Incorrect dependabot alerts when version in package-lock.json is outside affected range

[silverwind]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

npm

Package manager version

npm@10

Language version

node 20

Manifest location and content before the Dependabot update

https://github.com/go-gitea/gitea/blob/main/package-lock.json

dependabot.yml content

No response

Updated dependency

No response

What you expected to see, versus what you actually saw

No dependabot alert raised, but it raised multiples for GHSA-35jh-r3h4-6jhm like for example https://github.com/go-gitea/gitea/security/dependabot/64.

lodash@4.17.21 does not match the affected version range <= 4.5.0 and npm ls lodash also confirms there is no affected version in the file:

$ npm ls lodash
gitea@
├─┬ @stoplight/spectral-cli@6.11.1
│ ├─┬ @stoplight/json@3.21.0
│ │ └── lodash@4.17.21 deduped
│ ├─┬ @stoplight/spectral-core@1.18.3
│ │ └── lodash@4.17.21 deduped
│ ├─┬ @stoplight/spectral-formatters@1.3.0
│ │ └── lodash@4.17.21 deduped
│ ├─┬ @stoplight/spectral-ref-resolver@1.0.4
│ │ └─┬ @stoplight/json-ref-resolver@3.1.6
│ │   └── lodash@4.17.21 deduped
│ ├─┬ @stoplight/spectral-ruleset-bundler@1.5.2
│ │ └─┬ @stoplight/spectral-functions@1.7.2
│ │   └── lodash@4.17.21 deduped
│ ├─┬ @stoplight/spectral-rulesets@1.18.1
│ │ └── lodash@4.17.21 deduped
│ ├─┬ @stoplight/spectral-runtime@1.1.2
│ │ └── lodash@4.17.21 deduped
│ └── lodash@4.17.21
├─┬ eslint-plugin-vue-scoped-css@2.8.0
│ ├── lodash@4.17.21 deduped
│ └─┬ vue-eslint-parser@9.4.2
│   └── lodash@4.17.21 deduped
└─┬ mermaid@10.9.0
  └─┬ cytoscape@3.28.1
    └── lodash@4.17.21 deduped

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

No response

Smallest manifest that reproduces the issue

No response

[silverwind]

Ah I see it is actually a correct alert, the affected package is a subpackage of lodash:

$ npm ls lodash.template
gitea@
└─┬ license-checker-webpack-plugin@0.2.1
  └── lodash.template@4.5.0

Sorry, I'll be closing this.