Dependabot phantom alert: lockfile version outside vulnerable range

Trap: a GitHub Dependabot alert stays OPEN even though the lockfile already resolves to a version OUTSIDE the vulnerable range. Looks like a real vuln needing a fix. Concrete case: svgo GHSA-2p49-hgcm-8545 (range >= 1.0.0, < 2.8.3) alert #197 on getsentry/craft docs/pnpm-lock.yaml, but the lockfile resolves svgo@4.0.1 (4.0.1 > 2.8.3 = patched). GitHub's alert state was stale and never reconciled. Fix: grep the lockfile for the resolved version; if outside the vulnerable range, the alert is phantom — no code change needed. Don't chase it.