The floor probe misses advisories introduced after the constraint floor.
zaojun now also probes the newest release the spec allows — what a fresh
resolution would install — via a pure selection helper over the releases
map (prereleases excluded unless the spec opts in; unparseable keys
skipped). Probes are deduplicated by parsed version, so ~=2.3 and a
2.3.0 map entry fetch once; advisories union deduped by ID. Probe
selection ignores --min-age: it picks advisories, not updates. The known
limitation shrinks to vulnerable mid-range islands; full closure would
need OSV range data. Closes #42

@@ -157,0 +202,4 @@
+            cache=mock_cache,
+            releases_map={"2.3.0": None},
+        )
+    assert [advisory.id for advisory in result] == ["PYSEC-2026-3849"]

@@ -16,3 +16,3 @@
 `zaojun` is a command-line (CLI) tool to check versions of your dependencies as defined in `pyproject.toml` against the latest versions published on [PyPI](https://pypi.org). Full documentation is available at [zaojun.marvin8.zone](https://zaojun.marvin8.zone/latest/).
 
-**New in v1.8.0**: Constraint-range advisory scanning — zaojun checks the oldest version your constraint allows, not just the newest release. When that floor has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. One extra cached HTTP request per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.
+**New in v1.8.0**: Constraint-range advisory scanning — zaojun checks the oldest and newest versions your constraint allows, not just the latest release. When either has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. Up to two extra cached HTTP requests per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.

@@ -5,3 +5,3 @@
 zaojun 1.7.5
 
-- Constraint-range advisory scanning: zaojun now also checks the oldest version each constraint allows — 🚨 warns when that floor is known to be affected by vulnerabilities, and suggests a floor that clears them
+- Constraint-range advisory scanning: zaojun now also checks the oldest and newest versions each constraint allows — 🚨 warns when either is known to be affected by vulnerabilities, and suggests a floor that clears them

@@ -173,0 +169,4 @@
+`~=X.Y`), and — when the release history is available — the newest release the
+constraint allows, which is what a fresh resolution would install. Exclusive-bound and
+wildcard shapes (`>2.3`, `==2.3.*`, `<2.0`) have no inclusive lower bound to probe, but
+their newest allowed release is still scanned.

@@ -16,3 +16,3 @@
 `zaojun` is a command-line (CLI) tool to check versions of your dependencies as defined in `pyproject.toml` against the latest versions published on [PyPI](https://pypi.org). Full documentation is available at [zaojun.marvin8.zone](https://zaojun.marvin8.zone/latest/).
 
-**New in v1.8.0**: Constraint-range advisory scanning — zaojun checks the oldest version your constraint allows, not just the newest release. When that floor has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. One extra cached HTTP request per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.
+**New in v1.8.0**: Constraint-range advisory scanning — zaojun checks the oldest version (when the constraint has an inclusive lower bound) and the newest version it allows, not just the latest release. When either has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. Up to two extra cached HTTP requests per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.

@@ -11,3 +11,3 @@
 ---
 
-zaojun's vulnerability feed only looked at the newest release on PyPI, so a constraint like `~=2.3` could look fully up to date while still admitting versions with six known advisories. zaojun now fetches the advisory list for each constraint's lower bound as well. Anything the floor is known to be affected by shows up as a 🚨 warning inline plus an "Advisories in declared range" section, with a suggested floor that clears every fixable advisory — the exact gap that hid the httpx2 advisories from library-mode runs. (Advisories introduced after the floor are out of scope for this scan.) Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.
+zaojun's vulnerability feed only looked at the newest release on PyPI, so a constraint like `~=2.3` could look fully up to date while still admitting versions with six known advisories. zaojun now fetches the advisory list for each constraint's lower bound and its newest allowed release as well. Anything either probe is known to be affected by shows up as a 🚨 warning inline plus an "Advisories in declared range" section, with a suggested floor that clears every fixable advisory — the exact gap that hid the httpx2 advisories from library-mode runs. (Vulnerable ranges that open and close entirely below the newest allowed release remain out of scope.) Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.

@@ -173,0 +168,4 @@
+JSON endpoint: the constraint's *inclusive lower bound* (`>=X.Y`, exact `==X.Y.Z`,
+`~=X.Y`), and — when the release history is available — the newest release the
+constraint allows, which is what a fresh resolution would install. Exclusive-bound and
+wildcard shapes (`>2.3`, `==2.3.*`, `<2.0`) have no inclusive lower bound to probe, but

@@ -215,6 +215,7 @@ async def check_dependency(  # noqa: PLR0913, PLR0917
             client=client,
             cache=cache,
             index_url=index_url,
+            releases_map=pypi_data.releases_map,

@@ -19,3 +19,3 @@
     "link": "https://osv.dev/vulnerability/PYSEC-2026-3849",
 }
-_VERSION_RESPONSE = {
+_ADVISORY_FLOOR = {

@@ -157,0 +209,4 @@
+
+async def test_upper_bound_only_spec_probes_newest_allowed(httpx2_mock, mock_cache):
+    """Without a floor, the newest allowed version is still probed."""
+    httpx2_mock.route(url="https://pypi.org/pypi/mypackage/1.9.0/json").respond(json=_VERSION_RESPONSE_NEWEST)

@@ -5,3 +5,3 @@
 zaojun 1.7.5
 
-- Constraint-range advisory scanning: zaojun now also checks the oldest version each constraint allows — 🚨 warns when that floor is known to be affected by vulnerabilities, and suggests a floor that clears them
+- Constraint-range advisory scanning: zaojun now also checks the oldest and newest versions each constraint allows — 🚨 warns when either is known to be affected by vulnerabilities, and suggests a floor that clears them

@@ -11,3 +11,3 @@
 ---
 
-zaojun's vulnerability feed only looked at the newest release on PyPI, so a constraint like `~=2.3` could look fully up to date while still admitting versions with six known advisories. zaojun now fetches the advisory list for each constraint's lower bound as well. Anything the floor is known to be affected by shows up as a 🚨 warning inline plus an "Advisories in declared range" section, with a suggested floor that clears every fixable advisory — the exact gap that hid the httpx2 advisories from library-mode runs. (Advisories introduced after the floor are out of scope for this scan.) Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.
+zaojun's vulnerability feed only looked at the newest release on PyPI, so a constraint like `~=2.3` could look fully up to date while still admitting versions with six known advisories. zaojun now fetches the advisory list for each constraint's lower bound and its newest allowed release as well. Anything either probe is known to be affected by shows up as a 🚨 warning inline plus an "Advisories in declared range" section, with a suggested floor that clears every fixable advisory — the exact gap that hid the httpx2 advisories from library-mode runs. (Vulnerable ranges that open and close entirely between the lower bound and the newest allowed release remain out of scope.) Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.

@@ -173,0 +168,4 @@
+JSON endpoint: the constraint's *inclusive lower bound* (`>=X.Y`, exact `==X.Y.Z`,
+`~=X.Y`), and — when the release history is available — the newest release the
+constraint allows, which is what a fresh resolution would install. Exclusive-bound and
+wildcard shapes (`>2.3`, `==2.3.*`, `<2.0`) have no single concrete lower-bound version

@@ -193,9 +193,13 @@ without any listed fix cannot be cleared by a floor raise.
 A failed range fetch produces no advisories for that package and prints a warning to

@@ -16,3 +16,3 @@
 `zaojun` is a command-line (CLI) tool to check versions of your dependencies as defined in `pyproject.toml` against the latest versions published on [PyPI](https://pypi.org). Full documentation is available at [zaojun.marvin8.zone](https://zaojun.marvin8.zone/latest/).
 
-**New in v1.8.0**: Constraint-range advisory scanning — zaojun checks the oldest version your constraint allows, not just the newest release. When that floor has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. One extra cached HTTP request per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.
+**New in v1.8.0**: Constraint-range advisory scanning — zaojun checks the lowest and newest releases your constraint actually allows, not just the latest release. When either has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. Up to two extra cached HTTP requests per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.

@@ -188,2 +191,2 @@
-Advisories already reported against the latest release are not repeated (matching by ID
-or alias). Range advisories set exit code 1 and apply the same `vuln-ignore` rules. The
+Advisories already reported against the latest release, or reported by both the
+lowest-allowed and newest-allowed probes, are not repeated (matching by ID or alias). Range advisories set exit code 1 and apply the same `vuln-ignore` rules. The

@@ -199,0 +200,4 @@
+not advisory probes. A too-new release carrying advisories is precisely the signal
+`--min-age` users want surfaced, so the newest-allowed probe ignores the age window.
+
+Known limitation: a vulnerable *mid-range island* — introduced and fixed entirely

@@ -16,3 +16,3 @@
 `zaojun` is a command-line (CLI) tool to check versions of your dependencies as defined in `pyproject.toml` against the latest versions published on [PyPI](https://pypi.org). Full documentation is available at [zaojun.marvin8.zone](https://zaojun.marvin8.zone/latest/).
 
-**New in v1.8.0**: Constraint-range advisory scanning — zaojun checks the oldest version your constraint allows, not just the newest release. When that floor has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. One extra cached HTTP request per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.
+**New in v1.7.5**: Constraint-range advisory scanning — zaojun checks the lowest and newest releases your constraint actually allows, not just the latest release. When either has known security advisories, the dependency line gains a 🚨 inline indicator and an `Advisories in declared range` block lists them with a suggested floor that clears every fixable advisory. Up to two extra cached HTTP requests per constrained package; `vuln-ignore` rules apply. Range advisories set exit code 1 and are never silenced by `--library` or `--compat-ok`.

@@ -173,0 +170,4 @@
+For example, `~=0.0` is probed at the lowest published `0.0.x` rather than a literal
+`0.0` that was never released. When no release history is available, the probe falls
+back to the constraint's inclusive lower bound (`>=X.Y`, exact `==X.Y.Z`, `~=X.Y`).
+Exclusive-bound and wildcard shapes (`>2.3`, `==2.3.*`, `<2.0`) have no single concrete

@@ -190,4 +194,4 @@
 suggested floor is the highest per-advisory minimum `fixed_in` version; advisories
 without any listed fix cannot be cleared by a floor raise.
 
 A failed range fetch produces no advisories for that package and prints a warning to

@@ -11,3 +11,3 @@
 ---
 
-zaojun's vulnerability feed only looked at the newest release on PyPI, so a constraint like `~=2.3` could look fully up to date while still admitting versions with six known advisories. zaojun now fetches the advisory list for each constraint's lower bound as well. Anything the floor is known to be affected by shows up as a 🚨 warning inline plus an "Advisories in declared range" section, with a suggested floor that clears every fixable advisory — the exact gap that hid the httpx2 advisories from library-mode runs. (Advisories introduced after the floor are out of scope for this scan.) Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.
+zaojun's constraint-range advisory scan previously probed a spec's lower bound and its newest allowed release. It now snaps the lower-bound probe to the lowest release the constraint actually allows, taken from the release history — so a spec like `~=0.0` probes the lowest published `0.0.x` rather than a literal `0.0` that was never released. Advisories are also now deduplicated by ID and alias across both probes, so the same vulnerability published under a GHSA and a PYSEC id is reported once. The existing mid-range-island caveat still applies: a vulnerable range that opens and closes entirely between the lowest and newest allowed probes remains out of scope. Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.

@@ -173,0 +170,4 @@
+For example, `~=0.0` is probed at the lowest published `0.0.x` rather than a literal
+`0.0` that was never released. When no release history is available, the probe falls
+back to the constraint's inclusive lower bound (`>=X.Y`, exact `==X.Y.Z`, `~=X.Y`).
+Exclusive-bound and wildcard shapes (`>2.3`, `==2.3.*`, `<2.0`) have no

@@ -400,6 +409,13 @@ Library mode is designed for Python packages that are consumed by other packages
 
 `--min-age` works normally in library mode and applies to incompatible updates.
 
+**Dev dependencies**: the constraint-hygiene rules above apply to whichever

@@ -175,3 +169,3 @@
 
     try:
-        response = await client.get(f"{index_url.rstrip('/')}/{package_name}/{lower_bound}/json")
+        response = await client.get(f"{index_url.rstrip('/')}/{package_name}/{version}/json")

@@ -6,2 +5,3 @@
+zaojun 1.8.0
 
-- Constraint-range advisory scanning: zaojun now also checks the oldest version each constraint allows — 🚨 warns when that floor is known to be affected by vulnerabilities, and suggests a floor that clears them
+- Constraint-range advisory scan refined: the lower-bound probe now snaps to the lowest allowed release, and advisories are deduplicated by ID and alias across probes

@@ -11,3 +11,3 @@
 ---
 
-zaojun's vulnerability feed only looked at the newest release on PyPI, so a constraint like `~=2.3` could look fully up to date while still admitting versions with six known advisories. zaojun now fetches the advisory list for each constraint's lower bound as well. Anything the floor is known to be affected by shows up as a 🚨 warning inline plus an "Advisories in declared range" section, with a suggested floor that clears every fixable advisory — the exact gap that hid the httpx2 advisories from library-mode runs. (Advisories introduced after the floor are out of scope for this scan.) Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.
+zaojun's constraint-range advisory scan previously probed a spec's lower bound and its newest allowed release. The lower-bound probe now snaps to the lowest release the constraint actually allows, taken from the release history — so a spec like `~=0.0` probes the lowest published `0.0.x` rather than a literal `0.0` that was never released. Advisories are also now deduplicated by ID and alias across both probes, so the same vulnerability published under a GHSA and a PYSEC id is reported once. The existing mid-range-island caveat still applies: a vulnerable range that opens and closes entirely between the lowest and newest allowed probes remains out of scope. Range warnings respect `vuln-ignore`, always set exit code 1, and are never silenced by `--library` or `--compat-ok`.

@@ -403,0 +416,4 @@
+when `--groups` is used). Dev dependencies do not ship to consumers, so raising
+their floor to exclude known-vulnerable releases is a normal hygiene bump, not a
+library-mode violation. For example, moving from `uv~=0.11` to
+`uv~=0.11.15` raises the minimum without changing the compatible range width