@openrewrite/recipes-nodejs 0.37.0-20260106-083133 → 0.37.0-20260106-104324

package/dist/security/dependency-vulnerability-check.js

@@ -49,8 +49,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DependencyVulnerabilityCheck = void 0;
-exports.extractVersionPrefix = extractVersionPrefix;
-exports.applyVersionPrefix = applyVersionPrefix;
 const rewrite_1 = require("@openrewrite/rewrite");
 const json_1 = require("@openrewrite/rewrite/json");
 const text_1 = require("@openrewrite/rewrite/text");
@@ -60,9 +58,9 @@ const semver = __importStar(require("semver"));
 const path = __importStar(require("path"));
 const vulnerability_1 = require("./vulnerability");
 const npm_utils_1 = require("./npm-utils");
-const ALL_DEPENDENCY_SCOPES = [
-    'dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'
-];
+const version_utils_1 = require("./version-utils");
+const types_1 = require("./types");
+const override_utils_1 = require("./override-utils");
 class VulnerabilityReportRow {
     constructor(sourcePath, cve, packageName, version, fixedVersion, lastAffectedVersion, upgradeable, summary, severity, depth, cwes, isDirect, dependencyPath) {
         this.sourcePath = sourcePath;
@@ -189,9 +187,6 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     shouldScanTransitives() {
         return this.transitiveFixStrategy !== 'report';
     }
-    shouldFixTransitives() {
-        return this.transitiveFixStrategy !== 'report';
-    }
     shouldVerifyTransitiveFixes() {
         return this.transitiveFixStrategy === 'override' ||
             this.transitiveFixStrategy === 'prefer-direct-upgrade';
@@ -199,7 +194,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     filterRemainingTransitiveFixes(fixes, lockFileContent, packageManager, db) {
         const result = [];
         for (const fix of fixes) {
-            if (!fix.isTransitive || fix.fixViaDirectUpgrade) {
+            if (!fix.isTransitive || (fix.fixViaDirectUpgrades && fix.fixViaDirectUpgrades.length > 0)) {
                 result.push(fix);
                 continue;
             }
@@ -217,7 +212,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     isVersionStillVulnerable(packageName, version, cves, db) {
         const vulns = db.getVulnerabilities(packageName);
         for (const vuln of vulns) {
-            if (cves.includes(vuln.cve) && this.isVersionAffected(version, vuln)) {
+            if (cves.includes(vuln.cve) && (0, version_utils_1.isVersionAffected)(version, vuln)) {
                 return true;
             }
         }
@@ -235,100 +230,6 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         return this.cvePatternRegex.test(vulnerability.cve);
     }
-    isVersionAffected(version, vulnerability) {
-        try {
-            const v = semver.parse(version);
-            if (!v)
-                return false;
-            if (vulnerability.introducedVersion && vulnerability.introducedVersion !== '0') {
-                const introduced = semver.parse(vulnerability.introducedVersion);
-                if (introduced && semver.lt(v, introduced)) {
-                    return false;
-                }
-            }
-            if (vulnerability.fixedVersion) {
-                const fixed = semver.parse(vulnerability.fixedVersion);
-                if (fixed && semver.gte(v, fixed)) {
-                    return false;
-                }
-                return true;
-            }
-            if (vulnerability.lastAffectedVersion) {
-                const lastAffected = semver.parse(vulnerability.lastAffectedVersion);
-                if (lastAffected && semver.gt(v, lastAffected)) {
-                    return false;
-                }
-                return true;
-            }
-            return true;
-        }
-        catch (_a) {
-            return false;
-        }
-    }
-    isUpgradeableWithinDelta(currentVersion, vulnerability) {
-        if (this.isReportOnly()) {
-            return false;
-        }
-        try {
-            const current = semver.parse(currentVersion);
-            if (!current)
-                return false;
-            const delta = this.maximumUpgradeDelta;
-            if (vulnerability.fixedVersion) {
-                const fixed = semver.parse(vulnerability.fixedVersion);
-                if (!fixed)
-                    return false;
-                switch (delta) {
-                    case 'patch':
-                        return current.major === fixed.major && current.minor === fixed.minor;
-                    case 'minor':
-                        return current.major === fixed.major;
-                    case 'major':
-                        return true;
-                    case 'none':
-                        return false;
-                }
-            }
-            if (vulnerability.lastAffectedVersion) {
-                const lastAffected = semver.parse(vulnerability.lastAffectedVersion);
-                if (!lastAffected)
-                    return false;
-                switch (delta) {
-                    case 'patch':
-                        return current.major === lastAffected.major &&
-                            current.minor === lastAffected.minor;
-                    case 'minor':
-                        return current.major === lastAffected.major;
-                    case 'major':
-                        return true;
-                    case 'none':
-                        return false;
-                }
-            }
-            return false;
-        }
-        catch (_a) {
-            return false;
-        }
-    }
-    getUpgradeVersion(vulnerability) {
-        if (vulnerability.fixedVersion) {
-            return vulnerability.fixedVersion;
-        }
-        return undefined;
-    }
-    getVersionPrefixForDelta() {
-        switch (this.maximumUpgradeDelta) {
-            case 'patch':
-                return '~';
-            case 'minor':
-            case 'major':
-                return '^';
-            default:
-                return '';
-        }
-    }
     renderPath(scope, path) {
         const parts = [];
         if (scope) {
@@ -339,6 +240,39 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         return parts.join(' > ');
     }
+    findAllDirectDepsForTransitive(marker, transitivePackageName, scopesToCheck) {
+        const results = [];
+        for (const scope of scopesToCheck) {
+            const deps = marker[scope] || [];
+            for (const dep of deps) {
+                if (dep.resolved && this.hasTransitiveInTree(dep.resolved, transitivePackageName, new Set())) {
+                    results.push({
+                        name: dep.resolved.name,
+                        version: dep.resolved.version,
+                        scope
+                    });
+                }
+            }
+        }
+        return results;
+    }
+    hasTransitiveInTree(resolved, targetPackageName, visited) {
+        const key = `${resolved.name}@${resolved.version}`;
+        if (visited.has(key))
+            return false;
+        visited.add(key);
+        if (resolved.dependencies) {
+            for (const child of resolved.dependencies) {
+                if (child.name === targetPackageName) {
+                    return true;
+                }
+                if (child.resolved && this.hasTransitiveInTree(child.resolved, targetPackageName, visited)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
     findVulnerabilities(resolved, db, depth, isDirect, scope, path, visited, results) {
         const key = `${resolved.name}@${resolved.version}`;
         if (visited.has(key))
@@ -353,7 +287,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             if (!this.matchesCvePattern(vuln)) {
                 continue;
             }
-            if (this.isVersionAffected(resolved.version, vuln)) {
+            if ((0, version_utils_1.isVersionAffected)(resolved.version, vuln)) {
                 results.push({
                     resolved,
                     vulnerability: vuln,
@@ -385,7 +319,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             for (const dep of deps) {
                 if (!dep.resolved)
                     continue;
-                const declaredMinVersion = this.extractMinimumVersion(dep.versionConstraint);
+                const declaredMinVersion = (0, version_utils_1.extractMinimumVersion)(dep.versionConstraint);
                 if (!declaredMinVersion)
                     continue;
                 if (declaredMinVersion === dep.resolved.version)
@@ -401,8 +335,8 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     if (!this.matchesCvePattern(vuln)) {
                         continue;
                     }
-                    if (this.isVersionAffected(declaredMinVersion, vuln) &&
-                        !this.isVersionAffected(dep.resolved.version, vuln)) {
+                    if ((0, version_utils_1.isVersionAffected)(declaredMinVersion, vuln) &&
+                        !(0, version_utils_1.isVersionAffected)(dep.resolved.version, vuln)) {
                         affectedCves.push(vuln.cve);
                         affectedCveSummaries.set(vuln.cve, vuln.summary);
                         const fixVersion = vuln.fixedVersion;
@@ -433,20 +367,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         if (this.isReportOnly()) {
             return false;
         }
-        return this.isVersionWithinDelta(fromVersion, toVersion);
-    }
-    extractMinimumVersion(constraint) {
-        if (!constraint)
-            return undefined;
-        if (semver.valid(constraint)) {
-            return constraint;
-        }
-        const match = constraint.match(/^[~^>=<]*\s*(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/);
-        if (match && semver.valid(match[1])) {
-            return match[1];
-        }
-        const coerced = semver.coerce(constraint);
-        return coerced === null || coerced === void 0 ? void 0 : coerced.version;
+        return (0, version_utils_1.isVersionWithinDelta)(fromVersion, toVersion, this.maximumUpgradeDelta);
     }
     findHighestSafeVersion(packageName, originalVersion, initialFixVersion, db, visited = new Set()) {
         if (visited.has(initialFixVersion)) {
@@ -454,15 +375,15 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         visited.add(initialFixVersion);
         const vulnsInFixVersion = db.getVulnerabilities(packageName)
-            .filter(v => this.isVersionAffected(initialFixVersion, v));
+            .filter(v => (0, version_utils_1.isVersionAffected)(initialFixVersion, v));
         if (vulnsInFixVersion.length === 0) {
             return initialFixVersion;
         }
         let highestFixVersion = initialFixVersion;
         for (const vuln of vulnsInFixVersion) {
-            const fixVersion = this.getUpgradeVersion(vuln);
+            const fixVersion = (0, version_utils_1.getUpgradeVersion)(vuln);
             if (fixVersion && semver.valid(fixVersion)) {
-                if (this.isVersionWithinDelta(originalVersion, fixVersion)) {
+                if ((0, version_utils_1.isVersionWithinDelta)(originalVersion, fixVersion, this.maximumUpgradeDelta)) {
                     if (semver.gt(fixVersion, highestFixVersion)) {
                         highestFixVersion = fixVersion;
                     }
@@ -474,29 +395,6 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         return initialFixVersion;
     }
-    isVersionWithinDelta(originalVersion, targetVersion) {
-        try {
-            const original = semver.parse(originalVersion);
-            const target = semver.parse(targetVersion);
-            if (!original || !target)
-                return false;
-            switch (this.maximumUpgradeDelta) {
-                case 'patch':
-                    return original.major === target.major && original.minor === target.minor;
-                case 'minor':
-                    return original.major === target.major;
-                case 'major':
-                    return true;
-                case 'none':
-                    return false;
-                default:
-                    return false;
-            }
-        }
-        catch (_a) {
-            return false;
-        }
-    }
     computeFixes(vulnerabilities, db, projectContext) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d, _e, _f, _g;
@@ -531,23 +429,27 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                 let isTransitive = true;
                 let scope;
                 let originalVersion;
-                let directDepInfo;
+                const directDepInfosMap = new Map();
                 for (const vuln of vulns) {
                     if (!originalVersion) {
                         originalVersion = vuln.resolved.version;
                     }
-                    if (!vuln.isDirect && vuln.path.length > 0 && !directDepInfo) {
+                    if (!vuln.isDirect && vuln.path.length > 0) {
                         const directDep = vuln.path[0];
-                        directDepInfo = {
-                            name: directDep.name,
-                            version: directDep.version,
-                            scope: vuln.scope || 'dependencies'
-                        };
+                        const depScope = vuln.scope || 'dependencies';
+                        const key = `${directDep.name}@${depScope}`;
+                        if (!directDepInfosMap.has(key)) {
+                            directDepInfosMap.set(key, {
+                                name: directDep.name,
+                                version: directDep.version,
+                                scope: depScope
+                            });
+                        }
                     }
-                    if (!this.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability)) {
+                    if (this.isReportOnly() || !(0, version_utils_1.isUpgradeableWithinDelta)(vuln.resolved.version, vuln.vulnerability, this.maximumUpgradeDelta)) {
                         continue;
                     }
-                    const fixVersion = this.getUpgradeVersion(vuln.vulnerability);
+                    const fixVersion = (0, version_utils_1.getUpgradeVersion)(vuln.vulnerability);
                     if (fixVersion) {
                         const fixMajor = (_g = semver.parse(fixVersion)) === null || _g === void 0 ? void 0 : _g.major;
                         const shouldConsiderFix = hasMultipleMajorVersions
@@ -566,8 +468,18 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         scope = vuln.scope;
                     }
                 }
+                if (isTransitive && (projectContext === null || projectContext === void 0 ? void 0 : projectContext.marker) && (projectContext === null || projectContext === void 0 ? void 0 : projectContext.scopesToCheck)) {
+                    const allDirectDeps = this.findAllDirectDepsForTransitive(projectContext.marker, packageName, projectContext.scopesToCheck);
+                    for (const dep of allDirectDeps) {
+                        const key = `${dep.name}@${dep.scope}`;
+                        if (!directDepInfosMap.has(key)) {
+                            directDepInfosMap.set(key, dep);
+                        }
+                    }
+                }
                 if (highestFixVersion && cves.length > 0 && originalVersion) {
                     const safeVersion = this.findHighestSafeVersion(packageName, originalVersion, highestFixVersion, db);
+                    const directDepInfosArray = Array.from(directDepInfosMap.values());
                     const fix = {
                         packageName,
                         newVersion: safeVersion || highestFixVersion,
@@ -576,11 +488,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         cveSummaries,
                         scope,
                         originalMajorVersion: originalMajor,
-                        directDepInfo: isTransitive && directDepInfo ? {
-                            name: directDepInfo.name,
-                            version: directDepInfo.version,
-                            scope: directDepInfo.scope
-                        } : undefined
+                        directDepInfos: isTransitive && directDepInfosArray.length > 0 ? directDepInfosArray : undefined
                     };
                     fixes.push(fix);
                 }
@@ -588,47 +496,50 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             return fixes;
         });
     }
-    tryFindDirectDepUpgrade(transitivePackageName, requiredFixVersion, directDepInfo, projectContext, db) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const isVulnerable = (version) => {
-                try {
-                    return semver.lt(version, requiredFixVersion);
-                }
-                catch (_a) {
-                    return true;
-                }
-            };
-            const isWithinDelta = (from, to) => {
-                return this.isVersionWithinDelta(from, to);
-            };
-            try {
-                const upgradeVersion = yield (0, npm_utils_1.findDirectUpgradeThatFixesTransitive)(projectContext.packageManager, directDepInfo.name, directDepInfo.version, transitivePackageName, isVulnerable, isWithinDelta, projectContext.originalPackageJson, directDepInfo.scope, projectContext.configFiles);
-                return upgradeVersion;
-            }
-            catch (_a) {
-                return undefined;
-            }
-        });
-    }
-    tryDirectUpgradesForTransitives(fixes, updateInfo, db) {
+    tryDirectUpgradesForTransitives(fixes, updateInfo) {
         return __awaiter(this, void 0, void 0, function* () {
             const result = [];
             for (const fix of fixes) {
-                if (!fix.directDepInfo) {
+                if (!fix.directDepInfos || fix.directDepInfos.length === 0) {
                     result.push(fix);
                     continue;
                 }
-                const directUpgradeVersion = yield this.tryFindDirectDepUpgrade(fix.packageName, fix.newVersion, fix.directDepInfo, {
-                    packageManager: updateInfo.packageManager,
-                    originalPackageJson: updateInfo.originalPackageJson,
-                    configFiles: updateInfo.configFiles
-                }, db);
-                if (directUpgradeVersion) {
-                    result.push(Object.assign(Object.assign({}, fix), { fixViaDirectUpgrade: {
-                            directDepName: fix.directDepInfo.name,
+                const candidateUpgrades = [];
+                const isVulnerable = (version) => {
+                    try {
+                        return semver.lt(version, fix.newVersion);
+                    }
+                    catch (_a) {
+                        return true;
+                    }
+                };
+                const isWithinDelta = (from, to) => {
+                    return (0, version_utils_1.isVersionWithinDelta)(from, to, this.maximumUpgradeDelta);
+                };
+                for (const directDepInfo of fix.directDepInfos) {
+                    const directUpgradeVersion = yield (0, npm_utils_1.findDirectUpgradeWithSafeTransitiveInIsolation)(updateInfo.packageManager, directDepInfo.name, directDepInfo.version, fix.packageName, isVulnerable, isWithinDelta, directDepInfo.scope, updateInfo.configFiles);
+                    if (directUpgradeVersion) {
+                        candidateUpgrades.push({
+                            directDepName: directDepInfo.name,
                             directDepVersion: directUpgradeVersion,
-                            directDepScope: fix.directDepInfo.scope
-                        } }));
+                            directDepScope: directDepInfo.scope
+                        });
+                    }
+                }
+                if (candidateUpgrades.length > 0) {
+                    const foundAllUpgrades = candidateUpgrades.length === fix.directDepInfos.length;
+                    if (foundAllUpgrades) {
+                        const allFixed = yield (0, npm_utils_1.verifyAllUpgradesFixTransitive)(updateInfo.packageManager, candidateUpgrades.map(u => ({
+                            name: u.directDepName,
+                            version: u.directDepVersion,
+                            scope: u.directDepScope
+                        })), fix.packageName, isVulnerable, updateInfo.originalPackageJson, updateInfo.configFiles);
+                        if (allFixed) {
+                            result.push(Object.assign(Object.assign({}, fix), { fixViaDirectUpgrades: candidateUpgrades }));
+                            continue;
+                        }
+                    }
+                    result.push(Object.assign(Object.assign({}, fix), { fixViaDirectUpgrades: candidateUpgrades }));
                 }
                 else {
                     result.push(fix);
@@ -680,7 +591,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         const visited = new Set();
                         const scopesToCheck = recipe.scope
                             ? [recipe.scope]
-                            : ALL_DEPENDENCY_SCOPES;
+                            : types_1.ALL_DEPENDENCY_SCOPES;
                         for (const scope of scopesToCheck) {
                             const deps = marker[scope] || [];
                             for (const dep of deps) {
@@ -713,7 +624,9 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                             fixes = yield recipe.computeFixes(vulnerabilities, acc.db, {
                                 packageManager: pm,
                                 originalPackageJson,
-                                configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined
+                                configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined,
+                                marker,
+                                scopesToCheck
                             });
                         }
                         if (recipe.fixDeclaredVersions) {
@@ -844,7 +757,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         const vulnerabilities = acc.vulnerableByProject.get(doc.sourcePath);
                         if (vulnerabilities && vulnerabilities.length > 0) {
                             for (const vuln of vulnerabilities) {
-                                const upgradeable = recipe.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability);
+                                const upgradeable = !recipe.isReportOnly() && (0, version_utils_1.isUpgradeableWithinDelta)(vuln.resolved.version, vuln.vulnerability, recipe.maximumUpgradeDelta);
                                 recipe.vulnerabilityReport.insertRow(ctx, new VulnerabilityReportRow(doc.sourcePath, vuln.vulnerability.cve, vuln.resolved.name, vuln.resolved.version, vuln.vulnerability.fixedVersion || '', vuln.vulnerability.lastAffectedVersion || '', upgradeable, vuln.vulnerability.summary, vuln.vulnerability.severity, vuln.depth, vuln.vulnerability.cwes, vuln.isDirect, recipe.renderPath(vuln.scope, vuln.path)));
                             }
                         }
@@ -1011,8 +924,8 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     }
     runPackageManagerInstall(acc, updateInfo, fixes) {
         return __awaiter(this, void 0, void 0, function* () {
-            const directFixes = fixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-            const transitiveFixes = fixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
+            const directFixes = fixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+            const transitiveFixes = fixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
             if (this.shouldVerifyTransitiveFixes() && transitiveFixes.length > 0) {
                 const phase1PackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, directFixes, updateInfo.packageManager);
                 const phase1Result = yield (0, javascript_1.runInstallInTempDir)(updateInfo.packageManager, phase1PackageJson, {
@@ -1032,7 +945,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     return;
                 }
                 if (this.transitiveFixStrategy === 'prefer-direct-upgrade') {
-                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, updateInfo, acc.db);
+                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, updateInfo);
                 }
                 const finalFixes = [...directFixes, ...remainingTransitiveFixes];
                 const finalPackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, finalFixes, updateInfo.packageManager);
@@ -1053,21 +966,18 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         return __awaiter(this, void 0, void 0, function* () {
             const memberPaths = acc.workspaceRoots.get(rootPath) || [];
             const pm = rootUpdateInfo.packageManager;
-            const allDirectFixes = [];
             const allTransitiveFixes = [];
             const rootFixes = acc.fixesByProject.get(rootPath) || [];
-            const rootDirectFixes = rootFixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-            const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
-            allDirectFixes.push(...rootDirectFixes);
+            const rootDirectFixes = rootFixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+            const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
             allTransitiveFixes.push(...rootTransitiveFixes);
             const memberDirectFixes = new Map();
             for (const memberPath of memberPaths) {
                 const memberFixes = acc.fixesByProject.get(memberPath) || [];
-                const directFixes = memberFixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-                const transitiveFixes = memberFixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
+                const directFixes = memberFixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+                const transitiveFixes = memberFixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
                 if (directFixes.length > 0) {
                     memberDirectFixes.set(memberPath, directFixes);
-                    allDirectFixes.push(...directFixes);
                 }
                 allTransitiveFixes.push(...transitiveFixes);
             }
@@ -1110,7 +1020,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     return;
                 }
                 if (this.transitiveFixStrategy === 'prefer-direct-upgrade') {
-                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, rootUpdateInfo, acc.db);
+                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, rootUpdateInfo);
                 }
                 const finalRootPackageJson = this.createModifiedPackageJson(rootOriginalContent, [...rootDirectFixes, ...remainingTransitiveFixes], pm);
                 const finalResult = yield (0, javascript_1.runWorkspaceInstallInTempDir)(pm, finalRootPackageJson, {
@@ -1134,7 +1044,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             if (!fix.isTransitive && fix.scope) {
                 if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
                     const originalVersion = packageJson[fix.scope][fix.packageName];
-                    packageJson[fix.scope][fix.packageName] = applyVersionPrefix(originalVersion, fix.newVersion);
+                    packageJson[fix.scope][fix.packageName] = (0, version_utils_1.applyVersionPrefix)(originalVersion, fix.newVersion);
                 }
             }
         }
@@ -1154,19 +1064,21 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             if (!fix.isTransitive && fix.scope) {
                 if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
                     const originalVersion = packageJson[fix.scope][fix.packageName];
-                    packageJson[fix.scope][fix.packageName] = applyVersionPrefix(originalVersion, fix.newVersion);
+                    packageJson[fix.scope][fix.packageName] = (0, version_utils_1.applyVersionPrefix)(originalVersion, fix.newVersion);
                 }
             }
             else if (fix.isTransitive) {
-                if (fix.fixViaDirectUpgrade) {
-                    const { directDepName, directDepVersion, directDepScope } = fix.fixViaDirectUpgrade;
-                    if ((_a = packageJson[directDepScope]) === null || _a === void 0 ? void 0 : _a[directDepName]) {
-                        const originalVersion = packageJson[directDepScope][directDepName];
-                        packageJson[directDepScope][directDepName] = applyVersionPrefix(originalVersion, directDepVersion);
-                        continue;
+                if (fix.fixViaDirectUpgrades && fix.fixViaDirectUpgrades.length > 0) {
+                    for (const upgrade of fix.fixViaDirectUpgrades) {
+                        const { directDepName, directDepVersion, directDepScope } = upgrade;
+                        if ((_a = packageJson[directDepScope]) === null || _a === void 0 ? void 0 : _a[directDepName]) {
+                            const originalVersion = packageJson[directDepScope][directDepName];
+                            packageJson[directDepScope][directDepName] = (0, version_utils_1.applyVersionPrefix)(originalVersion, directDepVersion);
+                        }
                     }
+                    continue;
                 }
-                const directDepScope = findDirectDependencyScope(packageJson, fix.packageName);
+                const directDepScope = (0, override_utils_1.findDirectDependencyScope)(packageJson, fix.packageName);
                 if (directDepScope) {
                     const directVersion = packageJson[directDepScope][fix.packageName];
                     const directMajor = semver.major(semver.coerce(directVersion) || '0.0.0');
@@ -1182,13 +1094,13 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         }
                         continue;
                     }
-                    packageJson[directDepScope][fix.packageName] = applyVersionPrefix(directVersion, fix.newVersion);
+                    packageJson[directDepScope][fix.packageName] = (0, version_utils_1.applyVersionPrefix)(directVersion, fix.newVersion);
                     continue;
                 }
                 const packageFixes = fixesByPackage.get(fix.packageName) || [];
                 const hasMultipleMajorVersions = packageFixes.length > 1 &&
                     new Set(packageFixes.map(f => f.originalMajorVersion)).size > 1;
-                const existingOverrides = getOverridesFromPackageJson(packageJson, packageManager);
+                const existingOverrides = (0, override_utils_1.getOverridesFromPackageJson)(packageJson, packageManager);
                 const hasExistingVersionSpecificOverrides = existingOverrides &&
                     Object.keys(existingOverrides).some(key => key.startsWith(`${fix.packageName}@`));
                 const isYarn = packageManager === "YarnClassic" ||
@@ -1338,42 +1250,4 @@ __decorate([
         example: "true"
     })
 ], DependencyVulnerabilityCheck.prototype, "addOverrideComments", void 0);
-function extractVersionPrefix(versionString) {
-    const match = versionString.match(/^([~^]|>=?|<=?|=)?(.*)$/);
-    if (match) {
-        return {
-            prefix: match[1] || '',
-            version: match[2]
-        };
-    }
-    return { prefix: '', version: versionString };
-}
-function applyVersionPrefix(originalVersion, newVersion) {
-    const { prefix } = extractVersionPrefix(originalVersion);
-    return prefix + newVersion;
-}
-function findDirectDependencyScope(packageJson, packageName) {
-    var _a;
-    for (const scope of ALL_DEPENDENCY_SCOPES) {
-        if ((_a = packageJson[scope]) === null || _a === void 0 ? void 0 : _a[packageName]) {
-            return scope;
-        }
-    }
-    return undefined;
-}
-function getOverridesFromPackageJson(packageJson, packageManager) {
-    var _a;
-    switch (packageManager) {
-        case "Npm":
-        case "Bun":
-            return packageJson.overrides;
-        case "Pnpm":
-            return (_a = packageJson.pnpm) === null || _a === void 0 ? void 0 : _a.overrides;
-        case "YarnClassic":
-        case "YarnBerry":
-            return packageJson.resolutions;
-        default:
-            return undefined;
-    }
-}
 //# sourceMappingURL=dependency-vulnerability-check.js.map