@openrewrite/recipes-nodejs 0.37.0-20260104-170507 → 0.37.0-20260106-082310

package/dist/security/dependency-vulnerability-check.js

@@ -59,6 +59,7 @@ const javascript_1 = require("@openrewrite/rewrite/javascript");
 const semver = __importStar(require("semver"));
 const path = __importStar(require("path"));
 const vulnerability_1 = require("./vulnerability");
+const npm_utils_1 = require("./npm-utils");
 const ALL_DEPENDENCY_SCOPES = [
     'dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'
 ];
@@ -159,7 +160,7 @@ __decorate([
 ], VulnerabilityReportRow.prototype, "dependencyPath", void 0);
 class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     constructor(options) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d, _e;
         super(options);
         this.name = "org.openrewrite.node.dependency-vulnerability-check";
         this.displayName = "Find and fix vulnerable npm dependencies";
@@ -169,9 +170,11 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             "If a minor or major upgrade is required to reach the fixed version, this can be controlled using the `maximumUpgradeDelta` option. " +
             "Vulnerability information comes from the GitHub Security Advisory Database.";
         this.vulnerabilityReport = new rewrite_1.DataTable("org.openrewrite.nodejs.table.VulnerabilityReport", "Vulnerability Report", "Lists all vulnerabilities found in project dependencies.", VulnerabilityReportRow);
-        (_a = this.maximumUpgradeDelta) !== null && _a !== void 0 ? _a : (this.maximumUpgradeDelta = 'patch');
-        (_b = this.minimumSeverity) !== null && _b !== void 0 ? _b : (this.minimumSeverity = vulnerability_1.Severity.LOW);
-        (_c = this.fixDeclaredVersions) !== null && _c !== void 0 ? _c : (this.fixDeclaredVersions = false);
+        (_a = this.transitiveFixStrategy) !== null && _a !== void 0 ? _a : (this.transitiveFixStrategy = 'report');
+        (_b = this.maximumUpgradeDelta) !== null && _b !== void 0 ? _b : (this.maximumUpgradeDelta = 'patch');
+        (_c = this.minimumSeverity) !== null && _c !== void 0 ? _c : (this.minimumSeverity = vulnerability_1.Severity.LOW);
+        (_d = this.fixDeclaredVersions) !== null && _d !== void 0 ? _d : (this.fixDeclaredVersions = false);
+        (_e = this.addOverrideComments) !== null && _e !== void 0 ? _e : (this.addOverrideComments = true);
         if (options === null || options === void 0 ? void 0 : options.minimumSeverity) {
             this.minimumSeverity = (0, vulnerability_1.parseSeverity)(options.minimumSeverity);
         }
@@ -179,10 +182,47 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             try {
                 this.cvePatternRegex = new RegExp(this.cvePattern);
             }
-            catch (_d) {
+            catch (_f) {
             }
         }
     }
+    shouldScanTransitives() {
+        return this.transitiveFixStrategy !== 'report';
+    }
+    shouldFixTransitives() {
+        return this.transitiveFixStrategy !== 'report';
+    }
+    shouldVerifyTransitiveFixes() {
+        return this.transitiveFixStrategy === 'override' ||
+            this.transitiveFixStrategy === 'prefer-direct-upgrade';
+    }
+    filterRemainingTransitiveFixes(fixes, lockFileContent, packageManager, db) {
+        const result = [];
+        for (const fix of fixes) {
+            if (!fix.isTransitive || fix.fixViaDirectUpgrade) {
+                result.push(fix);
+                continue;
+            }
+            const resolvedVersion = (0, npm_utils_1.extractVersionFromLockFile)(lockFileContent, fix.packageName, packageManager);
+            if (!resolvedVersion) {
+                continue;
+            }
+            const isStillVulnerable = this.isVersionStillVulnerable(fix.packageName, resolvedVersion, fix.cves, db);
+            if (isStillVulnerable) {
+                result.push(fix);
+            }
+        }
+        return result;
+    }
+    isVersionStillVulnerable(packageName, version, cves, db) {
+        const vulns = db.getVulnerabilities(packageName);
+        for (const vuln of vulns) {
+            if (cves.includes(vuln.cve) && this.isVersionAffected(version, vuln)) {
+                return true;
+            }
+        }
+        return false;
+    }
     initialValue(_ctx) {
         return Object.assign(Object.assign({}, (0, javascript_1.createDependencyRecipeAccumulator)()), { db: vulnerability_1.VulnerabilityDatabase.load(), vulnerableByProject: new Map(), fixesByProject: new Map(), originalLockFiles: new Map(), allPackageJsonContents: new Map(), workspaceRoots: new Map(), modifiedWorkspaceMemberContents: new Map(), workspaceDetectionComplete: false });
     }
@@ -324,7 +364,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                 });
             }
         }
-        if (this.overrideTransitive) {
+        if (this.shouldScanTransitives()) {
             const transitives = [
                 ...(resolved.dependencies || []),
                 ...(resolved.devDependencies || []),
@@ -352,6 +392,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     continue;
                 const vulns = db.getVulnerabilities(dep.name);
                 const affectedCves = [];
+                const affectedCveSummaries = new Map();
                 let highestFixVersion;
                 for (const vuln of vulns) {
                     if ((0, vulnerability_1.severityOrdinal)(vuln.severity) < (0, vulnerability_1.severityOrdinal)(this.minimumSeverity)) {
@@ -363,6 +404,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     if (this.isVersionAffected(declaredMinVersion, vuln) &&
                         !this.isVersionAffected(dep.resolved.version, vuln)) {
                         affectedCves.push(vuln.cve);
+                        affectedCveSummaries.set(vuln.cve, vuln.summary);
                         const fixVersion = vuln.fixedVersion;
                         if (fixVersion && (!highestFixVersion || semver.gt(fixVersion, highestFixVersion))) {
                             highestFixVersion = fixVersion;
@@ -378,6 +420,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                             scope,
                             isTransitive: false,
                             cves: affectedCves,
+                            cveSummaries: affectedCveSummaries,
                             originalMajorVersion: majorVersion
                         });
                     }
@@ -454,76 +497,145 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             return false;
         }
     }
-    computeFixes(vulnerabilities, db) {
-        var _a, _b, _c, _d, _e, _f, _g;
-        if (this.isReportOnly()) {
-            return [];
-        }
-        const byPackageAndMajor = new Map();
-        for (const vuln of vulnerabilities) {
-            const parsed = semver.parse(vuln.resolved.version);
-            const major = (_a = parsed === null || parsed === void 0 ? void 0 : parsed.major) !== null && _a !== void 0 ? _a : 0;
-            const key = `${vuln.resolved.name}@${major}`;
-            const existing = byPackageAndMajor.get(key) || [];
-            existing.push(vuln);
-            byPackageAndMajor.set(key, existing);
-        }
-        const majorVersionsByPackage = new Map();
-        for (const vuln of vulnerabilities) {
-            const parsed = semver.parse(vuln.resolved.version);
-            const major = (_b = parsed === null || parsed === void 0 ? void 0 : parsed.major) !== null && _b !== void 0 ? _b : 0;
-            const existing = majorVersionsByPackage.get(vuln.resolved.name) || new Set();
-            existing.add(major);
-            majorVersionsByPackage.set(vuln.resolved.name, existing);
-        }
-        const fixes = [];
-        for (const [key, vulns] of byPackageAndMajor) {
-            const packageName = vulns[0].resolved.name;
-            const originalMajor = (_d = (_c = semver.parse(vulns[0].resolved.version)) === null || _c === void 0 ? void 0 : _c.major) !== null && _d !== void 0 ? _d : 0;
-            const hasMultipleMajorVersions = ((_f = (_e = majorVersionsByPackage.get(packageName)) === null || _e === void 0 ? void 0 : _e.size) !== null && _f !== void 0 ? _f : 0) > 1;
-            let highestFixVersion;
-            const cves = [];
-            let isTransitive = true;
-            let scope;
-            let originalVersion;
-            for (const vuln of vulns) {
-                if (!originalVersion) {
-                    originalVersion = vuln.resolved.version;
-                }
-                if (!this.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability)) {
-                    continue;
-                }
-                const fixVersion = this.getUpgradeVersion(vuln.vulnerability);
-                if (fixVersion) {
-                    const fixMajor = (_g = semver.parse(fixVersion)) === null || _g === void 0 ? void 0 : _g.major;
-                    const shouldConsiderFix = hasMultipleMajorVersions
-                        ? fixMajor === originalMajor
-                        : true;
-                    if (shouldConsiderFix) {
-                        if (!highestFixVersion || semver.gt(fixVersion, highestFixVersion)) {
-                            highestFixVersion = fixVersion;
+    computeFixes(vulnerabilities, db, projectContext) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f, _g;
+            if (this.isReportOnly()) {
+                return [];
+            }
+            const byPackageAndMajor = new Map();
+            for (const vuln of vulnerabilities) {
+                const parsed = semver.parse(vuln.resolved.version);
+                const major = (_a = parsed === null || parsed === void 0 ? void 0 : parsed.major) !== null && _a !== void 0 ? _a : 0;
+                const key = `${vuln.resolved.name}@${major}`;
+                const existing = byPackageAndMajor.get(key) || [];
+                existing.push(vuln);
+                byPackageAndMajor.set(key, existing);
+            }
+            const majorVersionsByPackage = new Map();
+            for (const vuln of vulnerabilities) {
+                const parsed = semver.parse(vuln.resolved.version);
+                const major = (_b = parsed === null || parsed === void 0 ? void 0 : parsed.major) !== null && _b !== void 0 ? _b : 0;
+                const existing = majorVersionsByPackage.get(vuln.resolved.name) || new Set();
+                existing.add(major);
+                majorVersionsByPackage.set(vuln.resolved.name, existing);
+            }
+            const fixes = [];
+            for (const [key, vulns] of byPackageAndMajor) {
+                const packageName = vulns[0].resolved.name;
+                const originalMajor = (_d = (_c = semver.parse(vulns[0].resolved.version)) === null || _c === void 0 ? void 0 : _c.major) !== null && _d !== void 0 ? _d : 0;
+                const hasMultipleMajorVersions = ((_f = (_e = majorVersionsByPackage.get(packageName)) === null || _e === void 0 ? void 0 : _e.size) !== null && _f !== void 0 ? _f : 0) > 1;
+                let highestFixVersion;
+                const cves = [];
+                const cveSummaries = new Map();
+                let isTransitive = true;
+                let scope;
+                let originalVersion;
+                let directDepInfo;
+                for (const vuln of vulns) {
+                    if (!originalVersion) {
+                        originalVersion = vuln.resolved.version;
+                    }
+                    if (!vuln.isDirect && vuln.path.length > 0 && !directDepInfo) {
+                        const directDep = vuln.path[0];
+                        directDepInfo = {
+                            name: directDep.name,
+                            version: directDep.version,
+                            scope: vuln.scope || 'dependencies'
+                        };
+                    }
+                    if (!this.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability)) {
+                        continue;
+                    }
+                    const fixVersion = this.getUpgradeVersion(vuln.vulnerability);
+                    if (fixVersion) {
+                        const fixMajor = (_g = semver.parse(fixVersion)) === null || _g === void 0 ? void 0 : _g.major;
+                        const shouldConsiderFix = hasMultipleMajorVersions
+                            ? fixMajor === originalMajor
+                            : true;
+                        if (shouldConsiderFix) {
+                            if (!highestFixVersion || semver.gt(fixVersion, highestFixVersion)) {
+                                highestFixVersion = fixVersion;
+                            }
                         }
                     }
+                    cves.push(vuln.vulnerability.cve);
+                    cveSummaries.set(vuln.vulnerability.cve, vuln.vulnerability.summary);
+                    if (vuln.isDirect) {
+                        isTransitive = false;
+                        scope = vuln.scope;
+                    }
                 }
-                cves.push(vuln.vulnerability.cve);
-                if (vuln.isDirect) {
-                    isTransitive = false;
-                    scope = vuln.scope;
+                if (highestFixVersion && cves.length > 0 && originalVersion) {
+                    const safeVersion = this.findHighestSafeVersion(packageName, originalVersion, highestFixVersion, db);
+                    const fix = {
+                        packageName,
+                        newVersion: safeVersion || highestFixVersion,
+                        isTransitive,
+                        cves,
+                        cveSummaries,
+                        scope,
+                        originalMajorVersion: originalMajor,
+                        directDepInfo: isTransitive && directDepInfo ? {
+                            name: directDepInfo.name,
+                            version: directDepInfo.version,
+                            scope: directDepInfo.scope
+                        } : undefined
+                    };
+                    fixes.push(fix);
                 }
             }
-            if (highestFixVersion && cves.length > 0 && originalVersion) {
-                const safeVersion = this.findHighestSafeVersion(packageName, originalVersion, highestFixVersion, db);
-                fixes.push({
-                    packageName,
-                    newVersion: safeVersion || highestFixVersion,
-                    isTransitive,
-                    cves,
-                    scope,
-                    originalMajorVersion: originalMajor
-                });
+            return fixes;
+        });
+    }
+    tryFindDirectDepUpgrade(transitivePackageName, requiredFixVersion, directDepInfo, projectContext, db) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const isVulnerable = (version) => {
+                try {
+                    return semver.lt(version, requiredFixVersion);
+                }
+                catch (_a) {
+                    return true;
+                }
+            };
+            const isWithinDelta = (from, to) => {
+                return this.isVersionWithinDelta(from, to);
+            };
+            try {
+                const upgradeVersion = yield (0, npm_utils_1.findDirectUpgradeThatFixesTransitive)(projectContext.packageManager, directDepInfo.name, directDepInfo.version, transitivePackageName, isVulnerable, isWithinDelta, projectContext.originalPackageJson, directDepInfo.scope, projectContext.configFiles);
+                return upgradeVersion;
             }
-        }
-        return fixes;
+            catch (_a) {
+                return undefined;
+            }
+        });
+    }
+    tryDirectUpgradesForTransitives(fixes, updateInfo, db) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = [];
+            for (const fix of fixes) {
+                if (!fix.directDepInfo) {
+                    result.push(fix);
+                    continue;
+                }
+                const directUpgradeVersion = yield this.tryFindDirectDepUpgrade(fix.packageName, fix.newVersion, fix.directDepInfo, {
+                    packageManager: updateInfo.packageManager,
+                    originalPackageJson: updateInfo.originalPackageJson,
+                    configFiles: updateInfo.configFiles
+                }, db);
+                if (directUpgradeVersion) {
+                    result.push(Object.assign(Object.assign({}, fix), { fixViaDirectUpgrade: {
+                            directDepName: fix.directDepInfo.name,
+                            directDepVersion: directUpgradeVersion,
+                            directDepScope: fix.directDepInfo.scope
+                        } }));
+                }
+                else {
+                    result.push(fix);
+                }
+            }
+            return result;
+        });
     }
     scanner(acc) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -597,7 +709,12 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         let fixes = [];
                         if (vulnerabilities.length > 0) {
                             acc.vulnerableByProject.set(doc.sourcePath, vulnerabilities);
-                            fixes = recipe.computeFixes(vulnerabilities, acc.db);
+                            const originalPackageJson = storedContent || (yield rewrite_1.TreePrinters.print(doc));
+                            fixes = yield recipe.computeFixes(vulnerabilities, acc.db, {
+                                packageManager: pm,
+                                originalPackageJson,
+                                configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined
+                            });
                         }
                         if (recipe.fixDeclaredVersions) {
                             const preventiveFixes = recipe.findPreventiveFixes(marker, scopesToCheck, acc.db);
@@ -894,6 +1011,37 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     }
     runPackageManagerInstall(acc, updateInfo, fixes) {
         return __awaiter(this, void 0, void 0, function* () {
+            const directFixes = fixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
+            const transitiveFixes = fixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
+            if (this.shouldVerifyTransitiveFixes() && transitiveFixes.length > 0) {
+                const phase1PackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, directFixes, updateInfo.packageManager);
+                const phase1Result = yield (0, javascript_1.runInstallInTempDir)(updateInfo.packageManager, phase1PackageJson, {
+                    configFiles: updateInfo.configFiles
+                });
+                if (!phase1Result.success || !phase1Result.lockFileContent) {
+                    const modifiedPackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, fixes, updateInfo.packageManager);
+                    const result = yield (0, javascript_1.runInstallInTempDir)(updateInfo.packageManager, modifiedPackageJson, {
+                        configFiles: updateInfo.configFiles
+                    });
+                    (0, javascript_1.storeInstallResult)(result, acc, updateInfo, modifiedPackageJson);
+                    return;
+                }
+                let remainingTransitiveFixes = this.filterRemainingTransitiveFixes(transitiveFixes, phase1Result.lockFileContent, updateInfo.packageManager, acc.db);
+                if (remainingTransitiveFixes.length === 0) {
+                    (0, javascript_1.storeInstallResult)(phase1Result, acc, updateInfo, phase1PackageJson);
+                    return;
+                }
+                if (this.transitiveFixStrategy === 'prefer-direct-upgrade') {
+                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, updateInfo, acc.db);
+                }
+                const finalFixes = [...directFixes, ...remainingTransitiveFixes];
+                const finalPackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, finalFixes, updateInfo.packageManager);
+                const finalResult = yield (0, javascript_1.runInstallInTempDir)(updateInfo.packageManager, finalPackageJson, {
+                    configFiles: updateInfo.configFiles
+                });
+                (0, javascript_1.storeInstallResult)(finalResult, acc, updateInfo, finalPackageJson);
+                return;
+            }
             const modifiedPackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, fixes, updateInfo.packageManager);
             const result = yield (0, javascript_1.runInstallInTempDir)(updateInfo.packageManager, modifiedPackageJson, {
                 configFiles: updateInfo.configFiles
@@ -905,23 +1053,24 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         return __awaiter(this, void 0, void 0, function* () {
             const memberPaths = acc.workspaceRoots.get(rootPath) || [];
             const pm = rootUpdateInfo.packageManager;
+            const allDirectFixes = [];
             const allTransitiveFixes = [];
             const rootFixes = acc.fixesByProject.get(rootPath) || [];
-            const rootDirectFixes = rootFixes.filter(f => !f.isTransitive);
-            const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive);
+            const rootDirectFixes = rootFixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
+            const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
+            allDirectFixes.push(...rootDirectFixes);
             allTransitiveFixes.push(...rootTransitiveFixes);
             const memberDirectFixes = new Map();
             for (const memberPath of memberPaths) {
                 const memberFixes = acc.fixesByProject.get(memberPath) || [];
-                const directFixes = memberFixes.filter(f => !f.isTransitive);
-                const transitiveFixes = memberFixes.filter(f => f.isTransitive);
+                const directFixes = memberFixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
+                const transitiveFixes = memberFixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
                 if (directFixes.length > 0) {
                     memberDirectFixes.set(memberPath, directFixes);
+                    allDirectFixes.push(...directFixes);
                 }
                 allTransitiveFixes.push(...transitiveFixes);
             }
-            const rootOriginalContent = acc.allPackageJsonContents.get(rootPath) || rootUpdateInfo.originalPackageJson;
-            const modifiedRootPackageJson = this.createModifiedPackageJson(rootOriginalContent, [...rootDirectFixes, ...allTransitiveFixes], pm);
             const workspacePackages = {};
             for (const memberPath of memberPaths) {
                 const originalContent = acc.allPackageJsonContents.get(memberPath);
@@ -939,6 +1088,39 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                 }
                 workspacePackages[memberPath] = modifiedContent;
             }
+            const rootOriginalContent = acc.allPackageJsonContents.get(rootPath) || rootUpdateInfo.originalPackageJson;
+            if (this.shouldVerifyTransitiveFixes() && allTransitiveFixes.length > 0) {
+                const phase1RootPackageJson = this.createModifiedPackageJson(rootOriginalContent, rootDirectFixes, pm);
+                const phase1Result = yield (0, javascript_1.runWorkspaceInstallInTempDir)(pm, phase1RootPackageJson, {
+                    configFiles: rootUpdateInfo.configFiles,
+                    workspacePackages
+                });
+                if (!phase1Result.success || !phase1Result.lockFileContent) {
+                    const modifiedRootPackageJson = this.createModifiedPackageJson(rootOriginalContent, [...rootDirectFixes, ...allTransitiveFixes], pm);
+                    const result = yield (0, javascript_1.runWorkspaceInstallInTempDir)(pm, modifiedRootPackageJson, {
+                        configFiles: rootUpdateInfo.configFiles,
+                        workspacePackages
+                    });
+                    (0, javascript_1.storeInstallResult)(result, acc, rootUpdateInfo, modifiedRootPackageJson);
+                    return;
+                }
+                let remainingTransitiveFixes = this.filterRemainingTransitiveFixes(allTransitiveFixes, phase1Result.lockFileContent, pm, acc.db);
+                if (remainingTransitiveFixes.length === 0) {
+                    (0, javascript_1.storeInstallResult)(phase1Result, acc, rootUpdateInfo, phase1RootPackageJson);
+                    return;
+                }
+                if (this.transitiveFixStrategy === 'prefer-direct-upgrade') {
+                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, rootUpdateInfo, acc.db);
+                }
+                const finalRootPackageJson = this.createModifiedPackageJson(rootOriginalContent, [...rootDirectFixes, ...remainingTransitiveFixes], pm);
+                const finalResult = yield (0, javascript_1.runWorkspaceInstallInTempDir)(pm, finalRootPackageJson, {
+                    configFiles: rootUpdateInfo.configFiles,
+                    workspacePackages
+                });
+                (0, javascript_1.storeInstallResult)(finalResult, acc, rootUpdateInfo, finalRootPackageJson);
+                return;
+            }
+            const modifiedRootPackageJson = this.createModifiedPackageJson(rootOriginalContent, [...rootDirectFixes, ...allTransitiveFixes], pm);
             const result = yield (0, javascript_1.runWorkspaceInstallInTempDir)(pm, modifiedRootPackageJson, {
                 configFiles: rootUpdateInfo.configFiles,
                 workspacePackages
@@ -959,7 +1141,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         return JSON.stringify(packageJson, null, 2);
     }
     createModifiedPackageJson(originalContent, fixes, packageManager) {
-        var _a, _b, _c;
+        var _a;
         let packageJson = JSON.parse(originalContent);
         const fixesByPackage = new Map();
         for (const fix of fixes) {
@@ -967,6 +1149,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             existing.push(fix);
             fixesByPackage.set(fix.packageName, existing);
         }
+        const overrideComments = new Map();
         for (const fix of fixes) {
             if (!fix.isTransitive && fix.scope) {
                 if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
@@ -975,6 +1158,14 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                 }
             }
             else if (fix.isTransitive) {
+                if (fix.fixViaDirectUpgrade) {
+                    const { directDepName, directDepVersion, directDepScope } = fix.fixViaDirectUpgrade;
+                    if ((_a = packageJson[directDepScope]) === null || _a === void 0 ? void 0 : _a[directDepName]) {
+                        const originalVersion = packageJson[directDepScope][directDepName];
+                        packageJson[directDepScope][directDepName] = applyVersionPrefix(originalVersion, directDepVersion);
+                        continue;
+                    }
+                }
                 const directDepScope = findDirectDependencyScope(packageJson, fix.packageName);
                 if (directDepScope) {
                     const directVersion = packageJson[directDepScope][fix.packageName];
@@ -985,6 +1176,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         if (!isYarn) {
                             const versionSpecificKey = `${fix.packageName}@^${fix.originalMajorVersion}`;
                             packageJson = (0, javascript_1.applyOverrideToPackageJson)(packageJson, packageManager, versionSpecificKey, fix.newVersion);
+                            overrideComments.set(versionSpecificKey, this.generateOverrideComment(fix));
                         }
                         else {
                         }
@@ -1007,26 +1199,63 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                 if (useVersionSpecificOverride) {
                     const versionSpecificKey = `${fix.packageName}@^${fix.originalMajorVersion}`;
                     packageJson = (0, javascript_1.applyOverrideToPackageJson)(packageJson, packageManager, versionSpecificKey, fix.newVersion);
+                    overrideComments.set(versionSpecificKey, this.generateOverrideComment(fix));
                 }
                 else {
                     packageJson = (0, javascript_1.applyOverrideToPackageJson)(packageJson, packageManager, fix.packageName, fix.newVersion);
-                }
-                if (packageManager === "Pnpm") {
-                    if (!packageJson.devDependencies) {
-                        packageJson.devDependencies = {};
-                    }
-                    if (!((_a = packageJson.dependencies) === null || _a === void 0 ? void 0 : _a[fix.packageName]) &&
-                        !packageJson.devDependencies[fix.packageName] &&
-                        !((_b = packageJson.peerDependencies) === null || _b === void 0 ? void 0 : _b[fix.packageName]) &&
-                        !((_c = packageJson.optionalDependencies) === null || _c === void 0 ? void 0 : _c[fix.packageName])) {
-                        const prefix = this.getVersionPrefixForDelta();
-                        packageJson.devDependencies[fix.packageName] = prefix + fix.newVersion;
-                    }
+                    overrideComments.set(fix.packageName, this.generateOverrideComment(fix));
                 }
             }
         }
+        if (this.addOverrideComments && overrideComments.size > 0) {
+            packageJson = this.addOverrideCommentsToPackageJson(packageJson, packageManager, overrideComments);
+        }
         return JSON.stringify(packageJson, null, 2);
     }
+    generateOverrideComment(fix) {
+        if (!fix.cveSummaries || fix.cveSummaries.size === 0) {
+            return fix.cves.join(', ');
+        }
+        const parts = [];
+        for (const cve of fix.cves) {
+            const summary = fix.cveSummaries.get(cve);
+            if (summary) {
+                const truncatedSummary = summary.length > 80
+                    ? summary.substring(0, 77) + '...'
+                    : summary;
+                parts.push(`${cve}: ${truncatedSummary}`);
+            }
+            else {
+                parts.push(cve);
+            }
+        }
+        return parts.join('; ');
+    }
+    addOverrideCommentsToPackageJson(packageJson, packageManager, comments) {
+        let commentFieldName;
+        switch (packageManager) {
+            case "Npm":
+            case "Bun":
+                commentFieldName = '//overrides';
+                break;
+            case "Pnpm":
+                commentFieldName = '//pnpm.overrides';
+                break;
+            case "YarnClassic":
+            case "YarnBerry":
+                commentFieldName = '//resolutions';
+                break;
+            default:
+                return packageJson;
+        }
+        const existingComments = packageJson[commentFieldName] || {};
+        const mergedComments = Object.assign({}, existingComments);
+        for (const [key, comment] of comments) {
+            mergedComments[key] = comment;
+        }
+        packageJson[commentFieldName] = mergedComments;
+        return packageJson;
+    }
 }
 exports.DependencyVulnerabilityCheck = DependencyVulnerabilityCheck;
 __decorate([
@@ -1041,14 +1270,17 @@ __decorate([
 ], DependencyVulnerabilityCheck.prototype, "scope", void 0);
 __decorate([
     (0, rewrite_1.Option)({
-        displayName: "Override transitives",
-        description: "When enabled, transitive dependencies with vulnerabilities will have their versions overridden " +
-            "using npm overrides, yarn resolutions, or pnpm overrides. " +
-            "By default only direct dependencies have their version numbers upgraded.",
+        displayName: "Transitive fix strategy",
+        description: "Strategy for handling transitive dependency vulnerabilities. " +
+            "'report' only reports them without fixing. " +
+            "'override' adds overrides only for transitives not fixed by direct upgrades (runs extra npm install to verify). " +
+            "'prefer-direct-upgrade' tries to find higher direct dependency versions that fix transitives, falls back to overrides (queries npm registry). " +
+            "Default is 'report'.",
         required: false,
-        example: "true"
+        example: "override",
+        valid: ["report", "override", "prefer-direct-upgrade"]
     })
-], DependencyVulnerabilityCheck.prototype, "overrideTransitive", void 0);
+], DependencyVulnerabilityCheck.prototype, "transitiveFixStrategy", void 0);
 __decorate([
     (0, rewrite_1.Option)({
         displayName: "Maximum upgrade delta",
@@ -1096,6 +1328,16 @@ __decorate([
         example: "true"
     })
 ], DependencyVulnerabilityCheck.prototype, "fixDeclaredVersions", void 0);
+__decorate([
+    (0, rewrite_1.Option)({
+        displayName: "Add override comments",
+        description: "When enabled, adds a comment field (e.g., '//overrides') alongside overrides to document which CVEs " +
+            "each override is fixing. This helps with auditing and knowing when overrides can be removed. " +
+            "Default is true.",
+        required: false,
+        example: "true"
+    })
+], DependencyVulnerabilityCheck.prototype, "addOverrideComments", void 0);
 function extractVersionPrefix(versionString) {
     const match = versionString.match(/^([~^]|>=?|<=?|=)?(.*)$/);
     if (match) {