@openrewrite/recipes-nodejs 0.37.0-20260106-083133 → 0.37.0-20260106-170728

package/dist/security/dependency-vulnerability-check.js

@@ -49,8 +49,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DependencyVulnerabilityCheck = void 0;
-exports.extractVersionPrefix = extractVersionPrefix;
-exports.applyVersionPrefix = applyVersionPrefix;
 const rewrite_1 = require("@openrewrite/rewrite");
 const json_1 = require("@openrewrite/rewrite/json");
 const text_1 = require("@openrewrite/rewrite/text");
@@ -60,9 +58,9 @@ const semver = __importStar(require("semver"));
 const path = __importStar(require("path"));
 const vulnerability_1 = require("./vulnerability");
 const npm_utils_1 = require("./npm-utils");
-const ALL_DEPENDENCY_SCOPES = [
-    'dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'
-];
+const version_utils_1 = require("./version-utils");
+const types_1 = require("./types");
+const override_utils_1 = require("./override-utils");
 class VulnerabilityReportRow {
     constructor(sourcePath, cve, packageName, version, fixedVersion, lastAffectedVersion, upgradeable, summary, severity, depth, cwes, isDirect, dependencyPath) {
         this.sourcePath = sourcePath;
@@ -160,7 +158,7 @@ __decorate([
 ], VulnerabilityReportRow.prototype, "dependencyPath", void 0);
 class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     constructor(options) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         super(options);
         this.name = "org.openrewrite.node.dependency-vulnerability-check";
         this.displayName = "Find and fix vulnerable npm dependencies";
@@ -171,10 +169,11 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             "Vulnerability information comes from the GitHub Security Advisory Database.";
         this.vulnerabilityReport = new rewrite_1.DataTable("org.openrewrite.nodejs.table.VulnerabilityReport", "Vulnerability Report", "Lists all vulnerabilities found in project dependencies.", VulnerabilityReportRow);
         (_a = this.transitiveFixStrategy) !== null && _a !== void 0 ? _a : (this.transitiveFixStrategy = 'report');
-        (_b = this.maximumUpgradeDelta) !== null && _b !== void 0 ? _b : (this.maximumUpgradeDelta = 'patch');
-        (_c = this.minimumSeverity) !== null && _c !== void 0 ? _c : (this.minimumSeverity = vulnerability_1.Severity.LOW);
-        (_d = this.fixDeclaredVersions) !== null && _d !== void 0 ? _d : (this.fixDeclaredVersions = false);
-        (_e = this.addOverrideComments) !== null && _e !== void 0 ? _e : (this.addOverrideComments = true);
+        (_b = this.preferDirectUpgrade) !== null && _b !== void 0 ? _b : (this.preferDirectUpgrade = true);
+        (_c = this.maximumUpgradeDelta) !== null && _c !== void 0 ? _c : (this.maximumUpgradeDelta = 'patch');
+        (_d = this.minimumSeverity) !== null && _d !== void 0 ? _d : (this.minimumSeverity = vulnerability_1.Severity.LOW);
+        (_e = this.fixDeclaredVersions) !== null && _e !== void 0 ? _e : (this.fixDeclaredVersions = false);
+        (_f = this.addOverrideComments) !== null && _f !== void 0 ? _f : (this.addOverrideComments = true);
         if (options === null || options === void 0 ? void 0 : options.minimumSeverity) {
             this.minimumSeverity = (0, vulnerability_1.parseSeverity)(options.minimumSeverity);
         }
@@ -182,33 +181,29 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             try {
                 this.cvePatternRegex = new RegExp(this.cvePattern);
             }
-            catch (_f) {
+            catch (_g) {
             }
         }
     }
     shouldScanTransitives() {
-        return this.transitiveFixStrategy !== 'report';
-    }
-    shouldFixTransitives() {
-        return this.transitiveFixStrategy !== 'report';
+        return true;
     }
     shouldVerifyTransitiveFixes() {
-        return this.transitiveFixStrategy === 'override' ||
-            this.transitiveFixStrategy === 'prefer-direct-upgrade';
+        return this.preferDirectUpgrade === true;
     }
     filterRemainingTransitiveFixes(fixes, lockFileContent, packageManager, db) {
         const result = [];
         for (const fix of fixes) {
-            if (!fix.isTransitive || fix.fixViaDirectUpgrade) {
+            if (!fix.isTransitive || (fix.fixViaDirectUpgrades && fix.fixViaDirectUpgrades.length > 0)) {
                 result.push(fix);
                 continue;
             }
-            const resolvedVersion = (0, npm_utils_1.extractVersionFromLockFile)(lockFileContent, fix.packageName, packageManager);
-            if (!resolvedVersion) {
+            const resolvedVersions = (0, npm_utils_1.extractAllVersionsFromLockFile)(lockFileContent, fix.packageName, packageManager);
+            if (resolvedVersions.length === 0) {
                 continue;
             }
-            const isStillVulnerable = this.isVersionStillVulnerable(fix.packageName, resolvedVersion, fix.cves, db);
-            if (isStillVulnerable) {
+            const anyVersionVulnerable = resolvedVersions.some(version => this.isVersionStillVulnerable(fix.packageName, version, fix.cves, db));
+            if (anyVersionVulnerable) {
                 result.push(fix);
             }
         }
@@ -217,7 +212,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     isVersionStillVulnerable(packageName, version, cves, db) {
         const vulns = db.getVulnerabilities(packageName);
         for (const vuln of vulns) {
-            if (cves.includes(vuln.cve) && this.isVersionAffected(version, vuln)) {
+            if (cves.includes(vuln.cve) && (0, version_utils_1.isVersionAffected)(version, vuln)) {
                 return true;
             }
         }
@@ -235,100 +230,6 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         return this.cvePatternRegex.test(vulnerability.cve);
     }
-    isVersionAffected(version, vulnerability) {
-        try {
-            const v = semver.parse(version);
-            if (!v)
-                return false;
-            if (vulnerability.introducedVersion && vulnerability.introducedVersion !== '0') {
-                const introduced = semver.parse(vulnerability.introducedVersion);
-                if (introduced && semver.lt(v, introduced)) {
-                    return false;
-                }
-            }
-            if (vulnerability.fixedVersion) {
-                const fixed = semver.parse(vulnerability.fixedVersion);
-                if (fixed && semver.gte(v, fixed)) {
-                    return false;
-                }
-                return true;
-            }
-            if (vulnerability.lastAffectedVersion) {
-                const lastAffected = semver.parse(vulnerability.lastAffectedVersion);
-                if (lastAffected && semver.gt(v, lastAffected)) {
-                    return false;
-                }
-                return true;
-            }
-            return true;
-        }
-        catch (_a) {
-            return false;
-        }
-    }
-    isUpgradeableWithinDelta(currentVersion, vulnerability) {
-        if (this.isReportOnly()) {
-            return false;
-        }
-        try {
-            const current = semver.parse(currentVersion);
-            if (!current)
-                return false;
-            const delta = this.maximumUpgradeDelta;
-            if (vulnerability.fixedVersion) {
-                const fixed = semver.parse(vulnerability.fixedVersion);
-                if (!fixed)
-                    return false;
-                switch (delta) {
-                    case 'patch':
-                        return current.major === fixed.major && current.minor === fixed.minor;
-                    case 'minor':
-                        return current.major === fixed.major;
-                    case 'major':
-                        return true;
-                    case 'none':
-                        return false;
-                }
-            }
-            if (vulnerability.lastAffectedVersion) {
-                const lastAffected = semver.parse(vulnerability.lastAffectedVersion);
-                if (!lastAffected)
-                    return false;
-                switch (delta) {
-                    case 'patch':
-                        return current.major === lastAffected.major &&
-                            current.minor === lastAffected.minor;
-                    case 'minor':
-                        return current.major === lastAffected.major;
-                    case 'major':
-                        return true;
-                    case 'none':
-                        return false;
-                }
-            }
-            return false;
-        }
-        catch (_a) {
-            return false;
-        }
-    }
-    getUpgradeVersion(vulnerability) {
-        if (vulnerability.fixedVersion) {
-            return vulnerability.fixedVersion;
-        }
-        return undefined;
-    }
-    getVersionPrefixForDelta() {
-        switch (this.maximumUpgradeDelta) {
-            case 'patch':
-                return '~';
-            case 'minor':
-            case 'major':
-                return '^';
-            default:
-                return '';
-        }
-    }
     renderPath(scope, path) {
         const parts = [];
         if (scope) {
@@ -339,6 +240,39 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         return parts.join(' > ');
     }
+    findAllDirectDepsForTransitive(marker, transitivePackageName, scopesToCheck) {
+        const results = [];
+        for (const scope of scopesToCheck) {
+            const deps = marker[scope] || [];
+            for (const dep of deps) {
+                if (dep.resolved && this.hasTransitiveInTree(dep.resolved, transitivePackageName, new Set())) {
+                    results.push({
+                        name: dep.resolved.name,
+                        version: dep.resolved.version,
+                        scope
+                    });
+                }
+            }
+        }
+        return results;
+    }
+    hasTransitiveInTree(resolved, targetPackageName, visited) {
+        const key = `${resolved.name}@${resolved.version}`;
+        if (visited.has(key))
+            return false;
+        visited.add(key);
+        if (resolved.dependencies) {
+            for (const child of resolved.dependencies) {
+                if (child.name === targetPackageName) {
+                    return true;
+                }
+                if (child.resolved && this.hasTransitiveInTree(child.resolved, targetPackageName, visited)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
     findVulnerabilities(resolved, db, depth, isDirect, scope, path, visited, results) {
         const key = `${resolved.name}@${resolved.version}`;
         if (visited.has(key))
@@ -353,7 +287,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             if (!this.matchesCvePattern(vuln)) {
                 continue;
             }
-            if (this.isVersionAffected(resolved.version, vuln)) {
+            if ((0, version_utils_1.isVersionAffected)(resolved.version, vuln)) {
                 results.push({
                     resolved,
                     vulnerability: vuln,
@@ -385,7 +319,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             for (const dep of deps) {
                 if (!dep.resolved)
                     continue;
-                const declaredMinVersion = this.extractMinimumVersion(dep.versionConstraint);
+                const declaredMinVersion = (0, version_utils_1.extractMinimumVersion)(dep.versionConstraint);
                 if (!declaredMinVersion)
                     continue;
                 if (declaredMinVersion === dep.resolved.version)
@@ -401,8 +335,8 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     if (!this.matchesCvePattern(vuln)) {
                         continue;
                     }
-                    if (this.isVersionAffected(declaredMinVersion, vuln) &&
-                        !this.isVersionAffected(dep.resolved.version, vuln)) {
+                    if ((0, version_utils_1.isVersionAffected)(declaredMinVersion, vuln) &&
+                        !(0, version_utils_1.isVersionAffected)(dep.resolved.version, vuln)) {
                         affectedCves.push(vuln.cve);
                         affectedCveSummaries.set(vuln.cve, vuln.summary);
                         const fixVersion = vuln.fixedVersion;
@@ -433,20 +367,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         if (this.isReportOnly()) {
             return false;
         }
-        return this.isVersionWithinDelta(fromVersion, toVersion);
-    }
-    extractMinimumVersion(constraint) {
-        if (!constraint)
-            return undefined;
-        if (semver.valid(constraint)) {
-            return constraint;
-        }
-        const match = constraint.match(/^[~^>=<]*\s*(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/);
-        if (match && semver.valid(match[1])) {
-            return match[1];
-        }
-        const coerced = semver.coerce(constraint);
-        return coerced === null || coerced === void 0 ? void 0 : coerced.version;
+        return (0, version_utils_1.isVersionWithinDelta)(fromVersion, toVersion, this.maximumUpgradeDelta);
     }
     findHighestSafeVersion(packageName, originalVersion, initialFixVersion, db, visited = new Set()) {
         if (visited.has(initialFixVersion)) {
@@ -454,15 +375,15 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         visited.add(initialFixVersion);
         const vulnsInFixVersion = db.getVulnerabilities(packageName)
-            .filter(v => this.isVersionAffected(initialFixVersion, v));
+            .filter(v => (0, version_utils_1.isVersionAffected)(initialFixVersion, v));
         if (vulnsInFixVersion.length === 0) {
             return initialFixVersion;
         }
         let highestFixVersion = initialFixVersion;
         for (const vuln of vulnsInFixVersion) {
-            const fixVersion = this.getUpgradeVersion(vuln);
+            const fixVersion = (0, version_utils_1.getUpgradeVersion)(vuln);
             if (fixVersion && semver.valid(fixVersion)) {
-                if (this.isVersionWithinDelta(originalVersion, fixVersion)) {
+                if ((0, version_utils_1.isVersionWithinDelta)(originalVersion, fixVersion, this.maximumUpgradeDelta)) {
                     if (semver.gt(fixVersion, highestFixVersion)) {
                         highestFixVersion = fixVersion;
                     }
@@ -474,29 +395,6 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         }
         return initialFixVersion;
     }
-    isVersionWithinDelta(originalVersion, targetVersion) {
-        try {
-            const original = semver.parse(originalVersion);
-            const target = semver.parse(targetVersion);
-            if (!original || !target)
-                return false;
-            switch (this.maximumUpgradeDelta) {
-                case 'patch':
-                    return original.major === target.major && original.minor === target.minor;
-                case 'minor':
-                    return original.major === target.major;
-                case 'major':
-                    return true;
-                case 'none':
-                    return false;
-                default:
-                    return false;
-            }
-        }
-        catch (_a) {
-            return false;
-        }
-    }
     computeFixes(vulnerabilities, db, projectContext) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d, _e, _f, _g;
@@ -531,23 +429,28 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                 let isTransitive = true;
                 let scope;
                 let originalVersion;
-                let directDepInfo;
+                const directDepInfosMap = new Map();
                 for (const vuln of vulns) {
                     if (!originalVersion) {
                         originalVersion = vuln.resolved.version;
                     }
-                    if (!vuln.isDirect && vuln.path.length > 0 && !directDepInfo) {
+                    if (!vuln.isDirect && vuln.path.length > 0) {
                         const directDep = vuln.path[0];
-                        directDepInfo = {
-                            name: directDep.name,
-                            version: directDep.version,
-                            scope: vuln.scope || 'dependencies'
-                        };
+                        const depScope = vuln.scope || 'dependencies';
+                        const key = `${directDep.name}@${depScope}`;
+                        if (!directDepInfosMap.has(key)) {
+                            directDepInfosMap.set(key, {
+                                name: directDep.name,
+                                version: directDep.version,
+                                scope: depScope
+                            });
+                        }
                     }
-                    if (!this.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability)) {
+                    const upgradeCheck = (0, version_utils_1.isUpgradeableWithinDelta)(vuln.resolved.version, vuln.vulnerability, this.maximumUpgradeDelta);
+                    if (this.isReportOnly() || !upgradeCheck) {
                         continue;
                     }
-                    const fixVersion = this.getUpgradeVersion(vuln.vulnerability);
+                    const fixVersion = (0, version_utils_1.getUpgradeVersion)(vuln.vulnerability);
                     if (fixVersion) {
                         const fixMajor = (_g = semver.parse(fixVersion)) === null || _g === void 0 ? void 0 : _g.major;
                         const shouldConsiderFix = hasMultipleMajorVersions
@@ -566,8 +469,18 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         scope = vuln.scope;
                     }
                 }
+                if (isTransitive && (projectContext === null || projectContext === void 0 ? void 0 : projectContext.marker) && (projectContext === null || projectContext === void 0 ? void 0 : projectContext.scopesToCheck)) {
+                    const allDirectDeps = this.findAllDirectDepsForTransitive(projectContext.marker, packageName, projectContext.scopesToCheck);
+                    for (const dep of allDirectDeps) {
+                        const key = `${dep.name}@${dep.scope}`;
+                        if (!directDepInfosMap.has(key)) {
+                            directDepInfosMap.set(key, dep);
+                        }
+                    }
+                }
                 if (highestFixVersion && cves.length > 0 && originalVersion) {
                     const safeVersion = this.findHighestSafeVersion(packageName, originalVersion, highestFixVersion, db);
+                    const directDepInfosArray = Array.from(directDepInfosMap.values());
                     const fix = {
                         packageName,
                         newVersion: safeVersion || highestFixVersion,
@@ -576,11 +489,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         cveSummaries,
                         scope,
                         originalMajorVersion: originalMajor,
-                        directDepInfo: isTransitive && directDepInfo ? {
-                            name: directDepInfo.name,
-                            version: directDepInfo.version,
-                            scope: directDepInfo.scope
-                        } : undefined
+                        directDepInfos: isTransitive && directDepInfosArray.length > 0 ? directDepInfosArray : undefined
                     };
                     fixes.push(fix);
                 }
@@ -588,47 +497,50 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             return fixes;
         });
     }
-    tryFindDirectDepUpgrade(transitivePackageName, requiredFixVersion, directDepInfo, projectContext, db) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const isVulnerable = (version) => {
-                try {
-                    return semver.lt(version, requiredFixVersion);
-                }
-                catch (_a) {
-                    return true;
-                }
-            };
-            const isWithinDelta = (from, to) => {
-                return this.isVersionWithinDelta(from, to);
-            };
-            try {
-                const upgradeVersion = yield (0, npm_utils_1.findDirectUpgradeThatFixesTransitive)(projectContext.packageManager, directDepInfo.name, directDepInfo.version, transitivePackageName, isVulnerable, isWithinDelta, projectContext.originalPackageJson, directDepInfo.scope, projectContext.configFiles);
-                return upgradeVersion;
-            }
-            catch (_a) {
-                return undefined;
-            }
-        });
-    }
-    tryDirectUpgradesForTransitives(fixes, updateInfo, db) {
+    tryDirectUpgradesForTransitives(fixes, updateInfo) {
         return __awaiter(this, void 0, void 0, function* () {
             const result = [];
             for (const fix of fixes) {
-                if (!fix.directDepInfo) {
+                if (!fix.directDepInfos || fix.directDepInfos.length === 0) {
                     result.push(fix);
                     continue;
                 }
-                const directUpgradeVersion = yield this.tryFindDirectDepUpgrade(fix.packageName, fix.newVersion, fix.directDepInfo, {
-                    packageManager: updateInfo.packageManager,
-                    originalPackageJson: updateInfo.originalPackageJson,
-                    configFiles: updateInfo.configFiles
-                }, db);
-                if (directUpgradeVersion) {
-                    result.push(Object.assign(Object.assign({}, fix), { fixViaDirectUpgrade: {
-                            directDepName: fix.directDepInfo.name,
+                const candidateUpgrades = [];
+                const isVulnerable = (version) => {
+                    try {
+                        return semver.lt(version, fix.newVersion);
+                    }
+                    catch (_a) {
+                        return true;
+                    }
+                };
+                const isWithinDelta = (from, to) => {
+                    return (0, version_utils_1.isVersionWithinDelta)(from, to, this.maximumUpgradeDelta);
+                };
+                for (const directDepInfo of fix.directDepInfos) {
+                    const directUpgradeVersion = yield (0, npm_utils_1.findDirectUpgradeWithSafeTransitiveInIsolation)(updateInfo.packageManager, directDepInfo.name, directDepInfo.version, fix.packageName, isVulnerable, isWithinDelta, directDepInfo.scope, updateInfo.configFiles);
+                    if (directUpgradeVersion) {
+                        candidateUpgrades.push({
+                            directDepName: directDepInfo.name,
                             directDepVersion: directUpgradeVersion,
-                            directDepScope: fix.directDepInfo.scope
-                        } }));
+                            directDepScope: directDepInfo.scope
+                        });
+                    }
+                }
+                if (candidateUpgrades.length > 0) {
+                    const foundAllUpgrades = candidateUpgrades.length === fix.directDepInfos.length;
+                    if (foundAllUpgrades) {
+                        const allFixed = yield (0, npm_utils_1.verifyAllUpgradesFixTransitive)(updateInfo.packageManager, candidateUpgrades.map(u => ({
+                            name: u.directDepName,
+                            version: u.directDepVersion,
+                            scope: u.directDepScope
+                        })), fix.packageName, isVulnerable, updateInfo.originalPackageJson, updateInfo.configFiles);
+                        if (allFixed) {
+                            result.push(Object.assign(Object.assign({}, fix), { fixViaDirectUpgrades: candidateUpgrades }));
+                            continue;
+                        }
+                    }
+                    result.push(Object.assign(Object.assign({}, fix), { fixViaDirectUpgrades: candidateUpgrades }));
                 }
                 else {
                     result.push(fix);
@@ -680,7 +592,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         const visited = new Set();
                         const scopesToCheck = recipe.scope
                             ? [recipe.scope]
-                            : ALL_DEPENDENCY_SCOPES;
+                            : types_1.ALL_DEPENDENCY_SCOPES;
                         for (const scope of scopesToCheck) {
                             const deps = marker[scope] || [];
                             for (const dep of deps) {
@@ -713,7 +625,9 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                             fixes = yield recipe.computeFixes(vulnerabilities, acc.db, {
                                 packageManager: pm,
                                 originalPackageJson,
-                                configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined
+                                configFiles: Object.keys(configFiles).length > 0 ? configFiles : undefined,
+                                marker,
+                                scopesToCheck
                             });
                         }
                         if (recipe.fixDeclaredVersions) {
@@ -844,7 +758,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         const vulnerabilities = acc.vulnerableByProject.get(doc.sourcePath);
                         if (vulnerabilities && vulnerabilities.length > 0) {
                             for (const vuln of vulnerabilities) {
-                                const upgradeable = recipe.isUpgradeableWithinDelta(vuln.resolved.version, vuln.vulnerability);
+                                const upgradeable = !recipe.isReportOnly() && (0, version_utils_1.isUpgradeableWithinDelta)(vuln.resolved.version, vuln.vulnerability, recipe.maximumUpgradeDelta);
                                 recipe.vulnerabilityReport.insertRow(ctx, new VulnerabilityReportRow(doc.sourcePath, vuln.vulnerability.cve, vuln.resolved.name, vuln.resolved.version, vuln.vulnerability.fixedVersion || '', vuln.vulnerability.lastAffectedVersion || '', upgradeable, vuln.vulnerability.summary, vuln.vulnerability.severity, vuln.depth, vuln.vulnerability.cwes, vuln.isDirect, recipe.renderPath(vuln.scope, vuln.path)));
                             }
                         }
@@ -1011,8 +925,8 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
     }
     runPackageManagerInstall(acc, updateInfo, fixes) {
         return __awaiter(this, void 0, void 0, function* () {
-            const directFixes = fixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-            const transitiveFixes = fixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
+            const directFixes = fixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+            const transitiveFixes = fixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
             if (this.shouldVerifyTransitiveFixes() && transitiveFixes.length > 0) {
                 const phase1PackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, directFixes, updateInfo.packageManager);
                 const phase1Result = yield (0, javascript_1.runInstallInTempDir)(updateInfo.packageManager, phase1PackageJson, {
@@ -1031,8 +945,8 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     (0, javascript_1.storeInstallResult)(phase1Result, acc, updateInfo, phase1PackageJson);
                     return;
                 }
-                if (this.transitiveFixStrategy === 'prefer-direct-upgrade') {
-                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, updateInfo, acc.db);
+                if (this.preferDirectUpgrade) {
+                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, updateInfo);
                 }
                 const finalFixes = [...directFixes, ...remainingTransitiveFixes];
                 const finalPackageJson = this.createModifiedPackageJson(updateInfo.originalPackageJson, finalFixes, updateInfo.packageManager);
@@ -1053,21 +967,18 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
         return __awaiter(this, void 0, void 0, function* () {
             const memberPaths = acc.workspaceRoots.get(rootPath) || [];
             const pm = rootUpdateInfo.packageManager;
-            const allDirectFixes = [];
             const allTransitiveFixes = [];
             const rootFixes = acc.fixesByProject.get(rootPath) || [];
-            const rootDirectFixes = rootFixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-            const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
-            allDirectFixes.push(...rootDirectFixes);
+            const rootDirectFixes = rootFixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+            const rootTransitiveFixes = rootFixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
             allTransitiveFixes.push(...rootTransitiveFixes);
             const memberDirectFixes = new Map();
             for (const memberPath of memberPaths) {
                 const memberFixes = acc.fixesByProject.get(memberPath) || [];
-                const directFixes = memberFixes.filter(f => !f.isTransitive || f.fixViaDirectUpgrade);
-                const transitiveFixes = memberFixes.filter(f => f.isTransitive && !f.fixViaDirectUpgrade);
+                const directFixes = memberFixes.filter(f => !f.isTransitive || (f.fixViaDirectUpgrades && f.fixViaDirectUpgrades.length > 0));
+                const transitiveFixes = memberFixes.filter(f => f.isTransitive && (!f.fixViaDirectUpgrades || f.fixViaDirectUpgrades.length === 0));
                 if (directFixes.length > 0) {
                     memberDirectFixes.set(memberPath, directFixes);
-                    allDirectFixes.push(...directFixes);
                 }
                 allTransitiveFixes.push(...transitiveFixes);
             }
@@ -1109,8 +1020,8 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                     (0, javascript_1.storeInstallResult)(phase1Result, acc, rootUpdateInfo, phase1RootPackageJson);
                     return;
                 }
-                if (this.transitiveFixStrategy === 'prefer-direct-upgrade') {
-                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, rootUpdateInfo, acc.db);
+                if (this.preferDirectUpgrade) {
+                    remainingTransitiveFixes = yield this.tryDirectUpgradesForTransitives(remainingTransitiveFixes, rootUpdateInfo);
                 }
                 const finalRootPackageJson = this.createModifiedPackageJson(rootOriginalContent, [...rootDirectFixes, ...remainingTransitiveFixes], pm);
                 const finalResult = yield (0, javascript_1.runWorkspaceInstallInTempDir)(pm, finalRootPackageJson, {
@@ -1134,7 +1045,7 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             if (!fix.isTransitive && fix.scope) {
                 if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
                     const originalVersion = packageJson[fix.scope][fix.packageName];
-                    packageJson[fix.scope][fix.packageName] = applyVersionPrefix(originalVersion, fix.newVersion);
+                    packageJson[fix.scope][fix.packageName] = (0, version_utils_1.applyVersionPrefix)(originalVersion, fix.newVersion);
                 }
             }
         }
@@ -1154,19 +1065,24 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
             if (!fix.isTransitive && fix.scope) {
                 if (packageJson[fix.scope] && packageJson[fix.scope][fix.packageName]) {
                     const originalVersion = packageJson[fix.scope][fix.packageName];
-                    packageJson[fix.scope][fix.packageName] = applyVersionPrefix(originalVersion, fix.newVersion);
+                    packageJson[fix.scope][fix.packageName] = (0, version_utils_1.applyVersionPrefix)(originalVersion, fix.newVersion);
                 }
             }
             else if (fix.isTransitive) {
-                if (fix.fixViaDirectUpgrade) {
-                    const { directDepName, directDepVersion, directDepScope } = fix.fixViaDirectUpgrade;
-                    if ((_a = packageJson[directDepScope]) === null || _a === void 0 ? void 0 : _a[directDepName]) {
-                        const originalVersion = packageJson[directDepScope][directDepName];
-                        packageJson[directDepScope][directDepName] = applyVersionPrefix(originalVersion, directDepVersion);
-                        continue;
+                if (this.transitiveFixStrategy === 'lock-file') {
+                    continue;
+                }
+                if (fix.fixViaDirectUpgrades && fix.fixViaDirectUpgrades.length > 0) {
+                    for (const upgrade of fix.fixViaDirectUpgrades) {
+                        const { directDepName, directDepVersion, directDepScope } = upgrade;
+                        if ((_a = packageJson[directDepScope]) === null || _a === void 0 ? void 0 : _a[directDepName]) {
+                            const originalVersion = packageJson[directDepScope][directDepName];
+                            packageJson[directDepScope][directDepName] = (0, version_utils_1.applyVersionPrefix)(originalVersion, directDepVersion);
+                        }
                     }
+                    continue;
                 }
-                const directDepScope = findDirectDependencyScope(packageJson, fix.packageName);
+                const directDepScope = (0, override_utils_1.findDirectDependencyScope)(packageJson, fix.packageName);
                 if (directDepScope) {
                     const directVersion = packageJson[directDepScope][fix.packageName];
                     const directMajor = semver.major(semver.coerce(directVersion) || '0.0.0');
@@ -1182,13 +1098,13 @@ class DependencyVulnerabilityCheck extends rewrite_1.ScanningRecipe {
                         }
                         continue;
                     }
-                    packageJson[directDepScope][fix.packageName] = applyVersionPrefix(directVersion, fix.newVersion);
+                    packageJson[directDepScope][fix.packageName] = (0, version_utils_1.applyVersionPrefix)(directVersion, fix.newVersion);
                     continue;
                 }
                 const packageFixes = fixesByPackage.get(fix.packageName) || [];
                 const hasMultipleMajorVersions = packageFixes.length > 1 &&
                     new Set(packageFixes.map(f => f.originalMajorVersion)).size > 1;
-                const existingOverrides = getOverridesFromPackageJson(packageJson, packageManager);
+                const existingOverrides = (0, override_utils_1.getOverridesFromPackageJson)(packageJson, packageManager);
                 const hasExistingVersionSpecificOverrides = existingOverrides &&
                     Object.keys(existingOverrides).some(key => key.startsWith(`${fix.packageName}@`));
                 const isYarn = packageManager === "YarnClassic" ||
@@ -1262,7 +1178,7 @@ __decorate([
     (0, rewrite_1.Option)({
         displayName: "Scope",
         description: "Match dependencies with the specified scope. Default includes all scopes. " +
-            "Use 'dependencies' for production dependencies, 'devDependencies' for development only, etc.",
+            "Use `dependencies` for production dependencies, `devDependencies` for development only, etc.",
         required: false,
         example: "dependencies",
         valid: ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]
@@ -1272,20 +1188,31 @@ __decorate([
     (0, rewrite_1.Option)({
         displayName: "Transitive fix strategy",
         description: "Strategy for handling transitive dependency vulnerabilities. " +
-            "'report' only reports them without fixing. " +
-            "'override' adds overrides only for transitives not fixed by direct upgrades (runs extra npm install to verify). " +
-            "'prefer-direct-upgrade' tries to find higher direct dependency versions that fix transitives, falls back to overrides (queries npm registry). " +
-            "Default is 'report'.",
+            "`report` only reports them without fixing. " +
+            "`override` adds overrides/resolutions for transitive vulnerabilities. " +
+            "`lock-file` updates the lock file to resolve safe versions without modifying `package.json` (similar to Dependabot). " +
+            "Default is `report`.",
         required: false,
         example: "override",
-        valid: ["report", "override", "prefer-direct-upgrade"]
+        valid: ["report", "override", "lock-file"]
     })
 ], DependencyVulnerabilityCheck.prototype, "transitiveFixStrategy", void 0);
+__decorate([
+    (0, rewrite_1.Option)({
+        displayName: "Prefer direct upgrade",
+        description: "When fixing transitive vulnerabilities, first try to find higher versions of " +
+            "direct dependencies that include safe transitive versions. Falls back to the " +
+            "`transitiveFixStrategy` if no suitable direct upgrade exists. Queries npm registry. " +
+            "Default is `true`.",
+        required: false,
+        example: "false"
+    })
+], DependencyVulnerabilityCheck.prototype, "preferDirectUpgrade", void 0);
 __decorate([
     (0, rewrite_1.Option)({
         displayName: "Maximum upgrade delta",
         description: "The maximum difference to allow when upgrading a dependency version. " +
-            "Use 'none' to only report vulnerabilities without making any changes. " +
+            "Use `none` to only report vulnerabilities without making any changes. " +
             "Patch version upgrades are the default and safest option. " +
             "Minor version upgrades can introduce new features but typically no breaking changes. " +
             "Major version upgrades may require code changes.",
@@ -1298,8 +1225,8 @@ __decorate([
     (0, rewrite_1.Option)({
         displayName: "Minimum severity",
         description: "Only fix vulnerabilities with a severity level equal to or higher than the specified minimum. " +
-            "Vulnerabilities are classified as LOW, MODERATE, HIGH, or CRITICAL based on their potential impact. " +
-            "Default is LOW, which includes all severity levels.",
+            "Vulnerabilities are classified as `LOW`, `MODERATE`, `HIGH`, or `CRITICAL` based on their potential impact. " +
+            "Default is `LOW`, which includes all severity levels.",
         required: false,
         example: "MODERATE",
         valid: ["LOW", "MODERATE", "HIGH", "CRITICAL"]
@@ -1319,11 +1246,11 @@ __decorate([
 __decorate([
     (0, rewrite_1.Option)({
         displayName: "Fix declared versions",
-        description: "When enabled, also upgrades version specifiers declared in package.json that specify vulnerable versions, " +
+        description: "When enabled, also upgrades version specifiers declared in `package.json` that specify vulnerable versions, " +
             "even if the lock file already resolves to a safe version. This is a preventive measure to ensure that " +
             "future installs (e.g., on a different machine or after lock file changes) won't install vulnerable versions. " +
             "These preventive upgrades are NOT reported in the vulnerability data table since there's no actual vulnerability. " +
-            "Default is false.",
+            "Default is `false`.",
         required: false,
         example: "true"
     })
@@ -1331,49 +1258,11 @@ __decorate([
 __decorate([
     (0, rewrite_1.Option)({
         displayName: "Add override comments",
-        description: "When enabled, adds a comment field (e.g., '//overrides') alongside overrides to document which CVEs " +
+        description: "When enabled, adds a comment field (e.g., `//overrides`) alongside overrides to document which CVEs " +
             "each override is fixing. This helps with auditing and knowing when overrides can be removed. " +
-            "Default is true.",
+            "Default is `true`.",
         required: false,
         example: "true"
     })
 ], DependencyVulnerabilityCheck.prototype, "addOverrideComments", void 0);
-function extractVersionPrefix(versionString) {
-    const match = versionString.match(/^([~^]|>=?|<=?|=)?(.*)$/);
-    if (match) {
-        return {
-            prefix: match[1] || '',
-            version: match[2]
-        };
-    }
-    return { prefix: '', version: versionString };
-}
-function applyVersionPrefix(originalVersion, newVersion) {
-    const { prefix } = extractVersionPrefix(originalVersion);
-    return prefix + newVersion;
-}
-function findDirectDependencyScope(packageJson, packageName) {
-    var _a;
-    for (const scope of ALL_DEPENDENCY_SCOPES) {
-        if ((_a = packageJson[scope]) === null || _a === void 0 ? void 0 : _a[packageName]) {
-            return scope;
-        }
-    }
-    return undefined;
-}
-function getOverridesFromPackageJson(packageJson, packageManager) {
-    var _a;
-    switch (packageManager) {
-        case "Npm":
-        case "Bun":
-            return packageJson.overrides;
-        case "Pnpm":
-            return (_a = packageJson.pnpm) === null || _a === void 0 ? void 0 : _a.overrides;
-        case "YarnClassic":
-        case "YarnBerry":
-            return packageJson.resolutions;
-        default:
-            return undefined;
-    }
-}
 //# sourceMappingURL=dependency-vulnerability-check.js.map