fix: prefer closest fix

Author: danielroe

server/utils/dependency-analysis.ts

@@ -182,8 +182,8 @@ function parseRangeIntervals(range: OsvRange): Array<{ introduced: string; fixed
 
 /**
  * Extract the fixed version for a specific package version from vulnerability data.
- * Finds the interval that contains the current version and returns its fixed version
- * Finds the interval that contains the current version and returns its fixed version.
+ * Finds all intervals that contain the current version and returns the closest fix,
+ * preferring a nearby backport over a distant major-version bump.
  * @see https://ossf.github.io/osv-schema/#affectedrangesevents-fields
  */
 function getFixedVersion(
@@ -198,7 +198,9 @@ function getFixedVersion(
     a => a.package.ecosystem === 'npm' && a.package.name === packageName,
   )
 
-  // Check each entry's ranges to find the interval that contains the current version
+  // Collect all matching fixed versions across all ranges
+  const matchingFixedVersions: string[] = []
+
   for (const entry of packageAffectedEntries) {
     if (!entry.ranges) continue
 
@@ -213,7 +215,7 @@ function getFixedVersion(
           const afterIntro = semver.gte(currentVersion, introVersion)
           const beforeFixed = !interval.fixed || semver.lt(currentVersion, interval.fixed)
           if (afterIntro && beforeFixed && interval.fixed) {
-            return interval.fixed
+            matchingFixedVersions.push(interval.fixed)
           }
         } catch {
           continue
@@ -222,7 +224,11 @@ function getFixedVersion(
     }
   }
 
-  return undefined
+  if (matchingFixedVersions.length === 0) return undefined
+  if (matchingFixedVersions.length === 1) return matchingFixedVersions[0]
+
+  // Return the lowest (closest) fixed version — the smallest bump from the current version
+  return matchingFixedVersions.sort(semver.compare)[0]
 }
 
 function getSeverityLevel(vuln: OsvVulnerability): OsvSeverityLevel {

test/unit/server/utils/dependency-analysis.spec.ts

@@ -783,6 +783,74 @@ describe('dependency-analysis', () => {
       expect(result.vulnerablePackages[0]?.vulnerabilities[0]?.fixedIn).toBe('1.6.0')
     })
 
+    it('suggests closest fixedIn when multiple ranges match (backport fix preferred)', async () => {
+      const mockResolved = new Map([
+        [
+          'example@3.4.6',
+          {
+            name: 'example',
+            version: '3.4.6',
+            size: 1000,
+            optional: false,
+            depth: 'root' as const,
+            path: ['example@3.4.6'],
+          },
+        ],
+      ])
+      vi.mocked(resolveDependencyTree).mockResolvedValue(mockResolved)
+
+      // Two affected ranges:
+      //   Range 1 (broad): >= 3.4.5-foo.2, < 3.5.9-foo.15 (fix: 3.5.9-foo.15)
+      //   Range 2 (narrow backport): >= 3.4.5-foo.2, < 3.4.8 (fix: 3.4.8)
+      //
+      // Version 3.4.6 falls in BOTH ranges.
+      // The broad range is listed first, so the current early-return picks 3.5.9-foo.15.
+      // But 3.4.8 is the closer/more appropriate fix for someone on 3.4.x.
+      mockOsvApi(
+        [{ vulns: [{ id: 'GHSA-backport', modified: '2024-01-01' }] }],
+        new Map([
+          [
+            'example@3.4.6',
+            {
+              vulns: [
+                {
+                  id: 'GHSA-backport',
+                  summary: 'Vulnerability with backported fix',
+                  database_specific: { severity: 'HIGH' },
+                  affected: [
+                    {
+                      package: { ecosystem: 'npm', name: 'example' },
+                      ranges: [
+                        {
+                          type: 'SEMVER',
+                          events: [{ introduced: '3.4.5-foo.2' }, { fixed: '3.5.9-foo.15' }],
+                        },
+                      ],
+                    },
+                    {
+                      package: { ecosystem: 'npm', name: 'example' },
+                      ranges: [
+                        {
+                          type: 'SEMVER',
+                          events: [{ introduced: '3.4.5-foo.2' }, { fixed: '3.4.8' }],
+                        },
+                      ],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        ]),
+      )
+
+      const result = await analyzeDependencyTree('example', '3.4.6')
+
+      expect(result.vulnerablePackages).toHaveLength(1)
+      // Should suggest 3.4.8 (the closest fix), not 3.5.9-foo.15
+      expect(result.vulnerablePackages[0]?.vulnerabilities[0]?.fixedIn).toBe('3.4.8')
+    })
+
     it('returns undefined fixedIn when no matching range has a fixed version', async () => {
       const mockResolved = new Map([
         [