[Bug?]: yarn npm audit mismatches a dependency version

[joostvdwsd]

Self-service

• I'd be willing to implement a fix

Describe the bug

Scenario:

• workspace depends on package@fixed version
• subdependency of workspace depends on same package@vulnerable version

Expected results

yarn npm audit -> no issues
yarn npm audit -R -> issue on package

Actual real life results:

yarn why yaml

├─ patch-package@npm:6.5.1
│  └─ yaml@npm:1.10.2 (via npm:^1.10.2)
│
└─ yarnissue@workspace:.
   └─ yaml@npm:2.2.2 (via npm:^2.2.2)

yarn npm audit

└─ yaml: 1.10.2
   ├─ ID: 1091814
   ├─ Issue: Uncaught Exception in yaml
   ├─ URL: https://github.com/advisories/GHSA-f9xv-q969-pqx4
   ├─ Severity: moderate
   ├─ Vulnerable Versions: <2.2.2
   ├─ Patched Versions: >=2.2.2
   ├─ Via: yaml
   └─ Recommendation: Upgrade to version 2.2.2 or later

Tried to attach a sherlock but the vm was crashing. Included a repoducable package.json

To reproduce

{
"name": "yarnissue",
"version": "1.0.0",
"main": "index.js",
"license": "MIT",
"dependencies": {
"patch-package": "6.5.1",
"yaml": "2.2.2"
},
"packageManager": "yarn@3.5.0"
}
yarn
yarn why yaml
yarn npm audit

Environment

System:
    OS: macOS 12.6.1
    CPU: (10) arm64 Apple M1 Pro
  Binaries:
    Node: 14.21.1 - /private/var/folders/v2/8k7t9jzj0ts0w2l2n72v2g6nc928z9/T/xfs-34fccac8/node
    Yarn: 3.5.0 - /private/var/folders/v2/8k7t9jzj0ts0w2l2n72v2g6nc928z9/T/xfs-34fccac8/yarn
    npm: 6.14.18 - ~/.nvm/versions/node/v14.21.1/bin/npm

Additional context

No response