<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">When running <code class="notranslate">npm audit --json</code> in this branch here <a href="https://github.com/mgdodge/rollup-plugin-vue-treeshake-bug-vue3/tree/vue2">https://github.com/mgdodge/rollup-plugin-vue-treeshake-bug-vue3/tree/vue2</a><br>
I observe lodash, which is not a direct dependency but deduped to the top - doesn't get mentioned in any of the <code class="notranslate">via</code> fields and its <code class="notranslate">effects</code> is empty.</p>
<div class="highlight highlight-source-js notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content=" &quot;lodash&quot;: {
                &quot;name&quot;: &quot;lodash&quot;,
                &quot;severity&quot;: &quot;high&quot;,
                &quot;via&quot;: [
                    {
                        &quot;source&quot;: 1673,
                        &quot;name&quot;: &quot;lodash&quot;,
                        &quot;dependency&quot;: &quot;lodash&quot;,
                        &quot;title&quot;: &quot;Command Injection&quot;,
                        &quot;url&quot;: &quot;https://npmjs.com/advisories/1673&quot;,
                        &quot;severity&quot;: &quot;high&quot;,
                        &quot;range&quot;: &quot;&lt;4.17.21&quot;
                    }
                ],
                &quot;effects&quot;: [],
                &quot;range&quot;: &quot;&lt;4.17.21&quot;,
                &quot;nodes&quot;: [
                    &quot;node_modules/lodash&quot;
                ],
                &quot;fixAvailable&quot;: true
            },"><pre class="notranslate"> <span class="pl-s">"lodash"</span>: <span class="pl-kos">{</span>
                <span class="pl-s">"name"</span>: <span class="pl-s">"lodash"</span><span class="pl-kos">,</span>
                <span class="pl-s">"severity"</span>: <span class="pl-s">"high"</span><span class="pl-kos">,</span>
                <span class="pl-s">"via"</span>: <span class="pl-kos">[</span>
                    <span class="pl-kos">{</span>
                        <span class="pl-s">"source"</span>: <span class="pl-c1">1673</span><span class="pl-kos">,</span>
                        <span class="pl-s">"name"</span>: <span class="pl-s">"lodash"</span><span class="pl-kos">,</span>
                        <span class="pl-s">"dependency"</span>: <span class="pl-s">"lodash"</span><span class="pl-kos">,</span>
                        <span class="pl-s">"title"</span>: <span class="pl-s">"Command Injection"</span><span class="pl-kos">,</span>
                        <span class="pl-s">"url"</span>: <span class="pl-s">"https://npmjs.com/advisories/1673"</span><span class="pl-kos">,</span>
                        <span class="pl-s">"severity"</span>: <span class="pl-s">"high"</span><span class="pl-kos">,</span>
                        <span class="pl-s">"range"</span>: <span class="pl-s">"&lt;4.17.21"</span>
                    <span class="pl-kos">}</span>
                <span class="pl-kos">]</span><span class="pl-kos">,</span>
                <span class="pl-s">"effects"</span>: <span class="pl-kos">[</span><span class="pl-kos">]</span><span class="pl-kos">,</span>
                <span class="pl-s">"range"</span>: <span class="pl-s">"&lt;4.17.21"</span><span class="pl-kos">,</span>
                <span class="pl-s">"nodes"</span>: <span class="pl-kos">[</span>
                    <span class="pl-s">"node_modules/lodash"</span>
                <span class="pl-kos">]</span><span class="pl-kos">,</span>
                <span class="pl-s">"fixAvailable"</span>: <span class="pl-c1">true</span>
            <span class="pl-kos">}</span><span class="pl-kos">,</span></pre></div>
<p dir="auto">Other dependencies also affected in a similar way. My hypothesis is it has something to do with dedupe.</p>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto">Produce correct dependency tree information in <code class="notranslate">via</code> fields</p>
<h3 dir="auto">Steps To Reproduce</h3>
<ol dir="auto">
<li>git clone <a href="mailto:git@github.com">git@github.com</a>:mgdodge/rollup-plugin-vue-treeshake-bug-vue3.git</li>
<li>cd rollup-plugin-vue-treeshake-bug-vue3</li>
<li>git checkout vue2</li>
<li>npm audit --json<br>
OR</li>
<li>npm audit --json | grep -B4 -A4 lodash</li>
</ol>
<p dir="auto">exact link to the package-lock.json at the revision used to reproduce <a href="https://github.com/mgdodge/rollup-plugin-vue-treeshake-bug-vue3/blob/031b3e104f4030e4a43d9b6454291017c1e8c5ad/package-lock.json">https://github.com/mgdodge/rollup-plugin-vue-treeshake-bug-vue3/blob/031b3e104f4030e4a43d9b6454291017c1e8c5ad/package-lock.json</a></p>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>OS: linux</li>
<li>Node: 16.2.0</li>
<li>npm: 7.13.0 (latest)</li>
</ul>