npm erroneously reports no longer vulnerable with multiple versions of dependency.

[jeffwidman]

An npm project is allowed to have multiple versions of the same dependency in the tree. When parsing the dependency we consolidate the different versions using the DependencySet. This retains the lowest version of the dependency seen with the expectation that the lowest version is the oldest and most likely to be vulnerable (or at least most noteworthy to call out in the update PR).

However, we've seen this can lead to confusing states when there is a vulnerability that affects some versions of the dependency but not the lowest version. In this case Dependabot incorrectly reports that no security update is needed.

Fixing this will be a bit of a lift because dependabot-core code has a number of places that assumes there will only be one version of a dependency in the tree.

Related:

• Dependabot doesn't properly manage multiple versions of a npm dependency in a repo #4701 👈 Primary root cause
• Dependabot shows an alert which it says is no longer vulnerable.  #4222
• Security fix version for vulnerable dependencies #2389
• Issues with aliased npm packages #1693 👈 aliased packages can also result in multiple versions of a single dependency to be installed at the top level

[jeffwidman]

Related:

• [npm] Consider all installed versions when checking if a dependency is still vulnerable #5801
• [npm] fix to preserve all_versions metadata from the lockfile #5846

[jeffwidman]

Watching our internal metrics now that ☝️ are deployed indicates that the amount of errors attributed to this condition have fallen off pretty sharply so I think we can call this done.

A number of these jobs will still fail for various reasons further down the job pipeline, but they'll be reported as update_not_possible rather than "no longer vulnerable".

This is a step in the right direction though though as the "no longer vulnerable" error we were giving before was very confusing and misleading.

Many thanks to @bdragon and @mctofu for their hard work on this.