Ensuring only one update is suggested per package.

Author: grasmash

src/Commands/pm/SecurityUpdateCommands.php

@@ -2,8 +2,6 @@
 namespace Drush\Commands\pm;
 
 use Composer\Semver\Comparator;
-use Composer\Semver\Semver;
-use Composer\Semver\VersionParser;
 use Consolidation\AnnotatedCommand\CommandData;
 use Consolidation\OutputFormatters\StructuredData\RowsOfFields;
 use Drush\Commands\DrushCommands;
@@ -209,7 +207,8 @@ protected function registerPackageSecurityUpdates(
         $name,
         $package
     ) {
-        if (!empty($security_advisories_composer_json['conflict'][$name])) {
+        if (empty($this->securityUpdates[$name]) &&
+            !empty($security_advisories_composer_json['conflict'][$name])) {
             $conflict_constraints = explode(',',
                 $security_advisories_composer_json['conflict'][$name]);
             foreach ($conflict_constraints as $conflict_constraint) {
@@ -218,10 +217,6 @@ protected function registerPackageSecurityUpdates(
                 if ($available_update) {
                     $this->securityUpdates[$name] = $available_update;
                 }
-                else {
-                    $this->logger()
-                        ->warning("Could not parse drupal-security-advisories conflicting version constraint $conflict_constraint for package $name.");
-                }
             }
         }
     }