fix: reconstruct transitive dependency paths from yarn.lock (#421).

[coder-Yash886]

Closes #421

Summary

• Reconstruct full transitive dependency paths from yarn.lock (Classic + Berry) using a BFS graph walk, following the pnpm fix: preserve multiple pnpm dependency paths for repeated package versions #335 approach
• Preserve multiple paths per package (cap: 5 paths, depth 10)
• Extend resolveTransitiveRemediationViaRegistry for deep chains so within-range remediation works for yarn/pnpm/bun without an npm lock graph
• Add parser and remediation tests; fix flaky Windows temp-dir teardown via shared test-utils.ts

What this fixes

The Yarn parser previously emitted flat paths (["project", "js-cookie"]) instead of the full chain (["project", "aws-amplify", "@aws-amplify/core", "js-cookie"]). Without correct paths, the within-range resolver could not suggest yarn upgrade js-cookie.

Once this lands, PR #537 (yarn-within-range fixture) should produce the expected scan output.

Test plan

• npm test — all 419 tests pass
• examples/yarn-classic — follow-redirects classified as transitive → yarn upgrade follow-redirects
• Maintainer: verify examples/yarn-within-range (from feat: add yarn-within-range lockfile fixture (#5) #537) emits yarn upgrade js-cookie

[coder-Yash886]

@sonukapoor Please review the PR when you have free time .
Is there any Slack or Discord channel for project discussions where I can coordinate or ask doubts related to issues and PRs?

[sonukapoor]

@sonukapoor Please review the PR when you have free time . Is there any Slack or Discord channel for project discussions where I can coordinate or ask doubts related to issues and PRs?

Will take a look this week. We have a Slack channel as mentioned in our readme: https://owasp.org/slack/invite

[sonukapoor]

Tested on the branch — yarn upgrade js-cookie is now correctly generated for the yarn-within-range fixture. Full test suite passes (419 tests, 1 skipped). The flat path problem is fixed. This unblocks #537.

[sonukapoor]

Tested on the branch — yarn upgrade js-cookie is now correctly generated for the yarn-within-range fixture. Full test suite passes (419 tests, 1 skipped). The flat path problem is fixed. This unblocks #537.

[sonukapoor]

Merged — thank you @coder-Yash886!