Test #conficting_dependencies with a locking parent dependabot fixture

npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker_spec.rb

@@ -1548,6 +1548,61 @@
       end
     end
 
+    context "with a locking parent dependency and an unsatisfiable vulnerablity" do
+      let(:dependency_files) { project_dependency_files("npm8/transitive_dependency_locked_by_parent") }
+      let(:dependency_version) { "1.0.0" }
+      let(:target_version) { Dependabot::NpmAndYarn::Version.new("1.0.1") }
+      let(:security_advisories) do
+        [
+          Dependabot::SecurityAdvisory.new(
+            dependency_name: "@dependabot-fixtures/npm-transitive-dependency",
+            package_manager: "npm_and_yarn",
+            vulnerable_versions: ["< 1.0.1"]
+          )
+        ]
+      end
+
+      it "delegates to the ConflictingDependencyResolver and VulnerabilityAuditor and explains the conflict", :vcr do
+        expect(described_class::ConflictingDependencyResolver).
+          to receive(:new).
+          with(
+            dependency_files: dependency_files,
+            credentials: credentials
+          ).and_call_original
+
+        expect(described_class::VulnerabilityAuditor).
+          to receive(:new).
+          with(
+            dependency_files: dependency_files,
+            credentials: credentials,
+            allow_removal: false
+          ).and_call_original
+
+        conflicting_dependencies_result = checker.send(:conflicting_dependencies)
+
+        expect(conflicting_dependencies_result.count).to eq(2)
+
+        expect(conflicting_dependencies_result.first).
+          to eq(
+            "explanation" => "@dependabot-fixtures/npm-parent-dependency-5@1.0.0 requires " \
+                             "@dependabot-fixtures/npm-transitive-dependency@1.0.0 via " \
+                             "@dependabot-fixtures/npm-intermediate-dependency@0.0.1",
+            "name" => "@dependabot-fixtures/npm-intermediate-dependency",
+            "requirement" => "1.0.0",
+            "version" => "0.0.1"
+          )
+
+        expect(conflicting_dependencies_result.last).
+          to eq(
+            "dependency_name" => "@dependabot-fixtures/npm-transitive-dependency",
+            "explanation" => "No patched version available for @dependabot-fixtures/npm-transitive-dependency",
+            "fix_available" => false,
+            "fix_updates" => [],
+            "top_level_ancestors" => []
+          )
+      end
+    end
+
     context "with a conflicting dependency and an unsatisfiable vulnerablity" do
       let(:dependency_files) { project_dependency_files("npm8/locked_transitive_dependency") }
       let(:dependency_version) { "1.0.0" }

npm_and_yarn/spec/fixtures/projects/npm8/transitive_dependency_locked_by_parent/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "transitive-dependency-locked-by-parent",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "@dependabot-fixtures/npm-parent-dependency-5": "1.0.0"
+  }
+}