composer-update: opt-out for constraint widening (extra.vuln-scan.no-widen)

[oxyc]

Summary

The composer-update action's two-step strategy (composer update -W, fall back to composer require -W per package) was silently widening explicitly-pinned constraints. Concrete damage seen in generoi/solarplexius after merging a vuln-scan auto-PR:

Package	Constraint before	Auto-PR set to	Reverted in
wpackagist-plugin/woocommerce	10.0.2 (exact pin)	^10.7	solarplexius#81
wpackagist-plugin/tradedoubler-affiliate-tracker	^1.1	^2.0 (major bump)	same
wpackagist-plugin/facebook-for-woocommerce	3.4.6 (exact pin)	bumped	same
wpackagist-plugin/query-monitor	^3.3	^4.0 (major bump)	same

Root cause: composer require -W <pkg> without an explicit version replaces the existing constraint with ^<latest>. The fallback was designed to widen constraints for vulns the existing range can't reach (e.g., advisory <2.0.0 + pinned ^1.5 → widen to ^2), but it does so unconditionally for every package handed to it.

Change

Read extra.vuln-scan.no-widen from the project's composer.json and skip those packages in the require fallback. composer update (step 1) still runs on them — only the constraint-widening fallback is opt-outable.

Accepts both shapes:

"extra": {
  "vuln-scan": {
    "no-widen": {
      "wpackagist-plugin/woocommerce": "License-tested only against 10.0.x",
      "wpackagist-plugin/facebook-for-woocommerce": "Pinned for custom integration code"
    }
  }
}

or plain array if you don't want to document reasons inline:

"extra": { "vuln-scan": { "no-widen": ["wpackagist-plugin/woocommerce"] } }

Map form is recommended — values are free-text and exist for in-place documentation only (the action doesn't parse them).

Test plan

• jq logic handles all three shapes: map → keys, array → values, missing → no output (default empty)
• Follow-up PRs to add extra.vuln-scan.no-widen to projects with intentionally-pinned packages (solarplexius first)
• Re-run vuln-scan on solarplexius after that lands; confirm the previously-widened packages are no longer in the auto-PR's diff
• After merge: bump v2 tag/branch to propagate

🤖 Generated with Claude Code