[BUG] If there are multiple community repositories that have the common package, version list of another package will be wrong

[Sayamame-beans]

Describe the bug

If both anatawa12's and bd_'s community repositories have been added and are shown in VCC, version list of another package will be wrong.
This is because both need and have the "nadena.dev.ndmf" ("NDMF" short for "Non-Destructive Modular Framework" ) package.

To Reproduce

1. Add community repositories which have common packages.
   This time, I use https://vpm.anatawa12.com/vpm.json and https://vpm.nadena.dev/vpm.json .
2. Open "Manage Packages" page on some project.
3. Check the package version lists.

This problem has different results depending on registration order of the community repositories.
If anatawa12's repo is earlier and bd_'s is later, "Modular Avatar" package appears to have version 1.0.2 which does not actually exist. (NDMF has version 1.0.2.)
If bd's repo is earlier and anatawa12's is later, "UdonSharp Migration Bug Fix" package appears to have version 1.0.0 and later which does not actually exist. (NDMF has version 1.0.0 and later.)

Expected behavior

All package version lists are shown correctly.

Screenshots

No response

Related Product

VCC (VRChat Creator Companion)

Product Version

2.1.5

OS

Windows 10

Additional context

In anatawa12's repo, "UdonSharp Migration Bug Fix" package is written exactly before NDMF package.
In bd_'s repo, "Modular Avatar" package is written exactly before NDMF package.

[hai-vr]

This issue also happens if the user enables multiple repo listings by the same author.
In my case, the pre-releases repo listing is a superset of bd_'s main repo listing.

Just as described in the initial bug report, this causes a package to be populated with non-existent versions numbers of a completely different package.

[orels1]

Thanks for the report. Seems like the package merging logic is misbehaving and pushing versions into the wrong versions lists

[Sayamame-beans]

Probably for the same reason, even if there is a newer version in the version list of common package, it may not be displayed.

This happens with anatawa12's repository and bd_'s prerelease repository( https://vpm.nadena.dev/vpm-prerelease.json ).
bd_'s prerelease repository has NDMF 1.3.0-rc.0 and anatawa12's repository does not, and anatawa12's is earlier and bd_'s is later in the VCC's repository order, NDMF 1.3.0-rc.0 is not shown.

VCC should merge the package lists with the same id.