Snyk Code PR Check shows a 'new' vulnerability but the PR did not touch that file