No PRs due to unclear `update_not_possible`

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

10.2.4

### Language version

20.11.0

### Manifest location and content before the Dependabot update

This is my `package.json`, located in the root project folder:

```
{
"name": "my-project",
"repository": "my-project-url",
"license": "UNLICENSED",
"scripts": {
"build": "wireit",
"i18n:build": "wireit",
"test": "wireit",
"lint": "wireit",
"test:ci": "wireit",
"i18n:extract": "wireit"
},
"wireit": {
"build": {
"dependencies": [
"sass",
"svg",
"webpack",
"esm"
]
},
"webpack": {
"command": "webpack",
"files": [
"frontend/assets/js/**/*.js",
"frontend/assets/js/**/*.vue",
"webpack.*"
],
"output": [
"frontend/static/js/*.min.js"
],
"clean": true,
"dependencies": [
"esm",
"i18n:build"
]
},
"esm": {
"command": "esbuild `find frontend/assets/js -iname \"*.js\" -not -path \"*/__tests__/*\" -not -path \"*/__fixture__/*\"` --outdir=frontend/static/js --minify --sourcemap --target=es6 --format=esm",
"files": [
"frontend/assets/js/**/*.js"
],
"output": [
"frontend/static/js/**/*.js"
],
"dependencies": [
"i18n:build",
"esm-dists"
]
},
"esm-dists": {
"command": "node esm-dists.mjs",
"files": [
"node_modules/**/*.js"
],
"output": [
"frontend/static/dependencies/*.min.mjs"
]
},
"svg": {
"command": "svg-sprite --config=svg-sprite.config.json 'frontend/assets/gfx/**/*.svg' 'node_modules/plyr/src/sprite/*.svg'",
"files": [
"frontend/assets/gfx/**/*.svg",
"node_modules/plyr/src/sprite/*.svg"
],
"output": [
"frontend/static/img/sprite.svg"
]
},
"sass": {
"command": "npx sass frontend/assets/scss:frontend/static/css --style=compressed --embed-sources --load-path=node_modules",
"files": [
"frontend/assets/scss/**/*.scss"
],
"output": [
"frontend/static/css"
],
"dependencies": [
"fonts"
]
},
"fonts": {
"command": "node copy-fonts.mjs",
"files": [
"frontend/assets/fonts/*.woff2",
"frontend/assets/fonts/*.woff"
],
"output": [
"frontend/static/fonts/*.woff2",
"frontend/static/fonts/*.woff"
]
},
"i18n:extract": {
"command": "lit-localize extract",
"files": [
"lit-localize.json",
"frontend/assets/js/**/*.js"
]
},
"i18n:build": {
"command": "lit-localize build",
"files": [
"lit-localize.json",
"frontend/assets/js/xliff/*.xlf"
],
"output": [
"frontend/assets/js/locale/*.js"
]
},
"lint": {
"dependencies": [
"lint:js",
"lint:sass"
]
},
"lint:js": {
"command": "eslint \"**/*.{js,vue}\""
},
"lint:sass": {
"command": "stylelint \"**/*.scss\""
},
"test": {
"command": "jest"
},
"test:ci": {
"command": "jest --ci"
}
},
"version": "0.1.0",
"engines": {
"node": "20.*",
"npm": "10.*"
},
"packageManager": "npm",
"imports": {
"#js/components/*": "./frontend/static/js/components/*.js",
"#js/integrations/*": "./frontend/static/js/integrations/*.js",
"#js/locale/*": "./frontend/static/js/locale/*.js",
"#js/pages/*": "./frontend/static/js/pages/*.js",
"#dependencies/*": "./frontend/static/dependencies/*.min.mjs"
},
"sasslintConfig": ".sass-lint.yaml",
"dependencies": {
"htmx.org": "*",
"lit": "*"
},
"devDependencies": {
"@algolia/autocomplete-js": "*",
"@algolia/autocomplete-theme-classic": "*",
"@easepick/bundle": "*",
"@lit/localize": "*",
"@lit/localize-tools": "*",
"@mapbox/mapbox-gl-geocoder": "*",
"@pusher/push-notifications-web": "*",
"@sentry/browser": "*",
"@sentry/integrations": "*",
"@testing-library/jest-dom": "*",
"algoliasearch-helper": "*",
"chart.js": "*",
"chartjs-adapter-dayjs-4": "*",
"chartjs-chart-treemap": "*",
"chartjs-plugin-annotation": "*",
"dayjs": "*",
"esbuild": "*",
"esbuild-jest": "*",
"eslint": "*",
"eslint-config-standard": "*",
"eslint-plugin-jest": "*",
"eslint-plugin-jsdoc": "*",
"eslint-plugin-promise": "*",
"eslint-plugin-vue": "*",
"hls.js": "*",
"identity-obj-proxy": "*",
"jest": "*",
"jest-canvas-mock": "*",
"jest-environment-jsdom": "*",
"lit-css-loader": "*",
"lodash": "*",
"lodash-webpack-plugin": "*",
"mousetrap": "*",
"normalize.css": "*",
"plyr": "*",
"pusher-js": "*",
"sass": "*",
"shepherd.js": "*",
"standard": "*",
"stylelint": "*",
"stylelint-config-standard-scss": "*",
"stylelint-scss": "*",
"svg-sprite": "*",
"svgo": "*",
"swiper": "9.*",
"vue": "2.7.16",
"vue-loader": "15.x",
"vue-template-compiler": "*",
"webpack": "*",
"webpack-cli": "*",
"wireit": "*"
}
}
```

### dependabot.yml content

```
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
version: 2
updates:
- package-ecosystem: pip
directory: "/"
schedule:
interval: weekly
groups:
minor-python-dependencies:
update-types:
- "minor"
- "patch"
major-python-dependencies:
update-types:
- "major"
versioning-strategy: lockfile-only
open-pull-requests-limit: 10
- package-ecosystem: npm
directory: "/"
schedule:
interval: weekly
groups:
minor-javascript-dependencies:
update-types:
- "minor"
- "patch"
major-javascript-dependencies:
update-types:
- "major"
versioning-strategy: lockfile-only
open-pull-requests-limit: 10
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weekly
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

As of today, I see a list of outdated dependencies, while Dependabot states: `No PRs affected`.
In dependabot logs I see the following:
```
updater | 2024/04/15 07:05:37 INFO Checking if hls.js needs updating
proxy | 2024/04/15 07:05:37 [315] GET https://registry.npmjs.org:443/hls.js
proxy | 2024/04/15 07:05:37 [315] 200 https://registry.npmjs.org:443/hls.js
proxy | 2024/04/15 07:05:40 [317] HEAD https://registry.npmjs.org:443/hls.js/-/hls.js-1.5.8.tgz
proxy | 2024/04/15 07:05:40 [317] 200 https://registry.npmjs.org:443/hls.js/-/hls.js-1.5.8.tgz
updater | 2024/04/15 07:05:40 INFO Latest version is 1.5.8
updater | 2024/04/15 07:05:40 INFO Requirements to unlock update_not_possible
updater | 2024/04/15 07:05:40 INFO Requirements update strategy lockfile_only
updater | 2024/04/15 07:05:40 INFO No update possible for hls.js
```

This started several months before, without me touching the dependency logic.

### Native package manager behavior

```
❯ npm outdated
Package Current Wanted Latest Location
@sentry/browser 7.109.0 7.110.0 7.110.0 node_modules/@sentry/browser
@sentry/integrations 7.109.0 7.110.0 7.110.0 node_modules/@sentry/integrations
eslint 8.57.0 9.0.0 9.0.0 node_modules/eslint
eslint-plugin-vue 9.24.1 9.25.0 9.25.0 node_modules/eslint-plugin-vue
hls.js 1.5.7 1.5.8 1.5.8 node_modules/hls.js
sass 1.74.1 1.75.0 1.75.0 node_modules/sass
swiper 9.4.1 9.4.1 11.1.1 node_modules/swiper
vue 2.7.16 2.7.16 3.4.21 node_modules/vue
vue-loader 15.11.1 15.11.1 17.4.2 node_modules/vue-loader
```

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Start by reproducing the report with the supplied root package.json and dependabot.yml, then trace the npm updater logs around lockfile-only handling and update_not_possible. Compare the listed npm outdated results with Dependabot's decision; done means the cause is identified and the behavior is covered by an appropriate regression test.

Written by the indexing model from the issue text.