fix(composer-update): name dev-locked intermediates so the chain can move

[oxyc]

The gap

find_direct_ancestors walks from a flagged transitive up to its direct-dep ancestor and returns only that ancestor. Anything crossed on the way is traversed and thrown away — including packages locked to a dev-* reference.

Composer will not move a dev-locked package during a partial update unless it is named explicitly. So when the flagged package sits underneath one, listing only the direct dep leaves the intermediate pinned at its recorded commit, and the update fails on a conflict that names neither package.

Where it bit

maptilat. composer/composer was flagged for CVE-2026-59946. Its direct ancestor is wp-cli/wp-cli-bundle, so the scanner ran:

composer update -W composer/composer:~2.10.2 wp-cli/wp-cli-bundle

But the intermediate wp-cli/wp-cli sat on dev-main and wasn't listed, so it stayed pinned:

- wp-cli/wp-cli dev-main requires wp-cli/php-cli-tools ~0.13.0 -> found
  wp-cli/php-cli-tools[v0.13.0] but these were not loaded, likely because
  it conflicts with another require.

The scan failed on this every day for weeks with no fixable PR to offer — the widen step could never resolve. Adding wp-cli/wp-cli to the arg list fixed it immediately when done by hand (generoi/maptilat#52). This makes that automatic.

The change

update.sh precomputes the dev-locked set from composer.lock:

jq -r '((.packages // []) + (."packages-dev" // []))[]
  | select(.version | test("^dev-|-dev$")) | .name' composer.lock \
  > /tmp/composer-update-devlocked.txt

find_direct_ancestors emits any intermediate found in it. Two details that matter:

• The intermediate is not terminal. The walk continues to the direct dep, which is still needed — both must be in the arg list.
• The target is never emitted as its own ancestor. build_pkg_arg already supplies it, with its min-safe constraint attached.

Behaviour is unchanged when the file is absent or empty, so plain dependency-update runs (no vulns_json) are unaffected.

Same family as the roots/wordpress-no-content self.version case already documented in expand_args_for: the arg list has to name every package that must be free to move.

Tests

Four new assertions in lib-functions.test.sh, modelling the maptilat topology exactly:

• empty dev-locked set → ancestor only (proves existing behaviour is untouched)
• dev-locked intermediate surfaced alongside the direct ancestor
• the intermediate does not stop the BFS
• a dev-locked target is not echoed as its own ancestor

Note on the suite

composer-update/tests/run.sh reports 3 of 6 files failing both with and without this change — I verified against clean master. Those are pre-existing (jq: parse error and a vendor/composer/ClassLoader.php bootstrap failure in the semver helper tests), unrelated to this, and I have not touched them. lib-functions.test.sh passes in full.

🤖 Generated with Claude Code