fix: CJS Module Lexer replaced by merve

[richardlau]

Update the checker to account for CJS Module Lexer gradually being replaced with merve.

---

Currently broken for the release lines where the replacement has already happened, e.g.
https://github.com/nodejs/nodejs-dependency-vuln-assessments/actions/runs/22383732503/job/64790456705#step:6:15

Traceback (most recent call last):
  File "/home/runner/work/nodejs-dependency-vuln-assessments/nodejs-dependency-vuln-assessments/dep_checker/main.py", line 261, in <module>
    exit(main())
  File "/home/runner/work/nodejs-dependency-vuln-assessments/nodejs-dependency-vuln-assessments/dep_checker/main.py", line 234, in main
    list() if gh_token is None else query_ghad(dependencies, gh_token, repo_path)
  File "/home/runner/work/nodejs-dependency-vuln-assessments/nodejs-dependency-vuln-assessments/dep_checker/main.py", line 113, in query_ghad
    dep_version = dep.version_parser(repo_path)
  File "/home/runner/work/nodejs-dependency-vuln-assessments/nodejs-dependency-vuln-assessments/dep_checker/versions_parser.py", line 53, in get_cjs_lexer_version
    return get_package_json_version(repo_path / "deps/cjs-module-lexer/src/package.json")
  File "/home/runner/work/nodejs-dependency-vuln-assessments/nodejs-dependency-vuln-assessments/dep_checker/versions_parser.py", line 8, in get_package_json_version
    with open(path, "r") as f:
FileNotFoundError: [Errno 2] No such file or directory: '../node/deps/cjs-module-lexer/src/package.json'
Error: Process completed with exit code 1.

[richardlau]

@nodejs/security-wg Is this correct? I based this on the "CJS Module Lexer" mapping, which also has cpe=None.

[richardlau]

Run from this branch: https://github.com/nodejs/nodejs-dependency-vuln-assessments/actions/runs/22406470674