From 57a48df34ec618a500a81e721bf1ebc342efcb16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dezs=C5=91=20BICZ=C3=93?= <mxr576@users.noreply.github.com>
Date: Sun, 7 May 2023 13:12:04 +0000
Subject: [PATCH] Support advisories from multiple repositories for the same
 package (#11436)

---
 src/Composer/Repository/RepositorySet.php | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/Composer/Repository/RepositorySet.php b/src/Composer/Repository/RepositorySet.php
index 34164e453..81280b204 100644
--- a/src/Composer/Repository/RepositorySet.php
+++ b/src/Composer/Repository/RepositorySet.php
@@ -257,20 +257,18 @@ class RepositorySet
      */
     private function getSecurityAdvisoriesForConstraints(array $packageConstraintMap, bool $allowPartialAdvisories): array
     {
-        $advisories = [];
+        $repoAdvisories = [];
         foreach ($this->repositories as $repository) {
             if (!$repository instanceof AdvisoryProviderInterface || !$repository->hasSecurityAdvisories()) {
                 continue;
             }
 
-            $result = $repository->getSecurityAdvisories($packageConstraintMap, $allowPartialAdvisories);
-            foreach ($result['namesFound'] as $nameFound) {
-                unset($packageConstraintMap[$nameFound]);
-            }
-
-            $advisories = array_merge($advisories, $result['advisories']);
+            $repoAdvisories[] = $repository->getSecurityAdvisories($packageConstraintMap, $allowPartialAdvisories)['advisories'];
         }
 
+        $advisories = array_merge_recursive([], ...$repoAdvisories);
+        ksort($advisories);
+
         return $advisories;
     }