fg-devkit 1.28.0 → 1.28.2

package/configs/dependency-policy.vue-workspace.json

@@ -18,7 +18,7 @@
       "@lexical/rich-text": "0.53.0",
       "@piwikpro/vue-piwik-pro": "2.0.0",
       "@sentry/vue": "11.10.0",
-      "@tanstack/vue-query": "5.105.0",
+      "@tanstack/vue-query": "5.105.1",
       "@unhead/vue": "3.4.3",
       "@vuelidate/core": "2.0.3",
       "@vuelidate/validators": "2.0.4",
@@ -44,7 +44,7 @@
       "vega-embed": "7.3.0",
       "vega-lite": "6.5.0",
       "vue-chartjs": "5.3.4",
-      "vue-quilly": "1.1.6",
+      "vue-quilly": "1.2.0",
       "vue3-touch-keyboard": "1.3.9",
       "vuex": "4.1.0"
     },
@@ -57,20 +57,20 @@
       "@storybook/addon-vitest": "10.6.5",
       "@storybook/vue3": "10.6.5",
       "@storybook/vue3-vite": "10.6.5",
-      "@tanstack/vue-query-devtools": "6.3.6",
+      "@tanstack/vue-query-devtools": "6.3.7",
       "@types/lodash-es": "4.17.12",
       "@types/node": "26.6.6",
       "@vitejs/plugin-vue": "6.0.10",
       "@vitest/browser": "5.0.5",
       "@vitest/browser-playwright": "5.0.5",
       "@vue/compiler-dom": "3.5.44",
-      "@vue/language-core": "3.3.13",
+      "@vue/language-core": "3.3.14",
       "@vue/test-utils": "2.5.1",
-      "fg-devkit": "1.27.2",
+      "fg-devkit": "1.28.1",
       "happy-dom": "21.0.4",
       "jsdom": "30.1.3",
       "randexp": "0.6.1",
-      "sass": "1.107.0",
+      "sass": "1.107.1",
       "storybook": "10.6.5",
       "vega": "6.4.0",
       "vite": "8.3.5",
@@ -87,7 +87,7 @@
     "playwright": "1.64.1",
     "tailwindcss": "4.3.3",
     "vue": "3.5.44",
-    "vue-i18n": "11.4.16",
+    "vue-i18n": "11.4.17",
     "vue-router": "5.4.0"
   },
   "overrides": {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.28.0",
+  "version": "1.28.2",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -56,11 +56,11 @@
     "@typescript-eslint/parser": "8.72.1",
     "@vitest/eslint-plugin": "1.6.28",
     "@vue/eslint-config-prettier": "10.2.0",
-    "eslint": "10.13.0",
+    "eslint": "10.14.0",
     "eslint-plugin-prettier": "5.5.7",
     "eslint-plugin-vue": "10.12.0",
     "eslint-plugin-vuejs-accessibility": "2.6.3",
-    "fallow": "3.37.0",
+    "fallow": "3.38.1",
     "git-cliff": "2.14.2",
     "lefthook": "2.2.2",
     "npm-check-updates": "23.1.1",
@@ -68,7 +68,7 @@
     "tsx": "4.23.15",
     "typescript": "5.9.3",
     "vue-eslint-parser": "10.4.1",
-    "vue-tsc": "3.3.13"
+    "vue-tsc": "3.3.14"
   },
   "scripts": {
     "fgd-ui": "pnpm --dir electron/maintainer-ui start",

package/scaffold/vue/package.json

@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@tailwindcss/vite": "4.3.3",
-    "@tanstack/vue-query": "5.105.0",
+    "@tanstack/vue-query": "5.105.1",
     "axios": "1.21.0",
     "content-disposition-header": "0.6.0",
     "date-fns": "4.4.0",
@@ -25,14 +25,14 @@
     "pinia": "4.1.0",
     "qrcode.vue": "3.11.0",
     "vue": "3.5.44",
-    "vue-i18n": "11.4.16",
+    "vue-i18n": "11.4.17",
     "vue-router": "5.4.0"
   },
   "devDependencies": {
     "@intlify/unplugin-vue-i18n": "11.2.8",
-    "@tanstack/vue-query-devtools": "6.3.6",
+    "@tanstack/vue-query-devtools": "6.3.7",
     "@types/node": "26.6.6",
-    "fg-devkit": "1.28.0",
+    "fg-devkit": "1.28.2",
     "@vitejs/plugin-vue": "6.0.10",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.15",

package/scripts/audit-override-commit.mjs

@@ -44,6 +44,7 @@ import {
   isReleaseAgeExcluded,
   isSameReleaseLine,
   normalizeAdvisories,
+  overrideKey,
   parseAuditJson,
   parseReleaseAgeExcludeEntry,
   planOverrides,
@@ -294,7 +295,7 @@ async function chooseForcedFixes(plan) {
   for (const item of plan.crossMajor) {
     const message = `${item.name} ${item.from} → ${item.to} (new major, ${ghsaList(item)}). Override?`
     if (await decide(message, 'allow-major')) {
-      overrides.push({ ...item, key: `${item.name}@>=${item.from} <${item.to}`, value: item.to, forced: true })
+      overrides.push({ ...item, key: overrideKey(item.name, item.from, item.to), value: item.to, forced: true })
     }
   }
 
@@ -449,7 +450,7 @@ function verify() {
   }
 }
 
-function printSummary({ fixedByRefresh, plan, forced, heldBack, applied, remaining, suppressions, excludeChanges }) {
+function printSummary({ fixedByRefresh, plan, forced, heldBack, applied, pruned, remaining, suppressions, excludeChanges }) {
   const suppressed = new Set(suppressions.covered.map((advisory) => advisory.ghsa))
   const unique = (items) => [...new Set(items)]
   const lines = []
@@ -471,6 +472,10 @@ function printSummary({ fixedByRefresh, plan, forced, heldBack, applied, remaini
       .filter((item) => item.forced)
       .map((item) => `${item.key} -> ${item.value} (${item.ghsas.join(', ')}${youngNote(item)})`),
   )
+  section(
+    'Override had no effect and was pruned (no parent range matched it, check pnpm-workspace.yaml by hand):',
+    pruned.map((item) => `${item.key} -> ${item.value} (${item.ghsas.join(', ')})`),
+  )
   section(
     'Bumped in package.json:',
     forced.bumps.map(
@@ -542,6 +547,7 @@ async function main() {
   let forced = { overrides: [], bumps: [] }
   let heldBack = []
   let allowed = []
+  let pruned = []
   let remaining = []
   let afterBumps
 
@@ -581,6 +587,9 @@ async function main() {
 
     // 4. Prune overrides.
     pruneOverrides()
+    const overridesAfterPrune = collectOverrides(cwd)
+    pruned = allowed.filter((item) => !(item.key in overridesAfterPrune))
+    allowed = allowed.filter((item) => item.key in overridesAfterPrune)
     remaining = allowed.length > 0 || forced.bumps.length > 0 ? audit() : afterRefresh
   }
   const afterOverrides = snapshot()
@@ -588,7 +597,7 @@ async function main() {
   // 5. Release-age excludes, 6. suppressions, 7. verify.
   const excludeChanges = pruneReleaseAgeExclude()
   const suppressions = syncSuppressions(remaining)
-  printSummary({ fixedByRefresh, plan, forced, heldBack, applied: allowed, remaining, suppressions, excludeChanges })
+  printSummary({ fixedByRefresh, plan, forced, heldBack, applied: allowed, pruned, remaining, suppressions, excludeChanges })
 
   const final = snapshot()
   const nothingChanged = !suppressionsWritten && TRACKED_FILES.every((file) => final[file] === original[file])

package/scripts/lib/audit-fix-plan.mjs

@@ -71,6 +71,38 @@ export function isSameReleaseLine(from, to) {
   return a.patch === b.patch
 }
 
+/** First version of the release line `version` belongs to: `1.0.0` for 1.4.2, `0.12.0` for 0.12.4. */
+export function releaseLineFloor(version) {
+  const parsed = parseVersion(version)
+  if (!parsed) return null
+  if (parsed.major > 0) return `${parsed.major}.0.0`
+  if (parsed.minor > 0) return `0.${parsed.minor}.0`
+  return `0.0.${parsed.patch}`
+}
+
+/** First version after the release line `version` belongs to: `2.0.0` for 1.4.2, `0.13.0` for 0.12.4. */
+export function releaseLineCeiling(version) {
+  const parsed = parseVersion(version)
+  if (!parsed) return null
+  if (parsed.major > 0) return `${parsed.major + 1}.0.0`
+  if (parsed.minor > 0) return `0.${parsed.minor + 1}.0`
+  return `0.0.${parsed.patch + 1}`
+}
+
+/**
+ * Override key for moving `from` up to `to`. pnpm applies a key when its range overlaps the
+ * range a parent requests, not the installed version, so the lower bound is the release line
+ * floor of `from`: a version lifted by an earlier override can sit outside the requested range.
+ * A prerelease keeps its own version as the lower bound, since `>=1.0.0` does not match
+ * `1.0.0-beta.1`. Across a major the key stops at the end of `from`'s release line so it
+ * never catches parents that already ask for the new major.
+ */
+export function overrideKey(name, from, to) {
+  const low = parseVersion(from)?.prerelease.length ? from : releaseLineFloor(from)
+  const high = isSameReleaseLine(from, to) ? to : releaseLineCeiling(from)
+  return `${name}@>=${low} <${high}`
+}
+
 /**
  * Lowest patched version strictly above `installed`, read from an advisory's
  * `patched_versions` (e.g. `>=1.2.2`, `>=1.1.21 <2.0.0 || >=2.1.7`).
@@ -140,8 +172,8 @@ export function normalizeAdvisories(report) {
  * Decide what to do with advisories that survived the lockfile refresh.
  *
  * For every installed vulnerable version the target is the lowest version that fixes all
- * advisories affecting it. Targets in the same release line become one override per range,
- * keyed tightly (`name@>=installed <target`) so nothing outside the vulnerable span moves.
+ * advisories affecting it. Installed versions in the same release line become one override,
+ * keyed from the release line floor (`name@>=1.0.0 <target`) so it matches the parent's range.
  *
  * @param {ReturnType<typeof normalizeAdvisories>} advisories
  * @param {{ directDependencies?: Set<string> }} [options]
@@ -205,24 +237,25 @@ export function planOverrides(advisories, { directDependencies = new Set() } = {
       .map(([installed, { target, ghsas: spanGhsas }]) => ({ low: installed, high: target, ghsas: spanGhsas }))
       .sort((a, b) => compareVersions(a.low, b.low))
 
-    const merged = []
+    const merged = new Map()
     for (const span of spans) {
-      const last = merged.at(-1)
-      if (last && compareVersions(span.low, last.high) < 0) {
+      const floor = releaseLineFloor(span.low)
+      const last = merged.get(floor)
+      if (last) {
         if (compareVersions(span.high, last.high) > 0) last.high = span.high
         for (const ghsa of span.ghsas) last.ghsas.add(ghsa)
       } else {
-        merged.push({ ...span, ghsas: new Set(span.ghsas) })
+        merged.set(floor, { ...span, ghsas: new Set(span.ghsas) })
       }
     }
 
-    for (const span of merged) {
+    for (const span of merged.values()) {
       const entry = { name, from: span.low, to: span.high, ghsas: [...span.ghsas] }
       if (!isSameReleaseLine(span.low, span.high)) {
         plan.crossMajor.push(entry)
         continue
       }
-      plan.overrides.push({ ...entry, key: `${name}@>=${span.low} <${span.high}`, value: span.high })
+      plan.overrides.push({ ...entry, key: overrideKey(name, span.low, span.high), value: span.high })
     }
   }
 
@@ -288,9 +321,73 @@ function unquoteYaml(value) {
   return text
 }
 
+/**
+ * `{ name, low, lowInclusive, high, highInclusive }` for keys like `name@>=1.0.0 <1.6.11`,
+ * `name@<=8.5.17`, `name@^1.2.0`, `name@~1.2.0` or `name@1.2.3`, else null. A null bound is open.
+ */
+function overrideKeyRange(key) {
+  const at = key.lastIndexOf('@')
+  if (at <= 0) return null
+  const range = { name: key.slice(0, at), low: null, lowInclusive: true, high: null, highInclusive: false }
+  const parts = key.slice(at + 1).trim().split(/\s+/)
+  const shorthand = parts.length === 1 && parts[0].match(/^([~^])(.+)$/)
+  if (shorthand) {
+    const version = parseVersion(shorthand[2])
+    if (!version) return null
+    range.low = shorthand[2]
+    range.high =
+      shorthand[1] === '^' ? releaseLineCeiling(shorthand[2]) : `${version.major}.${version.minor + 1}.0`
+    return range
+  }
+  for (const part of parts) {
+    const match = part.match(/^(>=|>|<=|<|=)?(.+)$/)
+    if (!match || !parseVersion(match[2])) return null
+    const operator = match[1] ?? '='
+    if (operator.startsWith('>') || operator === '=') {
+      range.low = match[2]
+      range.lowInclusive = operator !== '>'
+    }
+    if (operator.startsWith('<') || operator === '=') {
+      range.high = match[2]
+      range.highInclusive = operator !== '<'
+    }
+  }
+  return range
+}
+
+function startsBeforeEnd(start, end) {
+  if (start.low === null || end.high === null) return true
+  const order = compareVersions(start.low, end.high)
+  return order < 0 || (order === 0 && start.lowInclusive && end.highInclusive)
+}
+
+function rangesOverlap(a, b) {
+  return startsBeforeEnd(a, b) && startsBeforeEnd(b, a)
+}
+
+function rangeContains(outer, inner) {
+  const lowOrder = outer.low === null ? -1 : inner.low === null ? 1 : compareVersions(outer.low, inner.low)
+  const highOrder = outer.high === null ? -1 : inner.high === null ? 1 : compareVersions(inner.high, outer.high)
+  const lowOk = lowOrder < 0 || (lowOrder === 0 && (outer.lowInclusive || !inner.lowInclusive))
+  const highOk = highOrder < 0 || (highOrder === 0 && (outer.highInclusive || !inner.highInclusive))
+  return lowOk && highOk
+}
+
+/** How an existing key relates to `entry`: 'replaced', 'overlaps' (same package) or null. */
+function relationTo(key, value, entry) {
+  const existing = overrideKeyRange(key)
+  const next = overrideKeyRange(entry.key)
+  if (!existing || !next || existing.name !== next.name || key === entry.key) return null
+  if (!rangesOverlap(existing, next)) return null
+  const lowerTarget = parseVersion(value) && compareVersions(value, entry.value) <= 0
+  return lowerTarget && rangeContains(next, existing) ? 'replaced' : 'overlaps'
+}
+
 /**
  * Add or replace entries in the top-level `overrides:` map of pnpm-workspace.yaml,
- * keeping every other line untouched. Creates the section when missing.
+ * keeping every other line untouched. Creates the section when missing. pnpm uses the first
+ * matching key, so an older key for the same package that lies inside a new entry's range is
+ * removed, and a new entry that overlaps a key it cannot replace goes in before that key.
  *
  * @param {string} text
  * @param {{ key: string, value: string }[]} entries
@@ -314,17 +411,40 @@ export function upsertWorkspaceOverrides(text, entries) {
   while (lastContent > start && lines[lastContent] === '') lastContent -= 1
 
   const pending = new Map(entries.map((entry) => [entry.key, entry]))
+  const removed = new Set()
+  const insertBefore = new Map()
   for (let i = start + 1; i <= lastContent; i += 1) {
-    const match = lines[i].match(/^(\s+)((?:'(?:[^']|'')*'|"[^"]*"|[^:#]+)):/)
+    const match = lines[i].match(/^(\s+)((?:'(?:[^']|'')*'|"[^"]*"|[^:#]+)):\s*(.*?)\s*(?:#.*)?$/)
     if (!match) continue
     const key = unquoteYaml(match[2])
     if (pending.has(key)) {
       lines[i] = rendered(pending.get(key))
       pending.delete(key)
+      continue
+    }
+    const value = unquoteYaml(match[3])
+    if (entries.some((entry) => relationTo(key, value, entry) === 'replaced')) {
+      removed.add(i)
+      continue
+    }
+    for (const entry of entries) {
+      if (pending.has(entry.key) && relationTo(key, value, entry) === 'overlaps' && !insertBefore.has(entry.key)) {
+        insertBefore.set(entry.key, i)
+      }
     }
   }
-  lines.splice(lastContent + 1, 0, ...[...pending.values()].map(rendered))
-  return lines.join('\n')
+  const result = []
+  for (let i = 0; i < lines.length; i += 1) {
+    for (const [key, index] of insertBefore) {
+      if (index === i && pending.has(key)) {
+        result.push(rendered(pending.get(key)))
+        pending.delete(key)
+      }
+    }
+    if (!removed.has(i)) result.push(lines[i])
+    if (i === lastContent) result.push(...[...pending.values()].map(rendered))
+  }
+  return result.join('\n')
 }
 
 // ---------------------------------------------------------------------------

package/scripts/lib/audit-fix-plan.test.mjs

@@ -13,8 +13,10 @@ import {
   isSameReleaseLine,
   lowestPatchedVersion,
   normalizeAdvisories,
+  overrideKey,
   planOverrides,
   planReleaseAgeExcludePrune,
+  releaseLineFloor,
   readWorkspaceList,
   rewriteWorkspaceList,
   upsertWorkspaceOverrides,
@@ -108,23 +110,44 @@ test('planOverrides picks the lowest version that fixes every advisory, per rele
   assert.deepEqual(
     plan.overrides.map(({ key, value }) => ({ key, value })),
     [
-      { key: 'brace-expansion@>=1.1.18 <1.1.21', value: '1.1.21' },
-      { key: 'brace-expansion@>=2.1.4 <2.1.7', value: '2.1.7' },
+      { key: 'brace-expansion@>=1.0.0 <1.1.21', value: '1.1.21' },
+      { key: 'brace-expansion@>=2.0.0 <2.1.7', value: '2.1.7' },
     ],
   )
   assert.deepEqual(plan.overrides[0].ghsas.sort(), ['GHSA-1', 'GHSA-2'])
 })
 
-test('planOverrides merges overlapping spans of the same package', () => {
+test('planOverrides merges installed versions of the same release line', () => {
   const plan = planOverrides([
     advisory({ name: 'x', ghsa: 'GHSA-1', vulnerable: '<1.4.0', patched: '>=1.4.0', versions: ['1.2.0', '1.3.0'] }),
   ])
   assert.deepEqual(
     plan.overrides.map(({ key, value }) => ({ key, value })),
-    [{ key: 'x@>=1.2.0 <1.4.0', value: '1.4.0' }],
+    [{ key: 'x@>=1.0.0 <1.4.0', value: '1.4.0' }],
   )
 })
 
+test('planOverrides keys from the release line floor so a version lifted by an earlier override still matches', () => {
+  const plan = planOverrides([
+    advisory({ name: 'seroval', ghsa: 'GHSA-1', vulnerable: '<1.6.11', patched: '>=1.6.11', versions: ['1.6.3'] }),
+    advisory({ name: 'old', ghsa: 'GHSA-2', vulnerable: '<0.12.5', patched: '>=0.12.5', versions: ['0.12.4'] }),
+  ])
+  assert.deepEqual(
+    plan.overrides.map(({ key, value }) => ({ key, value })),
+    [
+      { key: 'seroval@>=1.0.0 <1.6.11', value: '1.6.11' },
+      { key: 'old@>=0.12.0 <0.12.5', value: '0.12.5' },
+    ],
+  )
+})
+
+test('releaseLineFloor follows caret semantics', () => {
+  assert.equal(releaseLineFloor('1.6.3'), '1.0.0')
+  assert.equal(releaseLineFloor('0.12.4'), '0.12.0')
+  assert.equal(releaseLineFloor('0.0.3'), '0.0.3')
+  assert.equal(releaseLineFloor('nope'), null)
+})
+
 test('planOverrides reports instead of overriding when it would be unsafe or useless', () => {
   const plan = planOverrides(
     [
@@ -245,6 +268,88 @@ test('upsertWorkspaceOverrides replaces matching keys and appends new ones in pl
   )
 })
 
+test('upsertWorkspaceOverrides removes older overlapping keys of the same package', () => {
+  const text = [
+    'overrides:',
+    "  'seroval@>=1.5.6 <1.6.3': '1.6.3'",
+    "  'seroval@>=2.0.0 <2.0.4': '2.0.4'",
+    "  'uuid@>=8.3.2 <11.1.1': '11.1.1'",
+    '  lodash: 4.18.1',
+    '',
+  ].join('\n')
+  const result = upsertWorkspaceOverrides(text, [{ key: 'seroval@>=1.0.0 <1.6.11', value: '1.6.11' }])
+  assert.equal(
+    result,
+    [
+      'overrides:',
+      "  'seroval@>=2.0.0 <2.0.4': '2.0.4'",
+      "  'uuid@>=8.3.2 <11.1.1': '11.1.1'",
+      '  lodash: 4.18.1',
+      "  'seroval@>=1.0.0 <1.6.11': '1.6.11'",
+      '',
+    ].join('\n'),
+  )
+})
+
+test('upsertWorkspaceOverrides puts a new key before an overlapping key it cannot replace', () => {
+  const text = "overrides:\n  lodash: 4.18.1\n  'seroval@<1.6.3': '1.6.3'\n  'uuid@<11.1.1': '11.1.1'\n"
+  const result = upsertWorkspaceOverrides(text, [{ key: 'seroval@>=1.0.0 <1.6.11', value: '1.6.11' }])
+  assert.equal(
+    result,
+    "overrides:\n  lodash: 4.18.1\n  'seroval@>=1.0.0 <1.6.11': '1.6.11'\n  'seroval@<1.6.3': '1.6.3'\n  'uuid@<11.1.1': '11.1.1'\n",
+  )
+})
+
+test('upsertWorkspaceOverrides keeps a forced cross-major key when a newer major gets its own key', () => {
+  const text = "overrides:\n  'x@>=1.0.0 <2.0.0': '2.0.3'\n"
+  const result = upsertWorkspaceOverrides(text, [{ key: 'x@>=2.0.0 <2.1.7', value: '2.1.7' }])
+  assert.equal(result, "overrides:\n  'x@>=1.0.0 <2.0.0': '2.0.3'\n  'x@>=2.0.0 <2.1.7': '2.1.7'\n")
+})
+
+test('upsertWorkspaceOverrides reads <=, >, caret, tilde and exact keys', () => {
+  const text = [
+    'overrides:',
+    "  'x@<=0.9.0': '0.9.1'",
+    "  'x@>1.0.0 <=1.6.2': '1.6.3'",
+    "  'x@~1.5.4': '1.5.9'",
+    "  'x@1.5.6': '1.6.3'",
+    "  'x@^1.5.0': '1.6.3'",
+    "  'x@>=1.6.11': '1.7.0'",
+    '  postcss@<=8.5.17: ^8.5.18',
+    '',
+  ].join('\n')
+  const result = upsertWorkspaceOverrides(text, [
+    { key: 'x@>=1.0.0 <1.6.11', value: '1.6.11' },
+    { key: 'postcss@>=8.0.0 <8.5.20', value: '8.5.20' },
+  ])
+  assert.equal(
+    result,
+    [
+      'overrides:',
+      "  'x@<=0.9.0': '0.9.1'",
+      "  'x@>=1.0.0 <1.6.11': '1.6.11'",
+      "  'x@^1.5.0': '1.6.3'",
+      "  'x@>=1.6.11': '1.7.0'",
+      "  'postcss@>=8.0.0 <8.5.20': '8.5.20'",
+      '  postcss@<=8.5.17: ^8.5.18',
+      '',
+    ].join('\n'),
+  )
+})
+
+test('upsertWorkspaceOverrides treats touching inclusive bounds as overlapping', () => {
+  const text = "overrides:\n  'x@<=1.6.11': '1.6.11'\n  'x@<1.0.0': '0.9.9'\n"
+  const result = upsertWorkspaceOverrides(text, [{ key: 'x@>=1.6.11 <1.7.2', value: '1.7.2' }])
+  assert.equal(result, "overrides:\n  'x@>=1.6.11 <1.7.2': '1.7.2'\n  'x@<=1.6.11': '1.6.11'\n  'x@<1.0.0': '0.9.9'\n")
+})
+
+test('overrideKey keeps prereleases and stops forced keys at the end of the release line', () => {
+  assert.equal(overrideKey('x', '1.6.3', '1.6.11'), 'x@>=1.0.0 <1.6.11')
+  assert.equal(overrideKey('x', '0.4.0-alpha.5', '0.4.1'), 'x@>=0.4.0-alpha.5 <0.4.1')
+  assert.equal(overrideKey('x', '1.1.18', '2.0.3'), 'x@>=1.0.0 <2.0.0')
+  assert.equal(overrideKey('@scope/x', '0.12.4', '1.0.0'), '@scope/x@>=0.12.0 <0.13.0')
+})
+
 test('diffLockfileVersions reports changed resolutions across lockfile documents', () => {
   const before = [
     '---',

package/scripts/lib/override-changes.mjs

@@ -80,7 +80,23 @@ export function collectOverrideChanges(before, after) {
       changed.push({ key, name: getOverridePackageName(key), from, to })
     }
   }
-  return changed
+  return mergeReplacedKeys(changed)
+}
+
+/** A key swapped for a new one of the same package (old range removed, new range added) is one change. */
+function mergeReplacedKeys(changed) {
+  const merged = []
+  for (const item of changed) {
+    const sameName = changed.filter((other) => other.name === item.name)
+    const added = sameName.filter((other) => other.to !== undefined)
+    const removed = sameName.filter((other) => other.to === undefined)
+    if (added.length !== 1 || removed.length === 0) {
+      merged.push(item)
+    } else if (item === added[0]) {
+      merged.push({ ...item, from: item.from ?? removed[0].from })
+    }
+  }
+  return merged
 }
 
 export function formatOverrideValue(value) {

package/scripts/lib/override-changes.test.mjs

@@ -0,0 +1,27 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { buildOverrideCommitMessage, collectOverrideChanges } from './override-changes.mjs'
+
+test('a replaced key of the same package is one change', () => {
+  const changed = collectOverrideChanges(
+    { 'seroval@>=1.5.6 <1.6.3': '1.6.3', 'uuid@<11.1.1': '11.1.1' },
+    { 'seroval@>=1.0.0 <1.6.11': '1.6.11', 'uuid@<11.1.1': '11.1.1' },
+  )
+  assert.deepEqual(changed, [{ key: 'seroval@>=1.0.0 <1.6.11', name: 'seroval', from: '1.6.3', to: '1.6.11' }])
+  assert.deepEqual(buildOverrideCommitMessage(changed), { subject: 'vuln(seroval): override 1.6.11', body: '' })
+})
+
+test('separate packages and pruned keys stay separate changes', () => {
+  const changed = collectOverrideChanges(
+    { 'a@<1.0.1': '1.0.1', 'b@<2.0.1': '2.0.1' },
+    { 'b@<2.0.1': '2.0.1', 'c@<3.0.1': '3.0.1' },
+  )
+  assert.deepEqual(
+    changed.map(({ name, from, to }) => ({ name, from, to })),
+    [
+      { name: 'a', from: '1.0.1', to: undefined },
+      { name: 'c', from: undefined, to: '3.0.1' },
+    ],
+  )
+})