fix: use path-based lookup for direct parent when same package installed at multiple versions (#1051)

When the same package (e.g. eslint) is installed at multiple versions in the
dependency tree, the packagesByName Map in resolveDirectParentContext kept only
the last entry (last-write-wins). If the nested version appeared last, it
became directParentVersion, causing the candidate filter to admit versions that
are actually downgrades from the root installation (e.g. eslint@6.15.0 when
eslint@9.36.0 is installed at the root).

Fix: use findPackageAlongPath with the path prefix up to and including the
direct parent position in viaPath, falling back to the existing Map lookup.
Path-based iteration finds the specific installed instance on the finding's
dependency path rather than an arbitrary same-name package.

Regression test added for the eslint@9.36.0 / eslint@6.14.0 collision case.

Author: sonukapoor

src/remediation/parent-upgrade.ts

@@ -110,7 +110,15 @@ function resolveDirectParentContext(
   const directParentName = directParentCandidates[0];
   if (!directParentName) return null;
 
-  const directParent = findDirectDependency(packages, directParentName, directDependencyNames, packagesByName);
+  // Path-based lookup disambiguates when the same package name is installed at
+  // multiple versions (e.g. eslint@9.36.0 at root AND eslint@6.14.0 nested).
+  // A name-keyed Map (last-write-wins) would return an arbitrary version, making
+  // directParentVersion wrong and potentially producing downgrade suggestions.
+  const directParentIdx = viaPath.indexOf(directParentName);
+  const directParentPathPrefix = viaPath.slice(0, directParentIdx + 1);
+  const directParent =
+    findPackageAlongPath(packages, directParentName, directParentPathPrefix) ??
+    findDirectDependency(packages, directParentName, directDependencyNames, packagesByName);
   if (!directParent) return null;
 
   return { directParentName, immediateParentName, directParent };

tests/parent-upgrade.test.ts

@@ -1516,6 +1516,65 @@ describe("resolveRecommendedParentUpgrade", () => {
     });
     expect(result?.reason).toContain("could not be verified");
   });
+
+  it("uses the root direct-dep version, not a nested same-name installation, as the currentVersion baseline when filtering upgrade candidates", async () => {
+    // Regression test for the packagesByName Map collision on the DIRECT parent itself.
+    //
+    // Graph: project -> eslint@9.36.0 -> eslint-utils@1.4.3 (vulnerable path)
+    //        project -> some-tool -> eslint@6.14.0 (nested, unrelated path)
+    //
+    // packagesByName is built as new Map(packages.map(p => [p.name, p])).
+    // Because eslint appears twice and 6.14.0 is last in the array, the map
+    // holds eslint -> 6.14.0. findDirectDependency then returns eslint@6.14.0
+    // as the direct parent, so directParentVersion = "6.14.0". The candidate
+    // filter compareVersions(version, "6.14.0") > 0 admits eslint@6.15.0,
+    // producing a downgrade suggestion from the actually-installed 9.36.0.
+    //
+    // After the fix: path-based lookup must return eslint@9.36.0, so only
+    // candidates > 9.36.0 (i.e. eslint@10.0.0) are considered.
+    const resolveRecommendedParentUpgrade = await loadResolver();
+
+    mockPackumentsByPackage(fetchMock, {
+      eslint: {
+        versions: {
+          "6.14.0": { dependencies: { "eslint-utils": "^1.4.0" } },
+          "6.15.0": { dependencies: { "eslint-utils": "^1.4.4" } },
+          "9.36.0": { dependencies: { "eslint-utils": "^1.4.0" } },
+          "10.0.0": { dependencies: { "eslint-utils": "^1.4.4" } },
+        },
+      },
+    });
+
+    const packages: PackageRef[] = [
+      // Root eslint@9.36.0 - the actual direct dep on the finding's path.
+      { name: "eslint", version: "9.36.0", ecosystem: "npm", paths: [["project", "eslint"]] },
+      { name: "eslint-utils", version: "1.4.3", ecosystem: "npm", paths: [["project", "eslint", "eslint-utils"]] },
+      // Nested eslint@6.14.0 - appears LAST so it wins the packagesByName Map,
+      // causing findDirectDependency to return the wrong version when the bug is present.
+      { name: "eslint", version: "6.14.0", ecosystem: "npm", paths: [["project", "some-tool", "eslint"]] },
+    ];
+
+    const finding = createFinding({
+      pkg: { name: "eslint-utils", version: "1.4.3", ecosystem: "npm", paths: [["project", "eslint", "eslint-utils"]] },
+      dependencyPaths: [["project", "eslint", "eslint-utils"]],
+      firstFixedVersion: "1.4.4",
+    });
+
+    const result = await resolveRecommendedParentUpgrade(finding, packages, new Set(["eslint"]));
+
+    // Must reflect the root installation version, not the nested one.
+    expect(result?.currentVersion).toBe("9.36.0");
+    // eslint@6.15.0 is a downgrade from 9.36.0 and must never be suggested.
+    expect(result?.targetVersion).not.toBe("6.15.0");
+    // The only valid upgrade above 9.36.0 is 10.0.0.
+    expect(result).toMatchObject({
+      package: "eslint",
+      currentVersion: "9.36.0",
+      targetVersion: "10.0.0",
+      vulnerablePackage: "eslint-utils",
+      confidence: "verified",
+    });
+  });
 });
 
 describe("resolveHighestSatisfying", () => {