fix: Direct dependency may upgraded to prerelease version even if pinned to stable

[chika3742]

fixes #4660

Summary

This PR fixes an issue where dependency_services report command could select a prerelease version even when the direct dependencies are constrained to stable version under certain conditions.

Condition

• foo:1.0.0 depends on baz:1.0.0
• foo:2.0.0-dev.0 depends on baz:2.0.0
• bar:1.0.0 depends on baz:1.0.0
• bar:2.0.0 depends on baz:2.0.0
• root project depends on foo:1.0.0 and bar:1.0.0

Running echo '{"target": "foo"}' | dart run ./bin/dependency_services.dart report

Previous Result

{
  "dependencies": [
    {
      "name": "bar",
      "version": "1.0.0",
      "kind": "direct",
      "source": {
        "type": "hosted",
        "description": {
          "name": "bar",
          "url": "http://localhost:$PORT",
          "sha256": "e46cfed05052e950f7ded2b9f1a368b5f3705e1aa79b0ee22e041d62d88156eb"
        }
      },
      "latest": "2.0.0",
      "constraint": "1.0.0",
      "compatible": [],
      "singleBreaking": [],
      "multiBreaking": [
        {
          "name": "bar",
          "version": "2.0.0",
          "kind": "direct",
          "source": {
            "type": "hosted",
            "description": {
              "name": "bar",
              "url": "http://localhost:$PORT",
              "sha256": "5621ac00a63b36202026258131aa189adac2cc9286196a7f82ee0f66cc9047c3"
            }
          },
          "constraintBumped": "2.0.0",
          "constraintWidened": "2.0.0",
          "constraintBumpedIfNeeded": "2.0.0",
          "previousVersion": "1.0.0",
          "previousConstraint": "1.0.0",
          "previousSource": {
            "type": "hosted",
            "description": {
              "name": "bar",
              "url": "http://localhost:$PORT",
              "sha256": "e46cfed05052e950f7ded2b9f1a368b5f3705e1aa79b0ee22e041d62d88156eb"
            }
          }
        },
        {
          "name": "foo",
          "version": "2.0.0-dev.0",
          "kind": "direct",
          "source": {
            "type": "hosted",
            "description": {
              "name": "foo",
              "url": "http://localhost:$PORT",
              "sha256": "828c6f8043a74375434d47c4bafc8f47ed3707c9ec9caafe78a2803013fc1412"
            }
          },
          "constraintBumped": "2.0.0-dev.0",
          "constraintWidened": "2.0.0-dev.0",
          "constraintBumpedIfNeeded": "2.0.0-dev.0",
          "previousVersion": "1.0.0",
          "previousConstraint": "1.0.0",
          "previousSource": {
            "type": "hosted",
            "description": {
              "name": "foo",
              "url": "http://localhost:$PORT",
              "sha256": "48a4851d3cf26e9152a94d346221669b294a26b4aa5d93290b7b3e63ce41eb3c"
            }
          }
        },
        {
          "name": "baz",
          "version": "2.0.0",
          "kind": "transitive",
          "source": {
            "type": "hosted",
            "description": {
              "name": "baz",
              "url": "http://localhost:$PORT",
              "sha256": "5b64d7130324b8591ab1b3c5091b4df7a68528a3493ac67b644e49df7486bd28"
            }
          },
          "constraintBumped": null,
          "constraintWidened": null,
          "constraintBumpedIfNeeded": null,
          "previousVersion": "1.0.0",
          "previousConstraint": null,
          "previousSource": {
            "type": "hosted",
            "description": {
              "name": "baz",
              "url": "http://localhost:$PORT",
              "sha256": "a7efc9c78968fdb7a7eed37efa3d53caf8b0eef7921b512f581966733cc9fc46"
            }
          }
        }
      ]
    },
    {
      "name": "baz",
      "version": "1.0.0",
      "kind": "transitive",
      "source": {
        "type": "hosted",
        "description": {
          "name": "baz",
          "url": "http://localhost:$PORT",
          "sha256": "a7efc9c78968fdb7a7eed37efa3d53caf8b0eef7921b512f581966733cc9fc46"
        }
      },
      "latest": "2.0.0",
      "constraint": null,
      "compatible": [],
      "singleBreaking": [],
      "multiBreaking": []
    },
    {
      "name": "foo",
      "version": "1.0.0",
      "kind": "direct",
      "source": {
        "type": "hosted",
        "description": {
          "name": "foo",
          "url": "http://localhost:$PORT",
          "sha256": "48a4851d3cf26e9152a94d346221669b294a26b4aa5d93290b7b3e63ce41eb3c"
        }
      },
      "latest": "1.0.0",
      "constraint": "1.0.0",
      "compatible": [],
      "singleBreaking": [],
      "multiBreaking": [
        {
          "name": "foo",
          "version": "2.0.0-dev.0",
          "kind": "direct",
          "source": {
            "type": "hosted",
            "description": {
              "name": "foo",
              "url": "http://localhost:$PORT",
              "sha256": "828c6f8043a74375434d47c4bafc8f47ed3707c9ec9caafe78a2803013fc1412"
            }
          },
          "constraintBumped": "2.0.0-dev.0",
          "constraintWidened": "2.0.0-dev.0",
          "constraintBumpedIfNeeded": "2.0.0-dev.0",
          "previousVersion": "1.0.0",
          "previousConstraint": "1.0.0",
          "previousSource": {
            "type": "hosted",
            "description": {
              "name": "foo",
              "url": "http://localhost:$PORT",
              "sha256": "48a4851d3cf26e9152a94d346221669b294a26b4aa5d93290b7b3e63ce41eb3c"
            }
          }
        },
        {
          "name": "bar",
          "version": "2.0.0",
          "kind": "direct",
          "source": {
            "type": "hosted",
            "description": {
              "name": "bar",
              "url": "http://localhost:$PORT",
              "sha256": "5621ac00a63b36202026258131aa189adac2cc9286196a7f82ee0f66cc9047c3"
            }
          },
          "constraintBumped": "2.0.0",
          "constraintWidened": "2.0.0",
          "constraintBumpedIfNeeded": "2.0.0",
          "previousVersion": "1.0.0",
          "previousConstraint": "1.0.0",
          "previousSource": {
            "type": "hosted",
            "description": {
              "name": "bar",
              "url": "http://localhost:$PORT",
              "sha256": "e46cfed05052e950f7ded2b9f1a368b5f3705e1aa79b0ee22e041d62d88156eb"
            }
          }
        },
        {
          "name": "baz",
          "version": "2.0.0",
          "kind": "transitive",
          "source": {
            "type": "hosted",
            "description": {
              "name": "baz",
              "url": "http://localhost:$PORT",
              "sha256": "5b64d7130324b8591ab1b3c5091b4df7a68528a3493ac67b644e49df7486bd28"
            }
          },
          "constraintBumped": null,
          "constraintWidened": null,
          "constraintBumpedIfNeeded": null,
          "previousVersion": "1.0.0",
          "previousConstraint": null,
          "previousSource": {
            "type": "hosted",
            "description": {
              "name": "baz",
              "url": "http://localhost:$PORT",
              "sha256": "a7efc9c78968fdb7a7eed37efa3d53caf8b0eef7921b512f581966733cc9fc46"
            }
          }
        }
      ]
    }
  ]
}

New result

{
  "dependencies": [
    {
      "name": "bar",
      "version": "1.0.0",
      "kind": "direct",
      "source": {
        "type": "hosted",
        "description": {
          "name": "bar",
          "url": "http://localhost:$PORT",
          "sha256": "e46cfed05052e950f7ded2b9f1a368b5f3705e1aa79b0ee22e041d62d88156eb"
        }
      },
      "latest": "2.0.0",
      "constraint": "1.0.0",
      "compatible": [],
      "singleBreaking": [],
      "multiBreaking": []
    },
    {
      "name": "baz",
      "version": "1.0.0",
      "kind": "transitive",
      "source": {
        "type": "hosted",
        "description": {
          "name": "baz",
          "url": "http://localhost:$PORT",
          "sha256": "a7efc9c78968fdb7a7eed37efa3d53caf8b0eef7921b512f581966733cc9fc46"
        }
      },
      "latest": "2.0.0",
      "constraint": null,
      "compatible": [],
      "singleBreaking": [],
      "multiBreaking": []
    },
    {
      "name": "foo",
      "version": "1.0.0",
      "kind": "direct",
      "source": {
        "type": "hosted",
        "description": {
          "name": "foo",
          "url": "http://localhost:$PORT",
          "sha256": "48a4851d3cf26e9152a94d346221669b294a26b4aa5d93290b7b3e63ce41eb3c"
        }
      },
      "latest": "1.0.0",
      "constraint": "1.0.0",
      "compatible": [],
      "singleBreaking": [],
      "multiBreaking": []
    }
  ]
}

---

• I’ve reviewed the contributor guide and applied the relevant portions to this PR.

Contribution guidelines:

• See our contributor guide for general expectations for PRs.
• Larger or significant changes should be discussed in an issue before creating a PR.
• Contributions to our repos should follow the Dart style guide and use dart format.
• Most changes should add an entry to the changelog and may need to rev the pubspec package version.
• Changes to packages require corresponding tests.

Note that many Dart repos have a weekly cadence for reviewing PRs - please allow for some latency before initial review feedback.