Error handling of security updates for conflicting target dependencies

[thavaahariharangit]

What are you trying to accomplish?

If the vulnerable dependency versions required via transitive dependency. then the update is not possible.

package-b current version "1.1.0" and it is vulnerable
it's lowest non vulnerable version is "1.2.0"

But package-a (1.2.0) requires package-c(1.2.0)
and the package-c(1.2.0) requires package-b(1.1.0)
In this scenario package-b cannot be updated.

We need to throw an error transitive_update_not_possible in this scenario
And logs should be updated with the expanation.

Anything you want to highlight for special attention from reviewers?

Current functionality can be found in this workflow

Root cause of the problem

Lowest non vulnerable version 0.1.12 ( @vulnerable_version_strings=["< 0.1.12"]) but the current version 0.1.7 and it is vulnerable.

But we cannot update this([email protected]) as this is required by [email protected] via a transitive dependency.

After this PR changes logs look like this

updater | 2025/02/19 10:16:24 INFO The latest possible version that can be installed is 0.1.7 because of the following conflicting dependency:
updater | 
updater |   @mocks-server/[email protected] requires [email protected] via a transitive dependency on [email protected]
updater | 2025/02/19 10:16:24 INFO The earliest fixed version is 0.1.12.
{"data":{"error-type":"transitive_update_not_possible","error-details":{"conflicting-dependencies":[{"explanation":"@mocks-server/[email protected] requires [email protected] via a transitive dependency on [email protected]","name":"express","requirement":"0.1.7","version":"4.21.2"}],"dependency-name":"path-to-regexp","latest-resolvable-version":"0.1.7","lowest-non-vulnerable-version":"0.1.12"}},"type":"record_update_job_error"}


...

updater | Dependabot encountered '1' error(s) during execution, please check the logs for more details.
updater | +--------------------------------+
updater | |             Errors             |
updater | +--------------------------------+
updater | | transitive_update_not_possible |
updater | +--------------------------------+

How will you know you've accomplished your goal?

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.