GitHub Dependabot ignores bun.lock and misses transitive dependency alerts

GitHub Dependabot does not parse bun.lock files, so Bun projects get no alerts for transitive dependencies and their vulnerabilities. In a test, bun audit found three vulnerabilities while Dependabot raised only one. The workaround is to submit the lockfile manually via GitHub's dependency submission API.

• Dependabot falls back to package.json and sees only direct dependencies
• Dependencies using catalog: syntax are recorded as literal strings and never match advisories
• In a test, bun audit found 3 vulnerabilities while Dependabot raised only 1
• Workaround: submit bun.lock via GitHub's dependency submission API