fix: guard ^ floor comparison against cross-major parent declarations

When the override is ^4.2.0 and a parent declares ^5.0.0, coerceVersion strips
the operator and compareVersions(5.0.0, 4.2.0) returns >= 0, causing OA009 to
fire. But ^4.2.0 means >=4.2.0 <5.0.0 and ^5.0.0 means >=5.0.0 <6.0.0 - the
ranges do not overlap, so removing the override would change the resolved
version from 4.x to 5.x. Added a majorOf() guard: when the override uses ^,
each parent must also be in the same major before it counts as meeting the
floor. Added a test case covering the cross-major non-firing case.

Author: sonukapoor

src/overrides/detectors/oa009-stale-floor.ts

@@ -5,6 +5,10 @@ import { looksLikeVersion, coerceVersion, compareVersions } from "../../utils/ve
 
 const RULE_ID = "OA009" as const;
 
+function majorOf(version: string): number {
+  return parseInt(version.split(".")[0] ?? "0", 10);
+}
+
 export function detect(ctx: OverrideContext): OverrideFinding[] {
   if (ctx.skippedDetectors.some((s) => s.ruleId === RULE_ID)) return [];
 
@@ -24,9 +28,13 @@ export function detect(ctx: OverrideContext): OverrideFinding[] {
     const parents = ctx.parentDeclarations.get(entry.packageName) ?? [];
     if (parents.length === 0) continue;
 
+    const floorMajor = pin.startsWith("^") ? majorOf(floor) : -1;
     const allParentsMeetFloor = parents.every((parent) => {
       const parentFloor = coerceVersion(parent.declaredValue);
       if (!parentFloor) return false;
+      // For ^ ranges the allowed range is [floor, nextMajor). A parent in a
+      // different major cannot overlap, so the override is not redundant.
+      if (floorMajor >= 0 && majorOf(parentFloor) !== floorMajor) return false;
       return compareVersions(parentFloor, floor) >= 0;
     });
     if (!allParentsMeetFloor) continue;

tests/overrides/detectors/oa009.test.ts

@@ -141,6 +141,16 @@ describe('OA009-STALE-FLOOR', () => {
     expect(detect(ctxOf([nested], [], []))).toEqual([]);
   });
 
+  it('does NOT fire when ^ override and parent are in different major (ranges do not overlap)', () => {
+    // Override ^4.2.0 means >=4.2.0 <5.0.0; parent ^5.0.0 means >=5.0.0 <6.0.0.
+    // Removing the override would change npm's resolution from 4.x to 5.x.
+    expect(detect(ctxOf(
+      [e('semver', '^4.2.0')],
+      [['semver', '4.6.3']],
+      [['semver', [p('some-lib', '^5.0.0')]]],
+    ))).toEqual([]);
+  });
+
   it('is conservative when parent declaredValue cannot be parsed as a version', () => {
     expect(detect(ctxOf(
       [e('js-yaml', '>=4.2.0')],