[BUG](arborist) `audit` does not always include all known vulnerabilities

[G-Rath]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When a package has multiple known vulnerabilities that match the version of the package installed, npm audit does not always show them (I currently suspect it's if those vulnerabilities have the same vulnerable_versions range).

Expected Behavior

All known & relevant vulnerabilities are shown/included in output.

Steps To Reproduce

1. npm init -y
2. npm install jquery-ui@1.12.0
3. npm audit
4. See that there is only one vulnerability shown, but there are three in the audit report that have the same vulnerable_versions range.

Environment

• npm: 7.24.2 & 8.3.0
• Node: 16.0.0
• OS: Ubuntu 18.04
• platform: Windows (WSL)

[G-Rath]

I compared this with the packages mentioned in npm/arborist#338 - if you do npm install highcharts@0.0.1, npm audit correctly shows that there are multiple relevant vulnerabilities confirming to me that this is a bug.

Here's the output log of `npm audit --json`, showing the audit report

npm verb cli [
npm verb cli   '/home/g-rath/.nodenv/versions/16.0.0/bin/node',
npm verb cli   '/home/g-rath/.nodenv/versions/16.0.0/bin/npm',
npm verb cli   'audit',
npm verb cli   '--json',
npm verb cli   '--loglevel',
npm verb cli   'silly'
npm verb cli ]
npm info using npm@7.24.2
npm info using node@v16.0.0
npm timing npm:load:whichnode Completed in 0ms
npm timing config:load:defaults Completed in 1ms
npm timing config:load:file:/home/g-rath/.nodenv/versions/16.0.0/lib/node_modules/npm/npmrc Completed in 1ms
npm timing config:load:builtin Completed in 1ms
npm timing config:load:cli Completed in 2ms
npm timing config:load:env Completed in 0ms
npm timing config:load:file:/c/Users/G-Rath/workspace/projects-scrap/npm-audit-test/.npmrc Completed in 0ms
npm timing config:load:project Completed in 1ms
npm timing config:load:file:/home/g-rath/.npmrc Completed in 1ms
npm timing config:load:user Completed in 1ms
npm timing config:load:file:/home/g-rath/.nodenv/versions/16.0.0/etc/npmrc Completed in 1ms
npm timing config:load:global Completed in 1ms
npm timing config:load:validate Completed in 0ms
npm timing config:load:credentials Completed in 0ms
npm timing config:load:setEnvs Completed in 0ms
npm timing config:load Completed in 8ms
npm timing npm:load:configload Completed in 9ms
npm timing npm:load:setTitle Completed in 0ms
npm timing npm:load:setupLog Completed in 1ms
npm timing config:load:flatten Completed in 3ms
npm timing npm:load:cleanupLog Completed in 1ms
npm timing npm:load:configScope Completed in 0ms
npm timing npm:load:projectScope Completed in 1ms
npm timing npm:load Completed in 18ms
npm timing arborist:ctor Completed in 1ms
npm sill audit bulk request {
npm sill audit   highcharts: [ '0.0.1' ],
npm sill audit   'jquery-ui': [ '1.12.0' ],
npm sill audit   underscore: [ '1.13.2' ]
npm sill audit }
npm http fetch POST 200 https://registry.npmjs.org/-/npm/v1/security/advisories/bulk 450ms
npm timing auditReport:getReport Completed in 452ms
npm sill audit report {
npm sill audit report   'jquery-ui': [
npm sill audit report     {
npm sill audit report       id: 1006727,
npm sill audit report       url: 'https://github.com/advisories/GHSA-j7qv-pgf6-hvh4',
npm sill audit report       title: 'XSS in `*Text` options of the Datepicker widget in jquery-ui',
npm sill audit report       severity: 'moderate',
npm sill audit report       vulnerable_versions: '<1.13.0'
npm sill audit report     },
npm sill audit report     {
npm sill audit report       id: 1006728,
npm sill audit report       url: 'https://github.com/advisories/GHSA-gpqq-952q-5327',
npm sill audit report       title: 'XSS in the `of` option of the `.position()` util in jquery-ui',
npm sill audit report       severity: 'moderate',
npm sill audit report       vulnerable_versions: '<1.13.0'
npm sill audit report     },
npm sill audit report     {
npm sill audit report       id: 1006729,
npm sill audit report       url: 'https://github.com/advisories/GHSA-9gj3-hwp5-pmwc',
npm sill audit report       title: 'XSS in the `altField` option of the Datepicker widget in jquery-ui',
npm sill audit report       severity: 'moderate',
npm sill audit report       vulnerable_versions: '<1.13.0'
npm sill audit report     }
npm sill audit report   ],
npm sill audit report   highcharts: [
npm sill audit report     {
npm sill audit report       id: 1006409,
npm sill audit report       url: 'https://github.com/advisories/GHSA-xmc8-cjfr-phx3',
npm sill audit report       title: 'Regular Expression Denial of Service in highcharts',
npm sill audit report       severity: 'high',
npm sill audit report       vulnerable_versions: '<6.1.0'
npm sill audit report     },
npm sill audit report     {
npm sill audit report       id: 1005225,
npm sill audit report       url: 'https://github.com/advisories/GHSA-8j65-4pcq-xq95',
npm sill audit report       title: 'Options structure open to XSS if passed unfiltered',
npm sill audit report       severity: 'high',
npm sill audit report       vulnerable_versions: '<9.0.0'
npm sill audit report     },
npm sill audit report     {
npm sill audit report       id: 1006061,
npm sill audit report       url: 'https://github.com/advisories/GHSA-gr4j-r575-g665',
npm sill audit report       title: 'Cross-Site Scripting in highcharts',
npm sill audit report       severity: 'high',
npm sill audit report       vulnerable_versions: '<7.2.2'
npm sill audit report     }
npm sill audit report   ]
npm sill audit report }
npm timing metavuln:cache:get:security-advisory:highcharts:i7D/zSVMg1KapE8ZSaZ5EXBnhyuQNNpDKz4UZyq77lnWVvPQcX3d3XvGygvpS5kxfoBtu0WtlfSLkxc8B8ZBiA== Completed in 6ms
npm timing metavuln:cache:get:security-advisory:jquery-ui:Jm9mUp502MHbDZ7S8pDmX8NooY7S9Q29pGKDuhPNSiKZglKYfQlboe0OE9Li1YUKU1zj4vN8HT+rSRwwubhGxQ== Completed in 8ms
npm timing metavuln:cache:get:security-advisory:highcharts:PCJ+5TJGP2xL1CAZMfOPMiQ/TwiiUua0BCtavpnwssEiRo6Y5sj9bcubo9ZtEVwEU6ItO6lZmn6u40I9PAesVA== Completed in 6ms
npm timing metavuln:cache:get:security-advisory:jquery-ui:fep+AcbF/SfRK2Amu2J6sxa5UFSWm5om6n9nqccdpTgojcMaCt52QRWAu+tNT04wIk0FGeh9i2a9z3EOpWtjqQ== Completed in 7ms
npm timing metavuln:cache:get:security-advisory:highcharts:YFxQqr9sjQUUS9GJz5LwYY2OJkgFL9o2fJGWoFrbxml3WMSTSvuWfOuEqj2A1XhgAcFiukENZ4vGswuOMSLXEA== Completed in 8ms
npm timing metavuln:cache:get:security-advisory:jquery-ui:vb7w2qQCnWXLjNoQfVXW/P0wP4kYFVZsTI4QeRCKsTR8ymRsUThz0rvw+zDCe3tG5euKZbdAFuR2n96dzDcw/Q== Completed in 8ms
npm http fetch GET 200 https://registry.npmjs.org/highcharts 19ms (cache hit)
npm timing metavuln:packument:highcharts Completed in 20ms
npm timing metavuln:load:security-advisory:highcharts:1006409 Completed in 0ms
npm timing metavuln:calculate:security-advisory:highcharts:1006409 Completed in 21ms
npm timing metavuln:load:security-advisory:highcharts:1005225 Completed in 0ms
npm timing metavuln:calculate:security-advisory:highcharts:1005225 Completed in 21ms
npm timing metavuln:load:security-advisory:highcharts:1006061 Completed in 1ms
npm timing metavuln:calculate:security-advisory:highcharts:1006061 Completed in 22ms
npm http fetch GET 200 https://registry.npmjs.org/jquery-ui 23ms (cache hit)
npm timing metavuln:packument:jquery-ui Completed in 24ms
npm timing metavuln:load:security-advisory:jquery-ui:1006727 Completed in 0ms
npm timing metavuln:calculate:security-advisory:jquery-ui:1006727 Completed in 25ms
npm timing metavuln:load:security-advisory:jquery-ui:1006728 Completed in 0ms
npm timing metavuln:calculate:security-advisory:jquery-ui:1006728 Completed in 24ms
npm timing metavuln:load:security-advisory:jquery-ui:1006729 Completed in 0ms
npm timing metavuln:calculate:security-advisory:jquery-ui:1006729 Completed in 24ms
npm timing auditReport:init Completed in 31ms
npm timing audit Completed in 507ms
{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "highcharts": {
      "name": "highcharts",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1005225,
          "name": "highcharts",
          "dependency": "highcharts",
          "title": "Options structure open to XSS if passed unfiltered",
          "url": "https://github.com/advisories/GHSA-8j65-4pcq-xq95",
          "severity": "high",
          "range": "<9.0.0"
        },
        {
          "source": 1006061,
          "name": "highcharts",
          "dependency": "highcharts",
          "title": "Cross-Site Scripting in highcharts",
          "url": "https://github.com/advisories/GHSA-gr4j-r575-g665",
          "severity": "high",
          "range": "<7.2.2"
        },
        {
          "source": 1006409,
          "name": "highcharts",
          "dependency": "highcharts",
          "title": "Regular Expression Denial of Service in highcharts",
          "url": "https://github.com/advisories/GHSA-xmc8-cjfr-phx3",
          "severity": "high",
          "range": "<6.1.0"
        }
      ],
      "effects": [],
      "range": "<=8.2.2",
      "nodes": [
        "node_modules/highcharts"
      ],
      "fixAvailable": {
        "name": "highcharts",
        "version": "9.3.2",
        "isSemVerMajor": true
      }
    },
    "jquery-ui": {
      "name": "jquery-ui",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1006727,
          "name": "jquery-ui",
          "dependency": "jquery-ui",
          "title": "XSS in `*Text` options of the Datepicker widget in jquery-ui",
          "url": "https://github.com/advisories/GHSA-j7qv-pgf6-hvh4",
          "severity": "moderate",
          "range": "<1.13.0"
        }
      ],
      "effects": [],
      "range": "<1.13.0",
      "nodes": [
        "node_modules/jquery-ui"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 1,
      "high": 1,
      "critical": 0,
      "total": 2
    },
    "dependencies": {
      "prod": 3,
      "dev": 1,
      "optional": 0,
      "peer": 0,
      "peerOptional": 0,
      "total": 3
    }
  }
}
npm timing command:audit Completed in 512ms
npm verb exit 0
npm timing npm Completed in 746ms
npm verb code 1