                for (const vuln of vulns) {
+                    // Filter by severity
+                    if (severityOrdinal(vuln.severity) < severityOrdinal(this.minimumSeverity!)) {
+                        continue;
+                    }
+
+                    // Filter by CVE pattern
+                    if (!this.matchesCvePattern(vuln)) {
+                        continue;
+                    }
+
+                    // Check if declared version is affected but resolved is not
+                    if (this.isVersionAffected(declaredMinVersion, vuln) &&
+                        !this.isVersionAffected(dep.resolved.version, vuln)) {
+                        affectedCves.push(vuln.cve);
+
+                        // Find fix version for this vulnerability.
+                        // Only use fixedVersion - don't guess based on lastAffectedVersion
+                        // since the guessed version may not exist (e.g., vm2@3.9.20 doesn't exist,
+                        // vue-template-compiler@3.0.0 will never exist).
+                        const fixVersion = vuln.fixedVersion;
+
+                        if (fixVersion && (!highestFixVersion || semver.gt(fixVersion, highestFixVersion))) {
+                            highestFixVersion = fixVersion;
+                        }
+                    }
+                }
+
+                if (affectedCves.length > 0 && highestFixVersion) {
+                    // Check if upgrade is within allowed delta
+                    if (this.isUpgradeWithinDelta(declaredMinVersion, highestFixVersion)) {
+                        const majorVersion = semver.major(declaredMinVersion);
+                        fixes.push({
+                            packageName: dep.name,
+                            newVersion: highestFixVersion,
+                            scope,
+                            isTransitive: false,
+                            cves: affectedCves,
+                            originalMajorVersion: majorVersion
+                        });
+                    }
+                }
+            }
+        }
+
+        return fixes;
+    }
+
+    /**
+     * Checks if upgrading from one version to another is within the allowed delta.
+     * Returns false in report-only mode.
+     */
+    private isUpgradeWithinDelta(fromVersion: string, toVersion: string): boolean {
+        if (this.isReportOnly()) {
+            return false;
+        }
+        return this.isVersionWithinDelta(fromVersion, toVersion);
+    }
+
+    /**
+     * Extracts the minimum version from a version constraint.
+     * For example: "^3.0.2" -> "3.0.2", "~1.2.3" -> "1.2.3", ">=2.0.0" -> "2.0.0"
+     */
+    private extractMinimumVersion(constraint: string): string | undefined {
+        if (!constraint) return undefined;
+
+        // Handle exact versions
+        if (semver.valid(constraint)) {
+            return constraint;
+        }
+
+        // Handle ranges with prefix: ^, ~, >=, >, etc.
+        const match = constraint.match(/^[~^>=<]*\s*(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/);
+        if (match && semver.valid(match[1])) {
+            return match[1];
+        }
+
+        // Try to coerce other formats
+        const coerced = semver.coerce(constraint);
+        return coerced?.version;
+    }
+
+    /**
+     * Finds the highest safe version for a package, recursively checking if fix versions
+     * themselves have vulnerabilities. Respects maximumUpgradeDelta from the original version.
+     *
+     * @param packageName The package to find a safe version for
+     * @param originalVersion The original installed version (used to check delta constraints)
+     * @param initialFixVersion The initial fix version to start from
+     * @param db The vulnerability database
+     * @param visited Set of versions already checked (to prevent infinite loops)
+     * @returns The highest safe version within delta, or undefined if none found
+     */
+    private findHighestSafeVersion(
+        packageName: string,
+        originalVersion: string,
+        initialFixVersion: string,
+        db: VulnerabilityDatabase,
+        visited: Set<string> = new Set()
+    ): string | undefined {
+        // Prevent infinite loops
+        if (visited.has(initialFixVersion)) {
+            return initialFixVersion;
+        }
+        visited.add(initialFixVersion);
+
+        // Check if the fix version itself has vulnerabilities
+        const vulnsInFixVersion = db.getVulnerabilities(packageName)
+            .filter(v => this.isVersionAffected(initialFixVersion, v));
+
+        if (vulnsInFixVersion.length === 0) {
+            // No vulnerabilities in this version - it's safe
+            return initialFixVersion;
+        }
+
+        // Find fix versions for vulnerabilities in the current fix version
+        let highestFixVersion = initialFixVersion;
+        for (const vuln of vulnsInFixVersion) {
+            const fixVersion = this.getUpgradeVersion(vuln);
+            if (fixVersion && semver.valid(fixVersion)) {
+                // Check if this fix version is within delta from the ORIGINAL version
+                if (this.isVersionWithinDelta(originalVersion, fixVersion)) {
+                    if (semver.gt(fixVersion, highestFixVersion)) {
+                        highestFixVersion = fixVersion;
+                    }
+                }
+            }
+        }
+
+        // If we found a higher version, recursively check it
+        if (highestFixVersion !== initialFixVersion) {
+            return this.findHighestSafeVersion(
+                packageName,
+                originalVersion,
+                highestFixVersion,
+                db,
+                visited
+            );
+        }
+
+        // Couldn't find a higher safe version within delta
+        return initialFixVersion;
+    }
+
+    /**
+     * Checks if a target version is within the allowed upgrade delta from the original version.
+     */
+    private isVersionWithinDelta(originalVersion: string, targetVersion: string): boolean {
+        try {
+            const original = semver.parse(originalVersion);
+            const target = semver.parse(targetVersion);
+            if (!original || !target) return false;
+
+            switch (this.maximumUpgradeDelta) {
+                case 'patch':
+                    return original.major === target.major && original.minor === target.minor;
+                case 'minor':
+                    return original.major === target.major;
+                case 'major':
+                    return true;
+                case 'none':
+                    return false;
+                default:
+                    return false;
+            }
+        } catch {
+            return false;
+        }
+    }
+
     /**
      * Computes the fixes to apply for the vulnerabilities found.
-     * Groups vulnerabilities by package and determines the best fix version.
+     * Groups vulnerabilities by package AND major version to handle packages with multiple
+     * major versions in the dependency tree (e.g., semver@6.x and semver@7.x).
+     * Recursively checks if fix versions have their own vulnerabilities.
+     *
+     * @param vulnerabilities The vulnerabilities found during scanning
+     * @param db The vulnerability database
      */
-    private computeFixes(vulnerabilities: VulnerableDependency[]): VulnerabilityFix[] {
+    private computeFixes(
+        vulnerabilities: VulnerableDependency[],
+        db: VulnerabilityDatabase
+    ): VulnerabilityFix[] {
         if (this.isReportOnly()) {
             return [];
         }
 
-        // Group vulnerabilities by package name
-        const byPackage = new Map<string, VulnerableDependency[]>();
+        // Group vulnerabilities by package name AND major version
+        // This handles packages like semver that may have multiple major versions
+        // (e.g., semver@6.3.0 and semver@7.5.0 both in the tree)
+        const byPackageAndMajor = new Map<string, VulnerableDependency[]>();
         for (const vuln of vulnerabilities) {
-            const existing = byPackage.get(vuln.resolved.name) || [];
+            const parsed = semver.parse(vuln.resolved.version);
+            const major = parsed?.major ?? 0;
+            const key = `${vuln.resolved.name}@${major}`;
+            const existing = byPackageAndMajor.get(key) || [];
             existing.push(vuln);
-            byPackage.set(vuln.resolved.name, existing);
+            byPackageAndMajor.set(key, existing);
+        }
+
+        // Count how many major versions exist for each package
+        const majorVersionsByPackage = new Map<string, Set<number>>();
+        for (const vuln of vulnerabilities) {
+            const parsed = semver.parse(vuln.resolved.version);
+            const major = parsed?.major ?? 0;
+            const existing = majorVersionsByPackage.get(vuln.resolved.name) || new Set();
+            existing.add(major);
+            majorVersionsByPackage.set(vuln.resolved.name, existing);
         }
 
         const fixes: VulnerabilityFix[] = [];
 
-        for (const [packageName, vulns] of byPackage) {
-            // Find the highest fix version needed across all vulnerabilities for this package
+        for (const [key, vulns] of byPackageAndMajor) {
+            const packageName = vulns[0].resolved.name;
+            const originalMajor = semver.parse(vulns[0].resolved.version)?.major ?? 0;
+            const hasMultipleMajorVersions = (majorVersionsByPackage.get(packageName)?.size ?? 0) > 1;
+
+            // Find the highest fix version needed across all vulnerabilities for this package@major
             let highestFixVersion: string | undefined;
             const cves: string[] = [];
             let isTransitive = true;
             let scope: DependencyScope | undefined;
+            let originalVersion: string | undefined;
 
             for (const vuln of vulns) {
+                // Track the original version for delta checking
+                if (!originalVersion) {
+                    originalVersion = vuln.resolved.version;
+                }
+
                 // Check if upgradeable within delta
                 if (!this.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability)) {
                     continue;
@@ -566,8 +882,19 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
 
                 const fixVersion = this.getUpgradeVersion(vuln.vulnerability);
                 if (fixVersion) {
-                    if (!highestFixVersion || semver.gt(fixVersion, highestFixVersion)) {
-                        highestFixVersion = fixVersion;
+                    // When there are multiple major versions of the same package in the tree
+                    // (e.g., semver@6.x and semver@7.x), only consider fix versions that match
+                    // the same major version to avoid suggesting semver@7.5.2 as a fix for semver@6.3.0.
+                    // When there's only one major version, respect maximumUpgradeDelta instead.
+                    const fixMajor = semver.parse(fixVersion)?.major;
+                    const shouldConsiderFix = hasMultipleMajorVersions
+                        ? fixMajor === originalMajor
+                        : true; // Let isUpgradeableWithinDelta handle the constraint
+
+                    if (shouldConsiderFix) {
+                        if (!highestFixVersion || semver.gt(fixVersion, highestFixVersion)) {
+                            highestFixVersion = fixVersion;
+                        }
                     }
                 }
 
@@ -579,13 +906,22 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                 }
             }
 
-            if (highestFixVersion && cves.length > 0) {
+            if (highestFixVersion && cves.length > 0 && originalVersion) {
+                // Recursively find the highest safe version (checking if fix versions have vulns)
+                const safeVersion = this.findHighestSafeVersion(
+                    packageName,
+                    originalVersion,
+                    highestFixVersion,
+                    db
+                );
+
                 fixes.push({
                     packageName,
-                    newVersion: highestFixVersion,
+                    newVersion: safeVersion || highestFixVersion,
                     isTransitive,
                     cves,
-                    scope
+                    scope,
+                    originalMajorVersion: originalMajor
                 });
             }
         }
@@ -593,28 +929,67 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         return fixes;
     }
 
-    async scanner(acc: Accumulator): Promise<TreeVisitor<any, ExecutionContext>> {
+    override async scanner(acc: Accumulator): Promise<TreeVisitor<any, ExecutionContext>> {
         const recipe = this;
 
-        return new class extends JsonVisitor<ExecutionContext> {
-            protected async visitDocument(doc: Json.Document, _ctx: ExecutionContext): Promise<Json | undefined> {
-                // Only process package.json files
+        // Lock file names to capture
+        const LOCK_FILE_NAMES = ['pnpm-lock.yaml', 'yarn.lock', 'package-lock.json', 'bun.lock'];
+
+        return new class extends TreeVisitor<Tree, ExecutionContext> {
+            protected async accept(tree: Tree, ctx: ExecutionContext): Promise<Tree | undefined> {
+                // Handle JSON documents (package.json and JSON lock files)
+                if (isJson(tree) && tree.kind === Json.Kind.Document) {
+                    return this.handleJsonDocument(tree as Json.Document, ctx);
+                }
+
+                // Handle YAML documents (pnpm-lock.yaml)
+                if (isYaml(tree) && isDocuments(tree)) {
+                    return this.handleYamlDocument(tree, ctx);
+                }
+
+                // Handle PlainText files (yarn.lock for Yarn Classic)
+                if (isPlainText(tree)) {
+                    return this.handlePlainTextDocument(tree as PlainText, ctx);
+                }
+
+                return tree;
+            }
+
+            private async handleJsonDocument(doc: Json.Document, _ctx: ExecutionContext): Promise<Json | undefined> {
+                const basename = path.basename(doc.sourcePath);
+
+                // Capture JSON lock file content (package-lock.json, bun.lock)
+                if (LOCK_FILE_NAMES.includes(basename)) {
+                    acc.originalLockFiles.set(doc.sourcePath, await TreePrinters.print(doc));
+                    return doc;
+                }
+
+                // Only process package.json files for vulnerability analysis
                 if (!doc.sourcePath.endsWith('package.json')) {
                     return doc;
                 }
 
+                // Store all package.json contents for workspace support
+                const packageJsonContent = await TreePrinters.print(doc);
+                acc.allPackageJsonContents.set(doc.sourcePath, packageJsonContent);
+
                 const marker = findNodeResolutionResult(doc);
                 if (!marker) {
                     return doc;
                 }
 
+                // Track workspace roots and their member paths
+                if (marker.workspacePackagePaths && marker.workspacePackagePaths.length > 0) {
+                    acc.workspaceRoots.set(doc.sourcePath, [...marker.workspacePackagePaths]);
+                }
+
                 const vulnerabilities: VulnerableDependency[] = [];
                 const visited = new Set<string>();
 
                 // Determine which scopes to check
                 const scopesToCheck: DependencyScope[] = recipe.scope
                     ? [recipe.scope]
-                    : ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+                    : ALL_DEPENDENCY_SCOPES;
 
                 for (const scope of scopesToCheck) {
                     const deps = marker[scope] || [];
@@ -634,46 +1009,100 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     }
                 }
 
-                if (vulnerabilities.length > 0) {
-                    acc.vulnerableByProject.set(doc.sourcePath, vulnerabilities);
+                // Extract package manager and config files for potential updates
+                const pm = marker.packageManager ?? PackageManager.Npm;
+                const configFiles: Record<string, string> = {};
+                const projectNpmrc = marker.npmrcConfigs?.find(c => c.scope === NpmrcScope.Project);
+                if (projectNpmrc) {
+                    const lines = Object.entries(projectNpmrc.properties)
+                        .map(([key, value]) => `${key}=${value}`);
+                    configFiles['.npmrc'] = lines.join('\n');
+                }
 
-                    // Compute fixes
-                    const fixes = recipe.computeFixes(vulnerabilities);
-                    if (fixes.length > 0) {
-                        acc.fixesByProject.set(doc.sourcePath, fixes);
+                // Check if this is a workspace root (has workspaces field)
+                // We need to store project info for workspace roots even if they don't have
+                // vulnerabilities themselves, because their members might have vulnerabilities
+                const storedContent = acc.allPackageJsonContents.get(doc.sourcePath);
+                let isWorkspaceRoot = false;
+                if (storedContent) {
+                    try {
+                        isWorkspaceRoot = JSON.parse(storedContent).workspaces !== undefined;
+                    } catch {
+                        // Invalid JSON, not a workspace root
+                    }
+                }
 
-                        // Store project info for lock file updates
-                        const projectDir = path.dirname(path.resolve(doc.sourcePath));
-                        const pm = marker.packageManager ?? PackageManager.Npm;
+                // Compute fixes from actual vulnerabilities (these get reported in data table)
+                let fixes: VulnerabilityFix[] = [];
+                if (vulnerabilities.length > 0) {
+                    acc.vulnerableByProject.set(doc.sourcePath, vulnerabilities);
+                    fixes = recipe.computeFixes(vulnerabilities, acc.db);
+                }
 
-                        acc.projectsToUpdate.set(doc.sourcePath, {
-                            projectDir,
-                            packageJsonPath: doc.sourcePath,
-                            originalPackageJson: await this.printDocument(doc),
-                            packageManager: pm
-                        });
+                // Fix declared versions for preventive upgrades (when enabled)
+                // These are NOT reported in the data table since the resolved version is safe
+                if (recipe.fixDeclaredVersions) {
+                    const preventiveFixes = recipe.findPreventiveFixes(marker, scopesToCheck, acc.db);
+                    // Merge preventive fixes, avoiding duplicates with actual fixes
+                    const existingPackages = new Set(fixes.map(f => `${f.packageName}@${f.scope}`));
+                    for (const fix of preventiveFixes) {
+                        const key = `${fix.packageName}@${fix.scope}`;
+                        if (!existingPackages.has(key)) {
+                            fixes.push(fix);
+                            existingPackages.add(key);
+                        }
                     }
                 }
 
+                if (fixes.length > 0) {
+                    acc.fixesByProject.set(doc.sourcePath, fixes);
+
+                    // Store project info for lock file updates
+                    acc.projectsToUpdate.set(doc.sourcePath, {
+                        packageJsonPath: doc.sourcePath,
+                        originalPackageJson: await TreePrinters.print(doc),
+                        packageManager: pm,
+                        configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined
+                    });
+                } else if (isWorkspaceRoot && !acc.projectsToUpdate.has(doc.sourcePath)) {
+                    // Workspace root without vulnerabilities - still need project info
+                    // for processing workspace members with vulnerabilities
+                    acc.projectsToUpdate.set(doc.sourcePath, {
+                        packageJsonPath: doc.sourcePath,
+                        originalPackageJson: await TreePrinters.print(doc),
+                        packageManager: pm,
+                        configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined
+                    });
+                }
+
                 return doc;
             }
 
-            private async printDocument(doc: Json.Document): Promise<string> {
-                return TreePrinters.print(doc);
+            private async handleYamlDocument(docs: Yaml.Documents, _ctx: ExecutionContext): Promise<Yaml.Documents | undefined> {
+                const basename = path.basename(docs.sourcePath);
+
+                // Capture YAML lock file content (pnpm-lock.yaml)
+                if (LOCK_FILE_NAMES.includes(basename)) {
+                    acc.originalLockFiles.set(docs.sourcePath, await TreePrinters.print(docs));
+                }
+
+                return docs;
             }
-        };
-    }
 
-    /**
-     * Returns sub-recipes to apply the fixes.
-     */
-    async getRecipeList(): Promise<Recipe[]> {
-        // This method is called before scanning, so we can't return fix recipes here.
-        // Instead, we'll apply fixes in the editor phase.
-        return [];
-    }
+            private async handlePlainTextDocument(text: PlainText, _ctx: ExecutionContext): Promise<PlainText | undefined> {
+                const basename = path.basename(text.sourcePath);
+
+                // Capture plain text lock file content (yarn.lock for Yarn Classic)
+                if (LOCK_FILE_NAMES.includes(basename)) {
+                    acc.originalLockFiles.set(text.sourcePath, await TreePrinters.print(text));
+                }
 
-    async editorWithData(acc: Accumulator): Promise<TreeVisitor<any, ExecutionContext>> {
+                return text;
+            }
+        }
+    };
+
+    override async editorWithData(acc: Accumulator): Promise<TreeVisitor<any, ExecutionContext>> {
         const recipe = this;
 
         // YAML lock file names (pnpm-lock.yaml, and yarn.lock for Berry)
@@ -776,32 +1205,31 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
 
             private async handlePackageJson(doc: Json.Document, ctx: ExecutionContext): Promise<Json | undefined> {
                 const vulnerabilities = acc.vulnerableByProject.get(doc.sourcePath);
-                if (!vulnerabilities || vulnerabilities.length === 0) {
-                    return doc;
-                }
 
-                // Insert rows into the data table for each vulnerability
-                for (const vuln of vulnerabilities) {
-                    const upgradeable = recipe.isUpgradeableWithinDelta(
-                        vuln.resolved.version,
-                        vuln.vulnerability
-                    );
+                // Insert rows into the data table for each vulnerability (always, even in report-only mode)
+                if (vulnerabilities && vulnerabilities.length > 0) {
+                    for (const vuln of vulnerabilities) {
+                        const upgradeable = recipe.isUpgradeableWithinDelta(
+                            vuln.resolved.version,
+                            vuln.vulnerability
+                        );
 
-                    recipe.vulnerabilityReport.insertRow(ctx, new VulnerabilityReportRow(
-                        doc.sourcePath,
-                        vuln.vulnerability.cve,
-                        vuln.resolved.name,
-                        vuln.resolved.version,
-                        vuln.vulnerability.fixedVersion || '',
-                        vuln.vulnerability.lastAffectedVersion || '',
-                        upgradeable,
-                        vuln.vulnerability.summary,
-                        vuln.vulnerability.severity,
-                        vuln.depth,
-                        vuln.vulnerability.cwes,
-                        vuln.isDirect,
-                        recipe.renderPath(vuln.scope, vuln.path)
-                    ));
+                        recipe.vulnerabilityReport.insertRow(ctx, new VulnerabilityReportRow(
+                            doc.sourcePath,
+                            vuln.vulnerability.cve,
+                            vuln.resolved.name,
+                            vuln.resolved.version,
+                            vuln.vulnerability.fixedVersion || '',
+                            vuln.vulnerability.lastAffectedVersion || '',
+                            upgradeable,
+                            vuln.vulnerability.summary,
+                            vuln.vulnerability.severity,
+                            vuln.depth,
+                            vuln.vulnerability.cwes,
+                            vuln.isDirect,
+                            recipe.renderPath(vuln.scope, vuln.path)
+                        ));
+                    }
                 }
 
                 // Apply fixes if not in report-only mode
@@ -809,13 +1237,97 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     return doc;
                 }
 
+                // Lazy workspace detection: build workspace map from collected package.json contents
+                // This is needed because the parser might not have detected workspaces if the files
+                // weren't on disk yet, or the marker wasn't populated correctly.
+                if (!acc.workspaceDetectionComplete) {
+                    this.detectWorkspacesFromContents();
+                    acc.workspaceDetectionComplete = true;
+                }
+
+                // Check if this file was already modified by workspace processing
+                const preModifiedContent = acc.modifiedWorkspaceMemberContents.get(doc.sourcePath)
+                    || acc.updatedPackageJsons.get(doc.sourcePath);
+                if (preModifiedContent) {
+                    return this.applyModifiedContent(doc, preModifiedContent);
+                }
+
+                // Determine if this is a workspace root or member
+                const isWorkspaceRoot = acc.workspaceRoots.has(doc.sourcePath);
+                const workspaceRootPath = this.findWorkspaceRootFor(doc.sourcePath);
+                const isWorkspaceMember = workspaceRootPath !== undefined;
+
+                // For workspace members, trigger workspace processing via the root
+                if (isWorkspaceMember && !isWorkspaceRoot) {
+                    // Check if we need to process this workspace (any fixes in root or members)
+                    const needsProcessing = this.workspaceNeedsProcessing(workspaceRootPath);
+                    if (needsProcessing && !acc.processedProjects.has(workspaceRootPath)) {
+                        // Process the entire workspace
+                        const rootUpdateInfo = acc.projectsToUpdate.get(workspaceRootPath);
+                        if (rootUpdateInfo) {
+                            const failureMessage = await runInstallIfNeeded(workspaceRootPath, acc, () =>
+                                recipe.runWorkspacePackageManagerInstall(acc, workspaceRootPath, rootUpdateInfo)
+                            );
+                            if (failureMessage) {
+                                return markupWarn(
+                                    doc,
+                                    `Failed to fix vulnerabilities in workspace`,
+                                    failureMessage
+                                );
+                            }
+                        }
+                    }
+
+                    // Return modified content if available
+                    const modifiedContent = acc.modifiedWorkspaceMemberContents.get(doc.sourcePath);
+                    if (modifiedContent) {
+                        return this.applyModifiedContent(doc, modifiedContent);
+                    }
+                    return doc;
+                }
+
+                // For workspace roots, process the entire workspace
+                if (isWorkspaceRoot) {
+                    const updateInfo = acc.projectsToUpdate.get(doc.sourcePath);
+                    if (!updateInfo) {
+                        return doc;
+                    }
+
+                    const needsProcessing = this.workspaceNeedsProcessing(doc.sourcePath);
+                    if (!needsProcessing) {
+                        return doc;
+                    }
+
+                    const failureMessage = await runInstallIfNeeded(doc.sourcePath, acc, () =>
+                        recipe.runWorkspacePackageManagerInstall(acc, doc.sourcePath, updateInfo)
+                    );
+                    if (failureMessage) {
+                        return markupWarn(
+                            doc,
+                            `Failed to fix vulnerabilities in ${doc.sourcePath}`,
+                            failureMessage
+                        );
+                    }
+
+                    // Only apply changes to root if it has actual fixes (direct or transitive overrides)
+                    const rootFixes = acc.fixesByProject.get(doc.sourcePath) || [];
+                    if (rootFixes.length > 0) {
+                        const modifiedContent = acc.updatedPackageJsons.get(doc.sourcePath);
+                        if (modifiedContent) {
+                            const result = await this.applyModifiedContent(doc, modifiedContent);
+                            return updateNodeResolutionMarker(result as Json.Document, updateInfo, acc);
+                        }
+                    }
+                    return doc;
+                }
+
+                // Non-workspace package.json: process normally
                 const fixes = acc.fixesByProject.get(doc.sourcePath);
                 const updateInfo = acc.projectsToUpdate.get(doc.sourcePath);
                 if (!fixes || fixes.length === 0 || !updateInfo) {
                     return doc;
                 }
 
-                // Run package manager install if needed
                 const failureMessage = await runInstallIfNeeded(doc.sourcePath, acc, () =>
                     recipe.runPackageManagerInstall(acc, updateInfo, fixes)
                 );
@@ -827,21 +1339,146 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     );
                 }
 
-                // Update the dependency versions in the JSON AST (preserves formatting)
-                let result: Json.Document = doc;
-                for (const fix of fixes) {
-                    if (!fix.isTransitive && fix.scope) {
-                        const visitor = new UpdateVersionVisitor(
-                            fix.packageName,
-                            fix.newVersion,
-                            fix.scope
-                        );
-                        result = await visitor.visit(result, undefined) as Json.Document;
+                const modifiedPackageJson = acc.updatedPackageJsons.get(doc.sourcePath);
+                if (!modifiedPackageJson) {
+                    return doc;
+                }
+
+                const result = await this.applyModifiedContent(doc, modifiedPackageJson);
+                return updateNodeResolutionMarker(result as Json.Document, updateInfo, acc);
+            }
+
+            /**
+             * Find the workspace root that contains a given package.json path.
+             */
+            private findWorkspaceRootFor(packageJsonPath: string): string | undefined {
+                for (const [rootPath, memberPaths] of acc.workspaceRoots) {
+                    if (memberPaths.includes(packageJsonPath)) {
+                        return rootPath;
                     }
                 }
+                return undefined;
+            }
 
-                // Update the NodeResolutionResult marker
-                return updateNodeResolutionMarker(result, updateInfo, acc);
+            /**
+             * Check if a workspace needs processing (has any fixes in root or members).
+             */
+            private workspaceNeedsProcessing(rootPath: string): boolean {
+                // Check if root has fixes
+                if (acc.fixesByProject.has(rootPath)) {
+                    return true;
+                }
+                // Check if any member has fixes
+                const memberPaths = acc.workspaceRoots.get(rootPath) || [];
+                for (const memberPath of memberPaths) {
+                    if (acc.fixesByProject.has(memberPath)) {
+                        return true;
+                    }
+                }
+                return false;
+            }
+
+            /**
+             * Detects workspaces from the collected package.json contents.
+             * This is a fallback for when the parser doesn't detect workspaces
+             * (e.g., marker.workspacePackagePaths wasn't populated).
+             */
+            private detectWorkspacesFromContents(): void {
+                // Find package.json files with workspaces field
+                for (const [pkgPath, content] of acc.allPackageJsonContents) {
+                    // Skip if already in workspaceRoots (parser detected it)
+                    if (acc.workspaceRoots.has(pkgPath)) {
+                        continue;
+                    }
+
+                    try {
+                        const pkgJson = JSON.parse(content);
+                        if (!pkgJson.workspaces) {
+                            continue;
+                        }
+
+                        // Get workspace patterns
+                        const patterns: string[] = Array.isArray(pkgJson.workspaces)
+                            ? pkgJson.workspaces
+                            : pkgJson.workspaces.packages || [];
+
+                        if (patterns.length === 0) {
+                            continue;
+                        }
+
+                        // Get the directory of this package.json
+                        const rootDir = path.dirname(pkgPath);
+
+                        // Find member package.json paths that match the patterns
+                        const memberPaths: string[] = [];
+                        for (const [otherPath] of acc.allPackageJsonContents) {
+                            if (otherPath === pkgPath) continue;
+
+                            // Check if this path matches any workspace pattern
+                            const relativePath = rootDir === '.'
+                                ? otherPath
+                                : otherPath.startsWith(rootDir + '/')
+                                    ? otherPath.slice(rootDir.length + 1)
+                                    : null;
+
+                            if (relativePath && this.matchesWorkspacePattern(relativePath, patterns)) {
+                                memberPaths.push(otherPath);
+                            }
+                        }
+
+                        if (memberPaths.length > 0) {
+                            acc.workspaceRoots.set(pkgPath, memberPaths);
+                        }
+                    } catch {
+                        // Invalid JSON, skip
+                    }
+                }
+            }
+
+            /**
+             * Checks if a package.json path matches any of the workspace patterns.
+             * Supports simple patterns like "packages/*" and "apps/*".
+             */
+            private matchesWorkspacePattern(relativePath: string, patterns: string[]): boolean {
+                // relativePath is like "packages/member-a/package.json"
+                // We need to check if the directory matches the pattern
+
+                for (const pattern of patterns) {
+                    if (pattern.endsWith('/*')) {
+                        // Pattern like "packages/*" should match "packages/anything/package.json"
+                        const baseDir = pattern.slice(0, -2);
+                        const pathParts = relativePath.split('/');
+                        // Check: baseDir/name/package.json
+                        if (pathParts.length === 3 &&
+                            pathParts[0] === baseDir &&
+                            pathParts[2] === 'package.json') {
+                            return true;
+                        }
+                    } else if (!pattern.includes('*')) {
+                        // Exact match pattern like "tools/eslint-config"
+                        if (relativePath === `${pattern}/package.json`) {
+                            return true;
+                        }
+                    }
+                    // TODO: Support more complex glob patterns if needed
+                }
+                return false;
+            }
+
+            /**
+             * Apply modified content to a document, preserving its ID and markers.
+             */
+            private async applyModifiedContent(doc: Json.Document, content: string): Promise<Json.Document> {
+                const parsedModified = await new JsonParser({}).parseOne({
+                    text: content,
+                    sourcePath: doc.sourcePath
+                }) as Json.Document;
+
+                return {
+                    ...doc,
+                    value: parsedModified.value,
+                    eof: parsedModified.eof
+                } as Json.Document;
             }
         };
     }
@@ -849,6 +1486,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
     /**
      * Runs the package manager in a temporary directory to update the lock file.
      * Writes a modified package.json with all new versions, then runs install.
+     * All file contents are provided from in-memory sources (SourceFiles), not read from disk.
      */
     private async runPackageManagerInstall(
         acc: Accumulator,
@@ -858,33 +1496,289 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         // Create modified package.json with all the new version constraints
         const modifiedPackageJson = this.createModifiedPackageJson(
             updateInfo.originalPackageJson,
-            fixes
+            fixes,
+            updateInfo.packageManager
         );
 
+        // Note: We intentionally do NOT pass the original lock file content.
+        // npm (and other package managers) don't apply overrides to already-resolved
+        // dependencies in an existing lock file. By not passing the original lock file,
+        // we force a fresh resolution that respects the overrides.
+        // This may cause more version changes in unrelated packages, but it's necessary
+        // to actually fix the vulnerabilities.
+
         const result = await runInstallInTempDir(
-            updateInfo.projectDir,
             updateInfo.packageManager,
-            modifiedPackageJson
+            modifiedPackageJson,
+            {
+                configFiles: updateInfo.configFiles
+            }
         );
 
         storeInstallResult(result, acc, updateInfo, modifiedPackageJson);
     }
 
+    /**
+     * Runs the package manager in a temporary directory for a workspace.
+     * Handles direct dependency fixes in workspace members and transitive fixes in root.
+     */
+    private async runWorkspacePackageManagerInstall(
+        acc: Accumulator,
+        rootPath: string,
+        rootUpdateInfo: ProjectUpdateInfo
+    ): Promise<void> {
+        const memberPaths = acc.workspaceRoots.get(rootPath) || [];
+        const pm = rootUpdateInfo.packageManager;
+
+        // Collect all transitive fixes from root and members (for root overrides)
+        const allTransitiveFixes: VulnerabilityFix[] = [];
+
+        // Process root fixes
+        const rootFixes = acc.fixesByProject.get(rootPath) || [];
+        const rootDirectFixes = rootFixes.filter(f => !f.isTransitive);
+        const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive);
+        allTransitiveFixes.push(...rootTransitiveFixes);
+
+        // Process member fixes and collect transitive fixes
+        const memberDirectFixes = new Map<string, VulnerabilityFix[]>();
+        for (const memberPath of memberPaths) {
+            const memberFixes = acc.fixesByProject.get(memberPath) || [];
+            const directFixes = memberFixes.filter(f => !f.isTransitive);
+            const transitiveFixes = memberFixes.filter(f => f.isTransitive);
+
+            if (directFixes.length > 0) {
+                memberDirectFixes.set(memberPath, directFixes);
+            }
+            allTransitiveFixes.push(...transitiveFixes);
+        }
+
+        // Create modified root package.json (with direct fixes + all transitive overrides)
+        const rootOriginalContent = acc.allPackageJsonContents.get(rootPath) || rootUpdateInfo.originalPackageJson;
+        const modifiedRootPackageJson = this.createModifiedPackageJson(
+            rootOriginalContent,
+            [...rootDirectFixes, ...allTransitiveFixes],
+            pm
+        );
+
+        // Create modified workspace member package.json files (with direct fixes only)
+        // Keep the full package.json content including workspace: dependencies so Yarn
+        // can properly resolve them in the temp directory
+        const workspacePackages: Record<string, string> = {};
+        for (const memberPath of memberPaths) {
+            const originalContent = acc.allPackageJsonContents.get(memberPath);
+            if (!originalContent) {
+                continue;
+            }
+
+            const directFixes = memberDirectFixes.get(memberPath);
+            let modifiedContent: string;
+            if (directFixes && directFixes.length > 0) {
+                // Apply direct dependency fixes to this member
+                modifiedContent = this.createModifiedPackageJsonDirectOnly(
+                    originalContent,
+                    directFixes
+                );
+                // Store the modified content for the actual output
+                acc.modifiedWorkspaceMemberContents.set(memberPath, modifiedContent);
+            } else {
+                modifiedContent = originalContent;
+            }
+
+            // Keep the full package.json including workspace: dependencies
+            workspacePackages[memberPath] = modifiedContent;
+        }
+
+        // Note: We intentionally do NOT pass the original lock file content.
+        // npm (and other package managers) don't apply overrides to already-resolved
+        // dependencies in an existing lock file. By not passing the original lock file,
+        // we force a fresh resolution that respects the overrides.
+
+        // Run workspace install with full workspace structure
+        // We keep workspace: dependencies and the workspaces field so Yarn can resolve them
+        const result = await runWorkspaceInstallInTempDir(
+            pm,
+            modifiedRootPackageJson,
+            {
+                configFiles: rootUpdateInfo.configFiles,
+                workspacePackages
+            }
+        );
+
+        storeInstallResult(result, acc, rootUpdateInfo, modifiedRootPackageJson);
+    }
+
+    /**
+     * Creates a modified package.json with only direct dependency fixes.
+     * Used for workspace members where transitive fixes go to the root.
+     */
+    private createModifiedPackageJsonDirectOnly(
+        originalContent: string,
+        fixes: VulnerabilityFix[]
+    ): string {
+        let packageJson = JSON.parse(originalContent);
+
+        for (const fix of fixes) {
+            if (!fix.isTransitive && fix.scope) {
+                // Direct dependency: update the version in the scope
+                if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
+                    const originalVersion = packageJson[fix.scope][fix.packageName];
+                    packageJson[fix.scope][fix.packageName] = applyVersionPrefix(originalVersion, fix.newVersion);
+                }
+            }
+        }
+
+        return JSON.stringify(packageJson, null, 2);
+    }
+
     /**
      * Creates a modified package.json with all the updated dependency versions.
+     * For direct dependencies, updates the version in the appropriate scope.
+     * For transitive dependencies, adds overrides/resolutions based on the package manager.
+     *
+     * Note: For pnpm, transitive dependencies are also added as devDependencies because
+     * pnpm's overrides don't work reliably for auto-installed peer dependencies when
+     * autoInstallPeers is enabled (the default). Adding as a devDependency ensures
+     * pnpm installs the specified version which then satisfies peer dependency requirements.
      */
     private createModifiedPackageJson(
         originalContent: string,
-        fixes: VulnerabilityFix[]
+        fixes: VulnerabilityFix[],
+        packageManager: PackageManager
     ): string {
-        const packageJson = JSON.parse(originalContent);
+        let packageJson = JSON.parse(originalContent);
+
+        // Check if there are multiple fixes for the same package with different major versions
+        const fixesByPackage = new Map<string, VulnerabilityFix[]>();
+        for (const fix of fixes) {
+            const existing = fixesByPackage.get(fix.packageName) || [];
+            existing.push(fix);
+            fixesByPackage.set(fix.packageName, existing);
+        }
 
         for (const fix of fixes) {
             if (!fix.isTransitive && fix.scope) {
+                // Direct dependency: update the version in the scope
                 if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
                     const originalVersion = packageJson[fix.scope][fix.packageName];
                     packageJson[fix.scope][fix.packageName] = applyVersionPrefix(originalVersion, fix.newVersion);
                 }
+            } else if (fix.isTransitive) {
+                // Check if this package is also a direct dependency in any scope.
+                // Package managers handle overrides for direct dependencies differently:
+                // - npm: EOVERRIDE error - doesn't allow overrides that conflict with direct deps
+                // - pnpm: May work but behavior can be inconsistent
+                // - yarn: Resolutions may conflict with direct dependencies
+                // - bun: Similar to npm
+                // For all package managers, it's safest to update the direct dependency version
+                // when the package is already a direct dependency.
+                const directDepScope = findDirectDependencyScope(packageJson, fix.packageName);
+
+                if (directDepScope) {
+                    // Package is a direct dependency.
+                    // Check if the major version of the direct dependency matches the fix's major version.
+                    // This handles the case where a package exists at multiple major versions:
+                    // e.g., form-data@^4 (direct, safe) and form-data@3.0.1 (transitive, vulnerable)
+                    // We should NOT downgrade the direct dependency to fix the transitive.
+                    const directVersion = packageJson[directDepScope][fix.packageName];
+                    const directMajor = semver.major(semver.coerce(directVersion) || '0.0.0');
+
+                    if (fix.originalMajorVersion !== undefined && directMajor !== fix.originalMajorVersion) {
+                        // Major versions don't match - use version-specific override for the transitive
+                        // instead of modifying the direct dependency
+                        const isYarn = packageManager === PackageManager.YarnClassic ||
+                            packageManager === PackageManager.YarnBerry;
+
+                        if (!isYarn) {
+                            // Use version-specific override: e.g., "form-data@^3": "3.0.4"
+                            const versionSpecificKey = `${fix.packageName}@^${fix.originalMajorVersion}`;
+                            packageJson = applyOverrideToPackageJson(
+                                packageJson,
+                                packageManager,
+                                versionSpecificKey,
+                                fix.newVersion
+                            );
+                        } else {
+                            // Yarn doesn't support version-specific resolutions
+                            // Skip this fix - the direct dependency at a higher version is already safe
+                            // and we can't override just the transitive without affecting the direct
+                        }
+                        continue;
+                    }
+
+                    // Major versions match - safe to update the direct dependency version
+                    packageJson[directDepScope][fix.packageName] = applyVersionPrefix(directVersion, fix.newVersion);
+                    // Don't add an override - it would conflict with the direct dependency
+                    continue;
+                }
+
+                // Check if this package has multiple major versions needing fixes
+                const packageFixes = fixesByPackage.get(fix.packageName) || [];
+                const hasMultipleMajorVersions = packageFixes.length > 1 &&
+                    new Set(packageFixes.map(f => f.originalMajorVersion)).size > 1;
+
+                // Check if there are already version-specific overrides for this package.
+                // If so, we should continue using version-specific overrides to avoid
+                // a generic override clobbering the existing version-specific ones.
+                const existingOverrides = getOverridesFromPackageJson(packageJson, packageManager);
+                const hasExistingVersionSpecificOverrides = existingOverrides &&
+                    Object.keys(existingOverrides).some(key =>
+                        key.startsWith(`${fix.packageName}@`)
+                    );
+
+                // Yarn resolutions don't support version-specific keys like "package@^version".
+                // When Yarn sees "js-yaml@^4": "4.1.1", it misinterprets it as resolving
+                // package "js-yaml" to version "^4@4.1.1" which is invalid.
+                // For Yarn, we must use simple package names and apply the highest fix version.
+                const isYarn = packageManager === PackageManager.YarnClassic ||
+                    packageManager === PackageManager.YarnBerry;
+
+                const useVersionSpecificOverride = !isYarn &&
+                    (hasMultipleMajorVersions || hasExistingVersionSpecificOverrides) &&
+                    fix.originalMajorVersion !== undefined;
+
+                if (useVersionSpecificOverride) {
+                    // Use version-specific override for packages with multiple major versions
+                    // e.g., "semver@^6": "6.3.1", "semver@^7": "7.5.2"
+                    // Note: This only works for npm, pnpm, and bun - not Yarn
+                    const versionSpecificKey = `${fix.packageName}@^${fix.originalMajorVersion}`;
+                    packageJson = applyOverrideToPackageJson(
+                        packageJson,
+                        packageManager,
+                        versionSpecificKey,
+                        fix.newVersion
+                    );
+                } else {
+                    // Single major version and no existing version-specific overrides
+                    // Use simple package override
+                    packageJson = applyOverrideToPackageJson(
+                        packageJson,
+                        packageManager,
+                        fix.packageName,
+                        fix.newVersion
+                    );
+                }
+
+                // For pnpm, also add as devDependency. This is needed because pnpm's
+                // overrides don't work reliably in all cases:
+                // 1. Auto-installed peer dependencies when autoInstallPeers is enabled
+                // 2. Packages with multiple major versions in the dependency tree
+                // 3. Optional dependencies resolved before overrides take effect
+                // Adding as devDependency ensures pnpm installs the specified version.
+                if (packageManager === PackageManager.Pnpm) {
+                    if (!packageJson.devDependencies) {
+                        packageJson.devDependencies = {};
+                    }
+                    // Only add if not already a direct dependency in any scope
+                    if (!packageJson.dependencies?.[fix.packageName] &&
+                        !packageJson.devDependencies[fix.packageName] &&
+                        !packageJson.peerDependencies?.[fix.packageName] &&
+                        !packageJson.optionalDependencies?.[fix.packageName]) {
+                        // Use version prefix based on maximumUpgradeDelta to allow
+                        // future patches that might fix additional vulnerabilities
+                        const prefix = this.getVersionPrefixForDelta();
+                        packageJson.devDependencies[fix.packageName] = prefix + fix.newVersion;
+                    }
+                }
             }
         }
 
@@ -905,75 +1799,52 @@ export function extractVersionPrefix(versionString: string): { prefix: string; v
             version: match[2]
         };
     }
-    return { prefix: '', version: versionString };
+    return {prefix: '', version: versionString};
 }
 
 /**
  * Applies the original version prefix to a new version.
  */
 export function applyVersionPrefix(originalVersion: string, newVersion: string): string {
-    const { prefix } = extractVersionPrefix(originalVersion);
+    const {prefix} = extractVersionPrefix(originalVersion);
     return prefix + newVersion;
 }
 
 /**
- * Visitor that updates the version of a specific dependency in a specific scope.
+ * Finds the dependency scope where a package is declared as a direct dependency.
+ * Returns the scope name (dependencies, devDependencies, etc.) or undefined if not found.
  */
-class UpdateVersionVisitor extends JsonVisitor<void> {
-    private readonly packageName: string;
-    private readonly newVersion: string;
-    private readonly targetScope: DependencyScope;
-    private inTargetScope = false;
-
-    constructor(packageName: string, newVersion: string, targetScope: DependencyScope) {
-        super();
-        this.packageName = packageName;
-        this.newVersion = newVersion;
-        this.targetScope = targetScope;
-    }
-
-    protected async visitMember(member: Json.Member, p: void): Promise<Json | undefined> {
-        // Check if we're entering the target scope
-        const keyName = getMemberKeyName(member);
-
-        if (keyName === this.targetScope) {
-            // We're entering the dependencies scope
-            this.inTargetScope = true;
-            const result = await super.visitMember(member, p);
-            this.inTargetScope = false;
-            return result;
-        }
-
-        // Check if this is the dependency we're looking for
-        if (this.inTargetScope && keyName === this.packageName) {
-            // Update the version value
-            return this.updateVersion(member);
+function findDirectDependencyScope(
+    packageJson: Record<string, any>,
+    packageName: string
+): DependencyScope | undefined {
+    for (const scope of ALL_DEPENDENCY_SCOPES) {
+        if (packageJson[scope]?.[packageName]) {
+            return scope;
         }
-
-        return super.visitMember(member, p);
     }
+    return undefined;
+}
 
-    private updateVersion(member: Json.Member): Json.Member {
-        const value = member.value;
-
-        if (!isLiteral(value)) {
-            return member; // Not a literal value, can't update
-        }
-
-        // Preserve the original version prefix (^, ~, etc.)
-        const originalVersion = String(value.value);
-        const newVersionWithPrefix = applyVersionPrefix(originalVersion, this.newVersion);
-
-        // Create new literal with updated version
-        const newLiteral: Json.Literal = {
-            ...value,
-            source: `"${newVersionWithPrefix}"`,
-            value: newVersionWithPrefix
-        };
-
-        return {
-            ...member,
-            value: newLiteral
-        };
+/**
+ * Extracts the overrides section from a package.json based on the package manager.
+ * Returns the overrides object or undefined if not present.
+ */
+function getOverridesFromPackageJson(
+    packageJson: Record<string, any>,
+    packageManager: PackageManager
+): Record<string, string> | undefined {
+    switch (packageManager) {
+        case PackageManager.Npm:
+        case PackageManager.Bun:
+            return packageJson.overrides;
+        case PackageManager.Pnpm:
+            return packageJson.pnpm?.overrides;
+        case PackageManager.YarnClassic:
+        case PackageManager.YarnBerry:
+            return packageJson.resolutions;
+        default:
+            return undefined;
     }
 }
+