@openrewrite/recipes-nodejs 0.37.0-20260106-082310 → 0.37.0-20260106-104324

package/src/security/dependency-vulnerability-check.ts

@@ -25,6 +25,7 @@ import {
     DependencyScope,
     findNodeResolutionResult,
     getUpdatedLockFileContent,
+    NodeResolutionResult,
     NpmrcScope,
     PackageManager,
     ResolvedDependency,
@@ -38,40 +39,32 @@ import * as semver from "semver";
 import * as path from "path";
 import {parseSeverity, Severity, severityOrdinal, Vulnerability, VulnerabilityDatabase} from "./vulnerability";
 import {
-    findDirectUpgradeThatFixesTransitive,
+    findDirectUpgradeWithSafeTransitiveInIsolation,
+    verifyAllUpgradesFixTransitive,
     extractVersionFromLockFile,
     DependencyScope as NpmUtilsDependencyScope
 } from "./npm-utils";
-
-/**
- * All dependency scopes that can contain dependencies in package.json.
- */
-const ALL_DEPENDENCY_SCOPES: DependencyScope[] = [
-    'dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'
-];
-
-/**
- * Maximum upgrade delta for version upgrades.
- * Use 'none' to only report vulnerabilities without making any changes.
- */
-export type UpgradeDelta = 'none' | 'patch' | 'minor' | 'major';
-
-/**
- * Strategy for handling transitive dependency vulnerabilities.
- *
- * - 'report': Report transitive vulnerabilities but don't fix them. (Default)
- * - 'override': Add overrides/resolutions for transitives that aren't fixed
- *               by direct dependency upgrades. Runs an extra npm install
- *               to check which transitives are still vulnerable after
- *               applying direct fixes, then adds overrides only for those.
- * - 'prefer-direct-upgrade': First applies minimum direct dependency upgrades,
- *                            then for any remaining transitive vulnerabilities,
- *                            tries to find a higher direct dependency version
- *                            that fixes them. Falls back to overrides if no
- *                            suitable direct upgrade exists. Queries npm registry.
- *                            Most thorough, slowest.
- */
-export type TransitiveFixStrategy = 'report' | 'override' | 'prefer-direct-upgrade';
+import {
+    UpgradeDelta,
+    extractMinimumVersion,
+    isVersionWithinDelta,
+    isVersionAffected,
+    isUpgradeableWithinDelta,
+    getUpgradeVersion,
+    applyVersionPrefix
+} from "./version-utils";
+import {
+    ALL_DEPENDENCY_SCOPES,
+    TransitiveFixStrategy,
+    PathSegment,
+    VulnerableDependency,
+    VulnerabilityFix,
+    ProjectUpdateInfo
+} from "./types";
+import {
+    findDirectDependencyScope,
+    getOverridesFromPackageJson
+} from "./override-utils";
 
 /**
  * Row for the vulnerability report data table.
@@ -186,89 +179,6 @@ class VulnerabilityReportRow {
     }
 }
 
-/**
- * Represents a segment in the dependency path.
- */
-interface PathSegment {
-    name: string;
-    version: string;
-}
-
-/**
- * Represents a vulnerable dependency found during scanning.
- */
-interface VulnerableDependency {
-    /** The resolved dependency that is vulnerable */
-    resolved: ResolvedDependency;
-    /** The vulnerability affecting it */
-    vulnerability: Vulnerability;
-    /** Depth in dependency tree (0 = direct) */
-    depth: number;
-    /** Whether this is a direct dependency */
-    isDirect: boolean;
-    /** The scope where this dependency was found (for direct deps) */
-    scope?: DependencyScope;
-    /** Path from root to this dependency */
-    path: PathSegment[];
-}
-
-/**
- * Represents a fix to apply for a vulnerability.
- */
-interface VulnerabilityFix {
-    /** Package name to upgrade (the vulnerable package) */
-    packageName: string;
-    /** Version to upgrade to */
-    newVersion: string;
-    /** Whether the vulnerable package is a transitive dependency */
-    isTransitive: boolean;
-    /** CVEs this fix resolves */
-    cves: string[];
-    /** CVE summaries for generating comments (CVE ID -> summary) */
-    cveSummaries: Map<string, string>;
-    /** The scope where this dependency was found (for direct deps) */
-    scope?: DependencyScope;
-    /** The original major version (for version-specific overrides) */
-    originalMajorVersion?: number;
-    /**
-     * For transitive vulnerabilities, info about the direct dependency that brings
-     * this transitive in. Used by prefer-direct-upgrade to find higher versions
-     * of the direct dependency that might fix the transitive.
-     */
-    directDepInfo?: {
-        name: string;
-        version: string;
-        scope: DependencyScope;
-    };
-    /**
-     * If set, fix this transitive vulnerability by upgrading a direct dependency
-     * instead of using overrides. This is preferred when a newer version of a
-     * direct dependency includes a fixed version of the vulnerable transitive.
-     */
-    fixViaDirectUpgrade?: {
-        /** Name of the direct dependency to upgrade */
-        directDepName: string;
-        /** Version to upgrade the direct dependency to */
-        directDepVersion: string;
-        /** Scope of the direct dependency */
-        directDepScope: DependencyScope;
-    };
-}
-
-/**
- * Project info for lock file updates.
- */
-interface ProjectUpdateInfo {
-    /** Relative path to package.json (from source root) */
-    packageJsonPath: string;
-    /** Original package.json content */
-    originalPackageJson: string;
-    /** The package manager used by this project */
-    packageManager: PackageManager;
-    /** Config file contents extracted from the project (e.g., .npmrc) */
-    configFiles?: Record<string, string>;
-}
-
 /**
  * Accumulator for the scanning recipe.
  */
@@ -439,13 +349,6 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         return this.transitiveFixStrategy !== 'report';
     }
 
-    /**
-     * Returns true if transitive vulnerabilities should be fixed with overrides.
-     */
-    private shouldFixTransitives(): boolean {
-        return this.transitiveFixStrategy !== 'report';
-    }
-
     /**
      * Returns true if we should verify that transitive fixes are still needed
      * after applying direct fixes (for override and prefer-direct-upgrade strategies).
@@ -474,7 +377,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
 
         for (const fix of fixes) {
             // Always keep direct fixes and fixes via direct upgrade
-            if (!fix.isTransitive || fix.fixViaDirectUpgrade) {
+            if (!fix.isTransitive || (fix.fixViaDirectUpgrades && fix.fixViaDirectUpgrades.length > 0)) {
                 result.push(fix);
                 continue;
             }
@@ -521,7 +424,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
     ): boolean {
         const vulns = db.getVulnerabilities(packageName);
         for (const vuln of vulns) {
-            if (cves.includes(vuln.cve) && this.isVersionAffected(version, vuln)) {
+            if (cves.includes(vuln.cve) && isVersionAffected(version, vuln)) {
                 return true;
             }
         }
@@ -559,147 +462,73 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
     }
 
     /**
-     * Checks if a version is affected by a vulnerability.
+     * Renders a dependency path as a string.
+     * Example: "dependencies > lodash@4.17.20 > vulnerable-pkg@1.0.0"
      */
-    private isVersionAffected(version: string, vulnerability: Vulnerability): boolean {
-        try {
-            const v = semver.parse(version);
-            if (!v) return false;
-
-            // Check introduced version
-            if (vulnerability.introducedVersion && vulnerability.introducedVersion !== '0') {
-                const introduced = semver.parse(vulnerability.introducedVersion);
-                if (introduced && semver.lt(v, introduced)) {
-                    return false; // Version is before the vulnerability was introduced
-                }
-            }
-
-            // Check if fixed
-            if (vulnerability.fixedVersion) {
-                const fixed = semver.parse(vulnerability.fixedVersion);
-                if (fixed && semver.gte(v, fixed)) {
-                    return false; // Version is at or after the fix
-                }
-                return true; // Version is in the vulnerable range
-            }
-
-            // Check last affected version
-            if (vulnerability.lastAffectedVersion) {
-                const lastAffected = semver.parse(vulnerability.lastAffectedVersion);
-                if (lastAffected && semver.gt(v, lastAffected)) {
-                    return false; // Version is after the last affected
-                }
-                return true;
-            }
-
-            return true; // No fix information, assume vulnerable
-        } catch {
-            return false; // Invalid version, skip
+    private renderPath(scope: DependencyScope | undefined, path: PathSegment[]): string {
+        const parts: string[] = [];
+        if (scope) {
+            parts.push(scope);
         }
+        for (const seg of path) {
+            parts.push(`${seg.name}@${seg.version}`);
+        }
+        return parts.join(' > ');
     }
 
     /**
-     * Checks if a vulnerability can be fixed within the maximum upgrade delta.
+     * Finds all direct dependencies that have a given transitive package in their dependency tree.
+     * This is needed because the visited set in findVulnerabilities prevents recording multiple
+     * paths to the same vulnerable package.
      */
-    private isUpgradeableWithinDelta(currentVersion: string, vulnerability: Vulnerability): boolean {
-        if (this.isReportOnly()) {
-            return false;
-        }
-
-        try {
-            const current = semver.parse(currentVersion);
-            if (!current) return false;
-
-            const delta = this.maximumUpgradeDelta!;
-
-            // If we have a fixed version, check if it's reachable within delta
-            if (vulnerability.fixedVersion) {
-                const fixed = semver.parse(vulnerability.fixedVersion);
-                if (!fixed) return false;
-
-                switch (delta) {
-                    case 'patch':
-                        return current.major === fixed.major && current.minor === fixed.minor;
-                    case 'minor':
-                        return current.major === fixed.major;
-                    case 'major':
-                        return true;
-                    case 'none':
-                        return false;
-                }
-            }
+    private findAllDirectDepsForTransitive(
+        marker: NodeResolutionResult,
+        transitivePackageName: string,
+        scopesToCheck: DependencyScope[]
+    ): { name: string; version: string; scope: DependencyScope }[] {
+        const results: { name: string; version: string; scope: DependencyScope }[] = [];
 
-            // If we only have lastAffectedVersion, check if upgrading within delta
-            // could get us past it (i.e., to a non-vulnerable version)
-            if (vulnerability.lastAffectedVersion) {
-                const lastAffected = semver.parse(vulnerability.lastAffectedVersion);
-                if (!lastAffected) return false;
-
-                switch (delta) {
-                    case 'patch':
-                        return current.major === lastAffected.major &&
-                            current.minor === lastAffected.minor;
-                    case 'minor':
-                        return current.major === lastAffected.major;
-                    case 'major':
-                        return true;
-                    case 'none':
-                        return false;
+        for (const scope of scopesToCheck) {
+            const deps = marker[scope] || [];
+            for (const dep of deps) {
+                if (dep.resolved && this.hasTransitiveInTree(dep.resolved, transitivePackageName, new Set())) {
+                    results.push({
+                        name: dep.resolved.name,
+                        version: dep.resolved.version,
+                        scope
+                    });
                 }
             }
-
-            return false;
-        } catch {
-            return false;
         }
-    }
 
-    /**
-     * Gets the version to upgrade to for a vulnerability.
-     */
-    private getUpgradeVersion(vulnerability: Vulnerability): string | undefined {
-        if (vulnerability.fixedVersion) {
-            return vulnerability.fixedVersion;
-        }
-        // For lastAffectedVersion, we need the next version after it
-        // We can't determine this exactly, so return undefined and let the
-        // upgrade recipe handle version selection
-        return undefined;
+        return results;
     }
 
     /**
-     * Gets the version prefix to use based on the maximum upgrade delta.
-     * This allows future patches that might fix additional vulnerabilities.
-     *
-     * - 'patch' → '~' (allows patch updates, e.g., ~1.2.3 matches 1.2.x)
-     * - 'minor' → '^' (allows minor and patch updates, e.g., ^1.2.3 matches 1.x.x)
-     * - 'major' → '^' (same as minor; ^ is reasonable even for major upgrades)
+     * Checks if a resolved dependency has a specific transitive in its dependency tree.
      */
-    private getVersionPrefixForDelta(): string {
-        switch (this.maximumUpgradeDelta) {
-            case 'patch':
-                return '~';
-            case 'minor':
-            case 'major':
-                return '^';
-            default:
-                return '';
-        }
-    }
+    private hasTransitiveInTree(
+        resolved: ResolvedDependency,
+        targetPackageName: string,
+        visited: Set<string>
+    ): boolean {
+        const key = `${resolved.name}@${resolved.version}`;
+        if (visited.has(key)) return false;
+        visited.add(key);
 
-    /**
-     * Renders a dependency path as a string.
-     * Example: "dependencies > lodash@4.17.20 > vulnerable-pkg@1.0.0"
-     */
-    private renderPath(scope: DependencyScope | undefined, path: PathSegment[]): string {
-        const parts: string[] = [];
-        if (scope) {
-            parts.push(scope);
-        }
-        for (const seg of path) {
-            parts.push(`${seg.name}@${seg.version}`);
+        // Check direct children
+        if (resolved.dependencies) {
+            for (const child of resolved.dependencies) {
+                if (child.name === targetPackageName) {
+                    return true;
+                }
+                if (child.resolved && this.hasTransitiveInTree(child.resolved, targetPackageName, visited)) {
+                    return true;
+                }
+            }
         }
-        return parts.join(' > ');
+
+        return false;
     }
 
     /**
@@ -736,7 +565,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
             }
 
             // Check if this version is affected
-            if (this.isVersionAffected(resolved.version, vuln)) {
+            if (isVersionAffected(resolved.version, vuln)) {
                 results.push({
                     resolved,
                     vulnerability: vuln,
@@ -793,7 +622,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                 if (!dep.resolved) continue;
 
                 // Extract the minimum version from the version constraint
-                const declaredMinVersion = this.extractMinimumVersion(dep.versionConstraint);
+                const declaredMinVersion = extractMinimumVersion(dep.versionConstraint);
                 if (!declaredMinVersion) continue;
 
                 // Skip if declared version equals resolved version (no discrepancy)
@@ -817,8 +646,8 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     }
 
                     // Check if declared version is affected but resolved is not
-                    if (this.isVersionAffected(declaredMinVersion, vuln) &&
-                        !this.isVersionAffected(dep.resolved.version, vuln)) {
+                    if (isVersionAffected(declaredMinVersion, vuln) &&
+                        !isVersionAffected(dep.resolved.version, vuln)) {
                         affectedCves.push(vuln.cve);
                         affectedCveSummaries.set(vuln.cve, vuln.summary);
 
@@ -863,30 +692,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         if (this.isReportOnly()) {
             return false;
         }
-        return this.isVersionWithinDelta(fromVersion, toVersion);
-    }
-
-    /**
-     * Extracts the minimum version from a version constraint.
-     * For example: "^3.0.2" -> "3.0.2", "~1.2.3" -> "1.2.3", ">=2.0.0" -> "2.0.0"
-     */
-    private extractMinimumVersion(constraint: string): string | undefined {
-        if (!constraint) return undefined;
-
-        // Handle exact versions
-        if (semver.valid(constraint)) {
-            return constraint;
-        }
-
-        // Handle ranges with prefix: ^, ~, >=, >, etc.
-        const match = constraint.match(/^[~^>=<]*\s*(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/);
-        if (match && semver.valid(match[1])) {
-            return match[1];
-        }
-
-        // Try to coerce other formats
-        const coerced = semver.coerce(constraint);
-        return coerced?.version;
+        return isVersionWithinDelta(fromVersion, toVersion, this.maximumUpgradeDelta!);
     }
 
     /**
@@ -915,7 +721,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
 
         // Check if the fix version itself has vulnerabilities
         const vulnsInFixVersion = db.getVulnerabilities(packageName)
-            .filter(v => this.isVersionAffected(initialFixVersion, v));
+            .filter(v => isVersionAffected(initialFixVersion, v));
 
         if (vulnsInFixVersion.length === 0) {
             // No vulnerabilities in this version - it's safe
@@ -925,10 +731,10 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         // Find fix versions for vulnerabilities in the current fix version
         let highestFixVersion = initialFixVersion;
         for (const vuln of vulnsInFixVersion) {
-            const fixVersion = this.getUpgradeVersion(vuln);
+            const fixVersion = getUpgradeVersion(vuln);
             if (fixVersion && semver.valid(fixVersion)) {
                 // Check if this fix version is within delta from the ORIGINAL version
-                if (this.isVersionWithinDelta(originalVersion, fixVersion)) {
+                if (isVersionWithinDelta(originalVersion, fixVersion, this.maximumUpgradeDelta!)) {
                     if (semver.gt(fixVersion, highestFixVersion)) {
                         highestFixVersion = fixVersion;
                     }
@@ -951,32 +757,6 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         return initialFixVersion;
     }
 
-    /**
-     * Checks if a target version is within the allowed upgrade delta from the original version.
-     */
-    private isVersionWithinDelta(originalVersion: string, targetVersion: string): boolean {
-        try {
-            const original = semver.parse(originalVersion);
-            const target = semver.parse(targetVersion);
-            if (!original || !target) return false;
-
-            switch (this.maximumUpgradeDelta) {
-                case 'patch':
-                    return original.major === target.major && original.minor === target.minor;
-                case 'minor':
-                    return original.major === target.major;
-                case 'major':
-                    return true;
-                case 'none':
-                    return false;
-                default:
-                    return false;
-            }
-        } catch {
-            return false;
-        }
-    }
-
     /**
      * Computes the fixes to apply for the vulnerabilities found.
      * Groups vulnerabilities by package AND major version to handle packages with multiple
@@ -998,6 +778,8 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
             packageManager: PackageManager;
             originalPackageJson: string;
             configFiles?: Record<string, string>;
+            marker?: NodeResolutionResult;
+            scopesToCheck?: DependencyScope[];
         }
     ): Promise<VulnerabilityFix[]> {
         if (this.isReportOnly()) {
@@ -1041,8 +823,8 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
             let isTransitive = true;
             let scope: DependencyScope | undefined;
             let originalVersion: string | undefined;
-            // Track the direct dependency that brings in this transitive (from the first vuln's path)
-            let directDepInfo: { name: string; version: string; scope: DependencyScope } | undefined;
+            // Track ALL direct dependencies that bring in this transitive
+            const directDepInfosMap = new Map<string, { name: string; version: string; scope: DependencyScope }>();
 
             for (const vuln of vulns) {
                 // Track the original version for delta checking
@@ -1050,22 +832,27 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     originalVersion = vuln.resolved.version;
                 }
 
-                // Track direct dependency info for transitive vulnerabilities
-                if (!vuln.isDirect && vuln.path.length > 0 && !directDepInfo) {
+                // Collect all unique direct dependencies that bring in this transitive
+                if (!vuln.isDirect && vuln.path.length > 0) {
                     const directDep = vuln.path[0];
-                    directDepInfo = {
-                        name: directDep.name,
-                        version: directDep.version,
-                        scope: vuln.scope || 'dependencies'
-                    };
+                    const depScope = vuln.scope || 'dependencies';
+                    // Use name@scope as key to deduplicate (same dep could appear in different scopes)
+                    const key = `${directDep.name}@${depScope}`;
+                    if (!directDepInfosMap.has(key)) {
+                        directDepInfosMap.set(key, {
+                            name: directDep.name,
+                            version: directDep.version,
+                            scope: depScope
+                        });
+                    }
                 }
 
                 // Check if upgradeable within delta
-                if (!this.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability)) {
+                if (this.isReportOnly() || !isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability, this.maximumUpgradeDelta!)) {
                     continue;
                 }
 
-                const fixVersion = this.getUpgradeVersion(vuln.vulnerability);
+                const fixVersion = getUpgradeVersion(vuln.vulnerability);
                 if (fixVersion) {
                     // When there are multiple major versions of the same package in the tree
                     // (e.g., semver@6.x and semver@7.x), only consider fix versions that match
@@ -1092,6 +879,23 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                 }
             }
 
+            // If this is a transitive vulnerability and we have a marker, find ALL direct deps
+            // that have this transitive in their tree. The visited set in findVulnerabilities
+            // prevents recording multiple paths to the same package, so we need this extra step.
+            if (isTransitive && projectContext?.marker && projectContext?.scopesToCheck) {
+                const allDirectDeps = this.findAllDirectDepsForTransitive(
+                    projectContext.marker,
+                    packageName,
+                    projectContext.scopesToCheck
+                );
+                for (const dep of allDirectDeps) {
+                    const key = `${dep.name}@${dep.scope}`;
+                    if (!directDepInfosMap.has(key)) {
+                        directDepInfosMap.set(key, dep);
+                    }
+                }
+            }
+
             if (highestFixVersion && cves.length > 0 && originalVersion) {
                 // Recursively find the highest safe version (checking if fix versions have vulns)
                 const safeVersion = this.findHighestSafeVersion(
@@ -1101,6 +905,9 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     db
                 );
 
+                // Convert directDepInfosMap to array for storage
+                const directDepInfosArray = Array.from(directDepInfosMap.values());
+
                 const fix: VulnerabilityFix = {
                     packageName,
                     newVersion: safeVersion || highestFixVersion,
@@ -1109,12 +916,8 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     cveSummaries,
                     scope,
                     originalMajorVersion: originalMajor,
-                    // Store direct dependency info for potential later use by prefer-direct-upgrade
-                    directDepInfo: isTransitive && directDepInfo ? {
-                        name: directDepInfo.name,
-                        version: directDepInfo.version,
-                        scope: directDepInfo.scope
-                    } : undefined
+                    // Store ALL direct dependencies for potential later use by prefer-direct-upgrade
+                    directDepInfos: isTransitive && directDepInfosArray.length > 0 ? directDepInfosArray : undefined
                 };
 
                 fixes.push(fix);
@@ -1125,103 +928,108 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
     }
 
     /**
-     * Tries to find a direct dependency upgrade that fixes a transitive vulnerability.
-     * Returns the version to upgrade to, or undefined if no suitable upgrade found.
-     */
-    private async tryFindDirectDepUpgrade(
-        transitivePackageName: string,
-        requiredFixVersion: string,
-        directDepInfo: { name: string; version: string; scope: DependencyScope },
-        projectContext: {
-            packageManager: PackageManager;
-            originalPackageJson: string;
-            configFiles?: Record<string, string>;
-        },
-        db: VulnerabilityDatabase
-    ): Promise<string | undefined> {
-        // Create a vulnerability check function for the transitive
-        const isVulnerable = (version: string): boolean => {
-            try {
-                // Version is vulnerable if it's less than the required fix version
-                return semver.lt(version, requiredFixVersion);
-            } catch {
-                return true; // Assume vulnerable if we can't parse
-            }
-        };
-
-        // Create a delta check function based on recipe settings
-        const isWithinDelta = (from: string, to: string): boolean => {
-            return this.isVersionWithinDelta(from, to);
-        };
-
-        try {
-            const upgradeVersion = await findDirectUpgradeThatFixesTransitive(
-                projectContext.packageManager,
-                directDepInfo.name,
-                directDepInfo.version,
-                transitivePackageName,
-                isVulnerable,
-                isWithinDelta,
-                projectContext.originalPackageJson,
-                directDepInfo.scope as NpmUtilsDependencyScope,
-                projectContext.configFiles
-            );
-
-            return upgradeVersion;
-        } catch {
-            return undefined;
-        }
-    }
-
-    /**
-     * For each remaining transitive fix, tries to find a higher direct dependency version
-     * that fixes the transitive vulnerability. Modifies fixes in place by setting
-     * `fixViaDirectUpgrade` when a suitable upgrade is found.
+     * For each remaining transitive fix, tries to find higher versions of ALL direct
+     * dependencies that bring in the transitive. Uses isolation-based testing to find
+     * candidate upgrades for each direct dep independently, then verifies all upgrades
+     * together fix the vulnerability.
      *
      * @param fixes The transitive fixes that are still needed after applying direct fixes
      * @param updateInfo Project update info containing package manager and config
-     * @param db The vulnerability database
-     * @returns The fixes array with `fixViaDirectUpgrade` set where applicable
+     * @returns The fixes array with `fixViaDirectUpgrades` set where applicable
      */
     private async tryDirectUpgradesForTransitives(
         fixes: VulnerabilityFix[],
-        updateInfo: ProjectUpdateInfo,
-        db: VulnerabilityDatabase
+        updateInfo: ProjectUpdateInfo
     ): Promise<VulnerabilityFix[]> {
         const result: VulnerabilityFix[] = [];
 
         for (const fix of fixes) {
             // Skip if no direct dependency info available
-            if (!fix.directDepInfo) {
+            if (!fix.directDepInfos || fix.directDepInfos.length === 0) {
                 result.push(fix);
                 continue;
             }
 
-            // Try to find a direct dependency upgrade that fixes this transitive
-            const directUpgradeVersion = await this.tryFindDirectDepUpgrade(
-                fix.packageName,
-                fix.newVersion,
-                fix.directDepInfo,
-                {
-                    packageManager: updateInfo.packageManager,
-                    originalPackageJson: updateInfo.originalPackageJson,
-                    configFiles: updateInfo.configFiles
-                },
-                db
-            );
+            // Phase 1: Find candidate upgrades for ALL direct dependencies in isolation
+            // Each direct dep is tested independently to find a version that brings in a safe transitive
+            const candidateUpgrades: {
+                directDepName: string;
+                directDepVersion: string;
+                directDepScope: DependencyScope;
+            }[] = [];
+
+            // Create a vulnerability check function for the transitive
+            const isVulnerable = (version: string): boolean => {
+                try {
+                    return semver.lt(version, fix.newVersion);
+                } catch {
+                    return true;
+                }
+            };
 
-            if (directUpgradeVersion) {
-                // Found a direct upgrade that fixes the transitive
-                result.push({
-                    ...fix,
-                    fixViaDirectUpgrade: {
-                        directDepName: fix.directDepInfo.name,
+            // Create a delta check function based on recipe settings
+            const isWithinDelta = (from: string, to: string): boolean => {
+                return isVersionWithinDelta(from, to, this.maximumUpgradeDelta!);
+            };
+
+            for (const directDepInfo of fix.directDepInfos) {
+                const directUpgradeVersion = await findDirectUpgradeWithSafeTransitiveInIsolation(
+                    updateInfo.packageManager,
+                    directDepInfo.name,
+                    directDepInfo.version,
+                    fix.packageName,
+                    isVulnerable,
+                    isWithinDelta,
+                    directDepInfo.scope as NpmUtilsDependencyScope,
+                    updateInfo.configFiles
+                );
+
+                if (directUpgradeVersion) {
+                    candidateUpgrades.push({
+                        directDepName: directDepInfo.name,
                         directDepVersion: directUpgradeVersion,
-                        directDepScope: fix.directDepInfo.scope
+                        directDepScope: directDepInfo.scope
+                    });
+                }
+            }
+
+            // Phase 2: Verify all candidate upgrades together fix the transitive
+            if (candidateUpgrades.length > 0) {
+                // Check if we found upgrades for ALL direct deps
+                const foundAllUpgrades = candidateUpgrades.length === fix.directDepInfos.length;
+
+                if (foundAllUpgrades) {
+                    // Verify all upgrades together fix the vulnerability
+                    const allFixed = await verifyAllUpgradesFixTransitive(
+                        updateInfo.packageManager,
+                        candidateUpgrades.map(u => ({
+                            name: u.directDepName,
+                            version: u.directDepVersion,
+                            scope: u.directDepScope as NpmUtilsDependencyScope
+                        })),
+                        fix.packageName,
+                        isVulnerable,
+                        updateInfo.originalPackageJson,
+                        updateInfo.configFiles
+                    );
+
+                    if (allFixed) {
+                        result.push({
+                            ...fix,
+                            fixViaDirectUpgrades: candidateUpgrades
+                        });
+                        continue;
                     }
+                }
+
+                // Partial upgrades found or verification failed - apply what we have
+                // The two-phase mechanism will add an override if still needed
+                result.push({
+                    ...fix,
+                    fixViaDirectUpgrades: candidateUpgrades
                 });
             } else {
-                // No direct upgrade found, will use override
+                // No direct upgrades found, will use override
                 result.push(fix);
             }
         }
@@ -1340,7 +1148,9 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     fixes = await recipe.computeFixes(vulnerabilities, acc.db, {
                         packageManager: pm,
                         originalPackageJson,
-                        configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined
+                        configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined,
+                        marker,
+                        scopesToCheck
                     });
                 }
 
@@ -1514,9 +1324,10 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                 // Insert rows into the data table for each vulnerability (always, even in report-only mode)
                 if (vulnerabilities && vulnerabilities.length > 0) {
                     for (const vuln of vulnerabilities) {
-                        const upgradeable = recipe.isUpgradeableWithinDelta(
+                        const upgradeable = !recipe.isReportOnly() && isUpgradeableWithinDelta(
                             vuln.resolved.version,
-                            vuln.vulnerability
+                            vuln.vulnerability,
+                            recipe.maximumUpgradeDelta!
                         );
 
                         recipe.vulnerabilityReport.insertRow(ctx, new VulnerabilityReportRow(
@@ -1804,8 +1615,9 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         fixes: VulnerabilityFix[]
     ): Promise<void> {
         // Separate direct fixes from transitive fixes
-        const directFixes = fixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-        const transitiveFixes = fixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
+        // Fixes with fixViaDirectUpgrades are treated as direct fixes (they upgrade direct deps)
+        const directFixes = fixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+        const transitiveFixes = fixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
 
         // For 'override' and 'prefer-direct-upgrade', use two-phase approach
         if (this.shouldVerifyTransitiveFixes() && transitiveFixes.length > 0) {
@@ -1863,8 +1675,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
             if (this.transitiveFixStrategy === 'prefer-direct-upgrade') {
                 remainingTransitiveFixes = await this.tryDirectUpgradesForTransitives(
                     remainingTransitiveFixes,
-                    updateInfo,
-                    acc.db
+                    updateInfo
                 );
             }
 
@@ -1931,26 +1742,23 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         const pm = rootUpdateInfo.packageManager;
 
         // Collect all fixes from root and members, separating direct from transitive
-        const allDirectFixes: VulnerabilityFix[] = [];
         const allTransitiveFixes: VulnerabilityFix[] = [];
 
         // Process root fixes
         const rootFixes = acc.fixesByProject.get(rootPath) || [];
-        const rootDirectFixes = rootFixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-        const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
-        allDirectFixes.push(...rootDirectFixes);
+        const rootDirectFixes = rootFixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+        const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
         allTransitiveFixes.push(...rootTransitiveFixes);
 
         // Process member fixes and collect transitive fixes
         const memberDirectFixes = new Map<string, VulnerabilityFix[]>();
         for (const memberPath of memberPaths) {
             const memberFixes = acc.fixesByProject.get(memberPath) || [];
-            const directFixes = memberFixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-            const transitiveFixes = memberFixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
+            const directFixes = memberFixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+            const transitiveFixes = memberFixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
 
             if (directFixes.length > 0) {
                 memberDirectFixes.set(memberPath, directFixes);
-                allDirectFixes.push(...directFixes);
             }
             allTransitiveFixes.push(...transitiveFixes);
         }
@@ -2038,8 +1846,7 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
             if (this.transitiveFixStrategy === 'prefer-direct-upgrade') {
                 remainingTransitiveFixes = await this.tryDirectUpgradesForTransitives(
                     remainingTransitiveFixes,
-                    rootUpdateInfo,
-                    acc.db
+                    rootUpdateInfo
                 );
             }
 
@@ -2142,18 +1949,21 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
                     packageJson[fix.scope][fix.packageName] = applyVersionPrefix(originalVersion, fix.newVersion);
                 }
             } else if (fix.isTransitive) {
-                // If we found a direct dependency upgrade that fixes this transitive vulnerability,
-                // upgrade that direct dependency instead of using overrides. This is preferred because:
+                // If we found direct dependency upgrades that fix this transitive vulnerability,
+                // upgrade those direct dependencies instead of using overrides. This is preferred because:
                 // 1. It's cleaner - no override/resolution clutter in package.json
                 // 2. It's more compatible - the direct dep author tested with their transitive deps
                 // 3. Future installs work naturally without forced versions
-                if (fix.fixViaDirectUpgrade) {
-                    const {directDepName, directDepVersion, directDepScope} = fix.fixViaDirectUpgrade;
-                    if (packageJson[directDepScope]?.[directDepName]) {
-                        const originalVersion = packageJson[directDepScope][directDepName];
-                        packageJson[directDepScope][directDepName] = applyVersionPrefix(originalVersion, directDepVersion);
-                        continue; // Skip the override logic below
+                if (fix.fixViaDirectUpgrades && fix.fixViaDirectUpgrades.length > 0) {
+                    // Apply ALL direct dependency upgrades that were found
+                    for (const upgrade of fix.fixViaDirectUpgrades) {
+                        const {directDepName, directDepVersion, directDepScope} = upgrade;
+                        if (packageJson[directDepScope]?.[directDepName]) {
+                            const originalVersion = packageJson[directDepScope][directDepName];
+                            packageJson[directDepScope][directDepName] = applyVersionPrefix(originalVersion, directDepVersion);
+                        }
                     }
+                    continue; // Skip the override logic below
                 }
 
                 // Check if this package is also a direct dependency in any scope.
@@ -2341,66 +2151,3 @@ export class DependencyVulnerabilityCheck extends ScanningRecipe<Accumulator> {
         return packageJson;
     }
 }
-
-/**
- * Extracts the version prefix (e.g., ^, ~, >=) from a version string.
- * Returns the prefix and the bare version separately.
- */
-export function extractVersionPrefix(versionString: string): { prefix: string; version: string } {
-    // Match common semver range prefixes: ^, ~, >=, <=, >, <, =
-    const match = versionString.match(/^([~^]|>=?|<=?|=)?(.*)$/);
-    if (match) {
-        return {
-            prefix: match[1] || '',
-            version: match[2]
-        };
-    }
-    return {prefix: '', version: versionString};
-}
-
-/**
- * Applies the original version prefix to a new version.
- */
-export function applyVersionPrefix(originalVersion: string, newVersion: string): string {
-    const {prefix} = extractVersionPrefix(originalVersion);
-    return prefix + newVersion;
-}
-
-/**
- * Finds the dependency scope where a package is declared as a direct dependency.
- * Returns the scope name (dependencies, devDependencies, etc.) or undefined if not found.
- */
-function findDirectDependencyScope(
-    packageJson: Record<string, any>,
-    packageName: string
-): DependencyScope | undefined {
-    for (const scope of ALL_DEPENDENCY_SCOPES) {
-        if (packageJson[scope]?.[packageName]) {
-            return scope;
-        }
-    }
-    return undefined;
-}
-
-/**
- * Extracts the overrides section from a package.json based on the package manager.
- * Returns the overrides object or undefined if not present.
- */
-function getOverridesFromPackageJson(
-    packageJson: Record<string, any>,
-    packageManager: PackageManager
-): Record<string, string> | undefined {
-    switch (packageManager) {
-        case PackageManager.Npm:
-        case PackageManager.Bun:
-            return packageJson.overrides;
-        case PackageManager.Pnpm:
-            return packageJson.pnpm?.overrides;
-        case PackageManager.YarnClassic:
-        case PackageManager.YarnBerry:
-            return packageJson.resolutions;
-        default:
-            return undefined;
-    }
-}
-