Fixes nested dependency detection in NpmLockfile3Detector and applies the engines array fix that was missing from PR #1400.#1606

Open

gzproger wants to merge 7 commits intomicrosoft:mainfrom

gzproger:npmlock3-fix-nested-deps

Commits on Jan 8, 2026

Fix NpmLockfile3 nested dependency detection and devOptional classification
jiewenz
committed

Commits on Jan 9, 2026

Refactor NpmLockfile3Detector and tests to improve dependency recording and handling of link/bundled packages
jiewenz
committed