Cam Proudlock 7ddfe4d3ef Recommend the smallest upgrade that clears an advisory, not the highest ...

The rollup took the highest fix version across a component's advisories, which
is wrong whenever an advisory is patched on more than one release branch. nanoid
is fixed on both 3.3.x and 5.x, and it is transitive under a postcss range of
^3.3.11 that no 5.x release can satisfy - so the recommendation was unreachable
rather than merely large.

Per advisory the target is now the lowest fix above the version in use; per
component, the highest of those. Fixes on older branches are skipped rather than
offered as a downgrade.

2026-08-29 17:24:52 -04:00

14 KiB

Raw Blame History

View Raw