fix: show fund info with conflicting items

Fixed a problem when having packages with multiple entries in the
arborist inventory, now it will always pick up funding info from the
latest version of the package found in the inventory.

Author: ruyadorno

lib/fund.js

@@ -2,6 +2,7 @@
 
 const archy = require('archy')
 const Arborist = require('@npmcli/arborist')
+const semver = require('semver')
 const npa = require('npm-package-arg')
 const { breadth } = require('treeverse')
 const {
@@ -101,7 +102,7 @@ function printHuman (fundingInfo, opts) {
 function openFundingUrl ({ actualTree, spec, fundingSourceNumber }) {
   const retrievePackageMetadata = () => {
     const arg = npa(spec, actualTree.path)
-    let packageMetadata = {}
+    let packageMetadata
     if (arg.type === 'directory') {
       if (actualTree.path === arg.where) {
         packageMetadata = actualTree.package
@@ -113,7 +114,14 @@ function openFundingUrl ({ actualTree, spec, fundingSourceNumber }) {
         }
       }
     } else {
-      const item = actualTree.inventory.query('name', arg.name)
+      const [ item ] = [
+        ...actualTree.inventory.values()
+      ]
+        .filter(i => i && i.package &&
+          i.package.name === arg.name &&
+          semver.valid(i.package.version))
+        .sort((a, b) => semver.rcompare(a.package.version, b.package.version))
+
       if (item) {
         packageMetadata = item.package
       } else {
@@ -123,7 +131,7 @@ function openFundingUrl ({ actualTree, spec, fundingSourceNumber }) {
     return packageMetadata
   }
 
-  const { funding } = retrievePackageMetadata()
+  const { funding } = retrievePackageMetadata() || {}
   const validSources = [].concat(normalizeFunding(funding)).filter(isValidFunding)
 
   if (validSources.length === 1 || (fundingSourceNumber > 0 && fundingSourceNumber <= validSources.length)) {

tap-snapshots/test-tap-fund.js-TAP.test.js

@@ -44,6 +44,13 @@ http://example.com/donate
 
 `
 
+exports[`test/tap/fund.js TAP fund using pkg name while having conflicting versions > should open greatest version 1`] = `
+Funding available at the following URL:
+
+http://example.com/2
+
+`
+
 exports[`test/tap/fund.js TAP fund using string shorthand > should open string-only url 1`] = `
 Funding available at the following URL:
 

test/tap/fund.js

@@ -145,6 +145,46 @@ const nestedMultipleFundingPackages = {
   }
 }
 
+const conflictingFundingPackages = {
+  'package.json': JSON.stringify({
+    name: 'conflicting-funding-packages',
+    version,
+    dependencies: {
+      foo: '1.0.0'
+    },
+    devDependencies: {
+      bar: '1.0.0'
+    }
+  }),
+  node_modules: {
+    foo: {
+      'package.json': JSON.stringify({
+        name: 'foo',
+        version: '1.0.0',
+        funding: 'http://example.com/1'
+      })
+    },
+    bar: {
+      node_modules: {
+        foo: {
+          'package.json': JSON.stringify({
+            name: 'foo',
+            version: '2.0.0',
+            funding: 'http://example.com/2'
+          })
+        }
+      },
+      'package.json': JSON.stringify({
+        name: 'bar',
+        version: '1.0.0',
+        dependencies: {
+          foo: '2.0.0'
+        }
+      })
+    }
+  }
+}
+
 test('fund with no package containing funding', t => {
   const cwd = t.testdir({
     'package.json': JSON.stringify({
@@ -378,6 +418,16 @@ test('fund using nested packages with multiple sources, with a source number', t
   t.end()
 })
 
+test('fund using pkg name while having conflicting versions', t => {
+  const cwd = t.testdir(conflictingFundingPackages)
+  const stdout = execSync(
+    `${process.execPath} ${bin} fund foo --which=1 --no-browser`,
+    { cwd }
+  )
+  t.matchSnapshot(stdout.toString(), 'should open greatest version')
+  t.end()
+})
+
 test('fund using package argument with no browser, using --json option', t => {
   const cwd = t.testdir(maintainerOwnsAllDeps)
   const stdout = execSync(