Repository: denoland/deno
Pull request: fix(audit): respect package.json overrides in vulnerability checks

## Summary

Closes #32871

When `package.json` overrides force a transitive dependency to a patched version, `deno audit` was still reporting it as vulnerable. For example:

```json
{
  "dependencies": { "@vitest/ui": "^4.1.0" },
  "overrides": { "flatted": "3.4.2" }
}
```

The override correctly resolves `flatted` to `3.4.2` (visible in the lockfile), but `deno audit` still reported the vulnerability for `flatted < 3.4.2`.

### Root cause

The npm audit API returns advisories based on the declared dependency tree, not the resolved versions after overrides. Deno was passing all advisories through without checking if the actually-installed version falls within the vulnerable range.

### Fix

After receiving advisories from the npm audit API, filter out any where no installed version actually falls within the `vulnerable_versions` range. Uses the finding paths to identify actual package names and cross-references with the resolution snapshot.

## Test plan

- [x] Added `tests/specs/audit/overrides` spec test
- [x] All 12 audit tests pass (11 existing + 1 new)


🤖 Generated with [Claude Code](https://claude.com/claude-code)

Changed files:
filename: cli/tools/pm/audit.rs
patch: @@ -318,6 +318,49 @@ mod npm {
 
     let mut advisories = response.advisories.values().collect::<Vec<_>>();
 
+    // Filter out advisories where no installed version falls within
+    // the vulnerable range. This handles package.json overrides that
+    // force a patched version -- the npm audit API returns advisories
+    // based on the dependency tree as declared, but overrides may have
+    // resolved a non-vulnerable version.
+    {
+      // Collect all installed package versions from the snapshot.
+      let mut installed_versions: HashMap<String, Vec<deno_semver::Version>> =
+        HashMap::new();
+      for pkg in npm_resolution_snapshot.all_packages_for_every_system() {
+        installed_versions
+          .entry(pkg.id.nv.name.to_string())
+          .or_default()
+          .push(pkg.id.nv.version.clone());
+      }
+      advisories.retain(|adv| {
+        let Ok(vulnerable_range) =
+          deno_semver::VersionReq::parse_from_npm(&adv.vulnerable_versions)
+        else {
+          // Can't parse the range; keep the advisory to be safe
+          return true;
+        };
+        // Use the finding paths to identify the actual installed
+        // package name (the last segment of each path).
+        let finding_pkg_names: Vec<&str> = adv
+          .findings
+          .iter()
+          .flat_map(|f| f.paths.iter())
+          .filter_map(|p| p.rsplit('>').next().map(str::trim))
+          .collect();
+        // Check if any installed version of the affected packages
+        // falls within the vulnerable range.
+        for name in &finding_pkg_names {
+          if let Some(versions) = installed_versions.get(*name)
+            && versions.iter().any(|v| vulnerable_range.matches(v))
+          {
+            return true;
+          }
+        }
+        false
+      });
+    }
+
     // Filter out ignored CVEs
     if !audit_flags.ignore.is_empty() {
       advisories.retain(|adv| {

filename: tests/specs/audit/overrides/__test__.jsonc
patch: @@ -0,0 +1,16 @@
+{
+  // Regression test for https://github.com/denoland/deno/issues/32871
+  // Audit should respect package.json overrides: when an override
+  // forces a patched version, the advisory should be filtered out.
+  "tempDir": true,
+  "steps": [
+    {
+      "args": "install",
+      "output": "[WILDCARD]"
+    },
+    {
+      "args": "audit",
+      "output": "audit.out"
+    }
+  ]
+}

filename: tests/specs/audit/overrides/audit.out
patch: @@ -0,0 +1 @@
+No known vulnerabilities found

filename: tests/specs/audit/overrides/package.json
patch: @@ -0,0 +1,8 @@
+{
+  "dependencies": {
+    "@denotest/using-vuln": "1.0.0"
+  },
+  "overrides": {
+    "@denotest/with-vuln2": "2.0.0"
+  }
+}