Dependabot doesn't properly manage multiple versions of a npm dependency in a repo

[milind009]

While parsing the dependencies for any JS based repos using npm or yarn, dependabot-core only maintains a single version for any dependency (from the logic in this code segment:

dependabot-core/common/lib/dependabot/file_parsers/base/dependency_set.rb

Line 59 in d6930a0

def combined_dependency(old_dep, new_dep)

) even though the repo might have multiple versions of the dependency. Therefore, this allows only updating a particular version of a dependency in a repo. Although this does'nt impact much in case of regular dependency updates, it poses a challenge while updating security vulnerabilities associated with any dependency via dependabot as it is possible that if multiple versions exist for a dependency, the vulnerable version might not be recognised by dependabot and hence won't be updated. Couple of questions which i had on this are -

1. Could you explain the logic in the combined_dependency function in this code segment:

   dependabot-core/common/lib/dependabot/file_parsers/base/dependency_set.rb

   Line 59 in d6930a0

   def combined_dependency(old_dep, new_dep)

   . Is it based on some theory of how npm and yarn package managers work or is it just a custom implementation of dependabot?
2. What is the reason behind parsing and updating just a single version of any dependency? Is it the complexity of implementation for multiple version or some other known fact or point that i might be missing?

@jurre Let me know your thoughts on these!

[jeffwidman]

I clarified the title. This causes #5741 which can create confusion as seen in #4222.

There may also be some unexpected interplay with how aliased packages are handled (#1693).

[Seb33300]

I am facing the same issue, after adding both bootstrap 4 & 5 in our project, Dependabot is no longer warning about Bootstrap 4 cve.

{
    "dependencies": {
        "bootstrap": "^5.3.3",
        "bootstrap4": "npm:bootstrap@^4.2.1"
    }
}