fix: resolve OutOfSyncError for workspace nested dependencies

Fix regression where workspace packages with their own node_modules
dependencies (e.g., packages/snyk-fix/node_modules/chalk) were not
being properly resolved, causing false OutOfSyncError exceptions.

Added workspace path lookup in getChildNodeKey to properly resolve
workspace package names during dependency matching.

Fixes regression between v2.3.1 and v2.4.1.

Author: JamesPatrickGill

lib/dep-graph-builders/npm-lock-v2/index.ts

@@ -490,6 +490,14 @@ export const getChildNodeKey = (
       if (pkgs[fullPath]) {
         return pkgs[fullPath].name || segment;
       }
+
+      // For workspace packages, the path might not have node_modules/ prefix
+      // Check if this segment (or joined path) exists as a workspace package
+      const workspacePath = pathSegments.join('/node_modules/');
+      if (pkgs[workspacePath]) {
+        return pkgs[workspacePath].name || segment;
+      }
+
       return segment;
     });
 

test/jest/dep-graph-builders/fixtures/npm-lock-v2/workspace-nested-deps/expected.json

@@ -0,0 +1,67 @@
+{
+  "schemaVersion": "1.3.0",
+  "pkgManager": {
+    "name": "npm"
+  },
+  "pkgs": [
+    {
+      "id": "[email protected]",
+      "info": {
+        "name": "root-workspace",
+        "version": "1.0.0"
+      }
+    },
+    {
+      "id": "@test/[email protected]",
+      "info": {
+        "name": "@test/workspace-pkg",
+        "version": "1.0.0"
+      }
+    },
+    {
+      "id": "[email protected]",
+      "info": {
+        "name": "lodash",
+        "version": "4.17.21"
+      }
+    }
+  ],
+  "graph": {
+    "rootNodeId": "root-node",
+    "nodes": [
+      {
+        "nodeId": "root-node",
+        "pkgId": "[email protected]",
+        "deps": [
+          {
+            "nodeId": "@test/[email protected]"
+          }
+        ]
+      },
+      {
+        "nodeId": "@test/[email protected]",
+        "pkgId": "@test/[email protected]",
+        "deps": [
+          {
+            "nodeId": "[email protected]"
+          }
+        ],
+        "info": {
+          "labels": {
+            "scope": "prod"
+          }
+        }
+      },
+      {
+        "nodeId": "[email protected]",
+        "pkgId": "[email protected]",
+        "deps": [],
+        "info": {
+          "labels": {
+            "scope": "prod"
+          }
+        }
+      }
+    ]
+  }
+}

test/jest/dep-graph-builders/fixtures/npm-lock-v2/workspace-nested-deps/package-lock.json

@@ -0,0 +1,11 @@
+{
+  "name": "root-workspace",
+  "version": "1.0.0",
+  "workspaces": [
+    "packages/*"
+  ],
+  "dependencies": {
+    "@test/workspace-pkg": "file:packages/workspace-pkg"
+  },
+  "devDependencies": {}
+}

test/jest/dep-graph-builders/fixtures/npm-lock-v2/workspace-nested-deps/package.json

@@ -24,6 +24,7 @@ describe('dep-graph-builder npm-lock-v2', () => {
         'dist-tag-sub-dependency',
         'bundled-top-level-dep',
         'missing-optional-dep-minimal',
+        'workspace-nested-deps',
       ])('[simple tests] project: %s ', (fixtureName) => {
         it('matches expected', async () => {
           const pkgJsonContent = readFileSync(