Fix combined_version to prefer higher version when merging duplicate dependencies

[Copilot]

What are you trying to accomplish?

When the same dependency appears in multiple files (e.g., requirements.txt pins urllib3==2.7.0 and constraints.txt pins urllib3==2.5.0), DependencySet#combined_version always kept the lower version. This caused the dependency graph snapshot to report the vulnerable version even after the user updated their manifest, preventing alerts from transitioning to "fixed".

The fix swaps the version preference so the higher version wins when both entries have the same top-level status:

# Before: always kept lower
elsif version_class.new(new_dep.version) > version_class.new(old_dep.version)
  old_dep.version
else
  new_dep.version
end

# After: keeps higher
elsif version_class.new(new_dep.version) > version_class.new(old_dep.version)
  new_dep.version
else
  old_dep.version
end

Anything you want to highlight for special attention from reviewers?

• The higher version is semantically correct: it represents what pip actually resolves/installs when both a requirement and a constraint exist for the same package.
• The existing precedence rules (prefer non-nil over nil, prefer top-level over transitive, prefer valid semver over git SHA) are unchanged. Only the final tiebreaker between two valid versions with the same top-level status is affected.
• This is shared common/ infrastructure, so it impacts multiple ecosystems. In this PR we updated affected expectations in Python, Maven, Gradle, GitHub Actions, and npm/yarn lockfile/parser/resolver specs.
• Blast radius note: npm/yarn file updater behavior changed in certain workspace scenarios because lockfile selection depends on merged dependency versions; specs were updated to assert the current behavior.
• Follow-up parity fix included: Bun now mirrors npm/yarn’s :all_versions flattening and subdependency lockfile filtering logic so duplicate-version lockfiles are handled consistently.

How will you know you've accomplished your goal?

• common/spec/dependabot/file_parsers/base/dependency_set_spec.rb passes with the higher-version behavior.
• Python constraint scenario reports the higher effective version in combined dependency snapshots.
• Updated ecosystem specs pass for the changed semantics (Python, Maven, Gradle, GitHub Actions, npm_and_yarn, and metadata finder).

Checklist

• I have run relevant tests for the changed files and updated expectations.
• I have written clear and descriptive commit messages.
• I have updated this PR description to reflect the actual blast radius of the shared change.

Review follow-ups

• Clarified PR blast radius: this shared DependencySet change required expectation updates across Python, Maven, Gradle, GitHub Actions, and npm/yarn specs.
• Clarified that npm/yarn workspace file updater behavior changed in specific scenarios due lockfile selection depending on merged dependency versions.
• Added Bun parity fixes to mirror npm/yarn behavior:
  • flatten nested :all_versions metadata in bun/helpers.rb
  • evaluate all candidate versions when filtering subdependency lockfiles in bun/sub_dependency_files_filterer.rb
• Updated a stale npm spec description so it matches the asserted behavior.

[Copilot]

Pull request overview

This pull request updates Dependabot’s shared DependencySet merging behavior so that when duplicate dependencies with the same top-level status are merged, the higher valid version is retained in the combined dependency’s version field. This primarily affects snapshot/reporting scenarios (e.g., dependency graph “fixed” transitions) rather than per-file update behavior.

Changes:

• Adjust DependencySet#combined_version to prefer the higher version when both versions are valid and have equal precedence.
• Update the Python file parser spec to expect the combined dependency version to reflect the higher pinned requirement when both requirement and constraint entries exist.
• Clarify the Python helper test description/comment around parsing constraint files.

Show a summary per file

File	Description
common/lib/dependabot/file_parsers/base/dependency_set.rb	Changes the final tiebreaker in combined_version so the higher version wins when merging duplicates.
python/spec/dependabot/python/file_parser_spec.rb	Updates expectations for the combined dependency version when both requirements and constraints specify versions.
python/helpers/test/test_parse_requirements.py	Updates test docstring/comment wording around constraint-file parsing behavior.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Low

[Copilot]

Review details

• Files reviewed: 14/14 changed files
• Comments generated: 3
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 17/17 changed files
• Comments generated: 1
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 18/18 changed files
• Comments generated: 0 new
• Review effort level: Low