Public search query: agent's dependency-bump PR reintroduced a patched CVE via lockfile merge