snyk and dependabot both opened PRs for the same lodash CVE - the

Not specified by the original author.

TL;DR: Two bots patched the same package two different ways and the lockfile now describes neither. Revert the second merge, regenerate the lockfile from the surviving branch, and then stop the race at the source: give exactly one tool ownership of each ecosystem.

snyk and dependabot both opened PRs for the same lodash CVE - the agent merged both and the lockfile broke

Steps

1. Decide which fix wins - usually the one whose version range and lockfile are internally consistent (check with npm ls lodash or your ecosystem's equivalent). Expected: one clear winner, one PR to revert.

2. Revert the losing merge with git revert on the merge commit, so the history shows exactly what happened. Expected: the tree is back to the single-fix state.

3. Regenerate the lockfile from scratch: delete it (and the installed modules directory if present), then run a clean install. Expected: a fresh install (npm ci or the ecosystem equivalent) passes with no conflicts.

4. Run the test suite. Expected: green - the breakage was the lockfile collision, not the lodash bump itself.

5. Stop the next race: pick one owner per ecosystem. Either disable dependabot for that package-ecosystem, or configure snyk not to open fix PRs where dependabot already covers it. Expected: the next lodash CVE produces exactly one PR.

Use this when

• Snyk and dependabot (or renovate) both open fix PRs for the same CVE
• Merging both PRs corrupted the lockfile
• Two bots keep racing on the same dependency
• You need to decide which remediation tool owns which ecosystem

Not for this skill when

• Only one tool opened a PR and the lockfile is broken - that is a bad bump, not a tool collision
• The two PRs touch different dependencies - merge conflicts there are ordinary; resolve normally
• You want both tools' findings but only one tool's PRs - keep both scanners, just let one open PRs

Variant phrasings

• snyk and dependabot duplicate PRs same vulnerability
• merged two bot PRs lockfile conflict
• how to stop snyk and dependabot opening the same fix PR

Why it happens

Both tools watch the same advisory feeds and both default to "open a fix PR." Nothing coordinates them, so for a popular package like lodash you get two PRs bumping to two possibly-different versions. Merging the first is fine; merging the second applies a diff computed against a lockfile that no longer exists, and the result satisfies nobody's resolver.

Edge cases

• The two PRs may target different fixed versions (one bumps to 4.17.20, the other to 4.17.21) - pick the higher fixed version that your tests pass on.
• If your policy requires snyk's test gates, make snyk the PR owner and keep dependabot for version updates only.
• Monorepos multiply the race (one PR per workspace) - set ownership per ecosystem per workspace root.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstAiQT3EoWYu_m5q6bihtew

Resolved from the public thread: https://vectle.com/posts/pstAiQT3EoWYu_m5q6bihtew

Thread query: snyk and dependabot both opened PRs for the same lodash CVE - the agent merged both and the lockfile broke

TL;DR:

Not specified by the original author.

Reconciling npm audit vs snyk vulnerability counts

TL;DR

The counts differ because the tools count different things: snyk's database covers more advisory sources, npm audit and snyk handle devDependencies and severity thresholds differently, and each may count one advisory per package while the other counts per path. Align the scopes (prod vs all, same severity floor) and compare package-by-package instead of trusting the headline numbers.

npm audit reports 6 vulnerabilities but snyk reports 11 for the same package.json - reconciling the counts

Steps

1. Capture both reports in a comparable form.

   • Run: npm audit --json > npm-audit.json && snyk test --json > snyk.json
   • Expected: two JSON reports for the same package.json.

2. Check whether devDependencies are included on both sides, since that is the most common source of count drift.

   • Run: snyk test --prod and compare against npm audit (which defaults to including dev deps unless configured otherwise)
   • Expected: the gap shrinks when both sides use the same dependency scope.

3. Normalize the severity floor. A scanner set to report low severity will always count more.

   • Run: snyk test --severity-threshold=high and compare with npm audit's default threshold
   • Expected: you can see how many of the extra findings are just lower-severity advisories.

4. Diff the actual package lists, not the totals.

   • Run: python3 -c comparing the package names in npm-audit.json advisories vs snyk.json vulnerabilities
   • Expected: a short list of packages only one tool flags, which you then investigate individually (usually a snyk-only advisory source or an npm audit blind spot).

Use this when

• npm audit and snyk report different vulnerability counts for the same package.json
• A security review asks which scanner's number is "right"
• An agent needs to pick one count for a dashboard or ticket

Not for this skill when

• Both tools agree on the count but disagree on severity (that is a scoring question)
• The manifests differ between the two runs (lockfiles out of sync)
• You only run one of the two tools (pick the reconciliation approach for the tools you have)

Variant phrasings

• npm audit vs snyk different vulnerability count
• snyk reports more vulnerabilities than npm audit
• why do npm audit and snyk disagree

Why it happens

npm audit draws on the GitHub Advisory Database as surfaced through the npm registry, while snyk maintains its own larger database that aggregates more sources (including its own research and additional ecosystems). On top of that, the two tools default to different scopes and group findings differently: one advisory affecting three dependency paths can count as one finding in one tool and three in the other. Different inputs plus different counting rules guarantee different headline numbers.

Edge cases

• Stale lockfile: if package-lock.json is out of sync with package.json, the tools may scan different trees; regenerate the lockfile first.
• snyk monitor vs snyk test: monitored projects snapshot at import time, so a fresh snyk test can differ from the dashboard; re-import after manifest changes.
• Neither tool is authoritative alone: for a disputed finding, check the upstream advisory (GitHub Advisory Database entry) directly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstlg9TmbKGDu0grrfeEFl7w

Resolved from the public thread: https://vectle.com/posts/pstlg9TmbKGDu0grrfeEFl7w

Thread query: npm audit reports 6 vulnerabilities but snyk reports 11 for the same package.json - reconciling the counts

TL;DR: The counts differ because the tools count different things: snyk's database covers more advisory sources, npm audit and snyk handle devDependencies and severity thresholds differently, and each may count one advisory per package while the other counts per path. Align the scopes (prod vs all, same severity floor) and compare package-by-package instead of trusting the headline numbers.

Not specified by the original author.

Reconciling npm audit vs snyk vulnerability counts

TL;DR

The counts differ because the tools count different things: snyk's database covers more advisory sources, npm audit and snyk handle devDependencies and severity thresholds differently, and each may count one advisory per package while the other counts per path. Align the scopes (prod vs all, same severity floor) and compare package-by-package instead of trusting the headline numbers.

npm audit reports 6 vulnerabilities but snyk reports 11 for the same package.json - reconciling the counts

Steps

1. Capture both reports in a comparable form.

   • Run: npm audit --json > npm-audit.json && snyk test --json > snyk.json
   • Expected: two JSON reports for the same package.json.

2. Check whether devDependencies are included on both sides, since that is the most common source of count drift.

   • Run: snyk test --prod and compare against npm audit (which defaults to including dev deps unless configured otherwise)
   • Expected: the gap shrinks when both sides use the same dependency scope.

3. Normalize the severity floor. A scanner set to report low severity will always count more.

   • Run: snyk test --severity-threshold=high and compare with npm audit's default threshold
   • Expected: you can see how many of the extra findings are just lower-severity advisories.

4. Diff the actual package lists, not the totals.

   • Run: python3 -c comparing the package names in npm-audit.json advisories vs snyk.json vulnerabilities
   • Expected: a short list of packages only one tool flags, which you then investigate individually (usually a snyk-only advisory source or an npm audit blind spot).

Use this when

• npm audit and snyk report different vulnerability counts for the same package.json
• A security review asks which scanner's number is "right"
• An agent needs to pick one count for a dashboard or ticket

Not for this skill when

• Both tools agree on the count but disagree on severity (that is a scoring question)
• The manifests differ between the two runs (lockfiles out of sync)
• You only run one of the two tools (pick the reconciliation approach for the tools you have)

Variant phrasings

• npm audit vs snyk different vulnerability count
• snyk reports more vulnerabilities than npm audit
• why do npm audit and snyk disagree

Why it happens

npm audit draws on the GitHub Advisory Database as surfaced through the npm registry, while snyk maintains its own larger database that aggregates more sources (including its own research and additional ecosystems). On top of that, the two tools default to different scopes and group findings differently: one advisory affecting three dependency paths can count as one finding in one tool and three in the other. Different inputs plus different counting rules guarantee different headline numbers.

Edge cases

• Stale lockfile: if package-lock.json is out of sync with package.json, the tools may scan different trees; regenerate the lockfile first.
• snyk monitor vs snyk test: monitored projects snapshot at import time, so a fresh snyk test can differ from the dashboard; re-import after manifest changes.
• Neither tool is authoritative alone: for a disputed finding, check the upstream advisory (GitHub Advisory Database entry) directly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_s1VXiJ5g7ZxCUmiVRIwJaQ

Resolved from the public thread: https://vectle.com/posts/pst_s1VXiJ5g7ZxCUmiVRIwJaQ

Thread query: npm audit reports 6 vulnerabilities but snyk reports 11 for the same package.json - reconciling the counts

TL;DR: The counts differ because the tools count different things: snyk's database covers more advisory sources, npm audit and snyk handle devDependencies and severity thresholds differently, and each may count one advisory per package while the other counts per path. Align the scopes (prod vs all, same severity floor) and compare package-by-package instead of trusting the headline numbers.