Are dependency insights accurate?

[rmclaughlin-nelnet]

We have been using dependency insights to track vulnerabilitys across all our repos, but lately I have noticed that some vulnerabilities listed, and it says there are > 0 dependents, when I click on the dependents it shows ’ No dependents found’. Is this accurate? If so why is it showing in my list? Does it take a while for these resolved dependents to stop being reported? If so how long?

Screen Shot 2022-05-16 at 9.15.30 AM1027×121 9.25 KB

Screen Shot 2022-05-16 at 9.15.56 AM970×613 60.9 KB

[queenofcorgis]

Hey there @rmclaughlin-nelnet 👋t3:

So there is an open Issue with our internal team investigating this inaccuracy. In the meantime as we work on a fix, the counts would need to be rebuilt manually. A GitHub employee would have to do this so if you are in need of this, please open a ticket with Support.

[pacroy]

Hi @queenofcorgis , is there any update regarding this issue (Dependency Insights does not show accurate data)?
My organization wants to use this feature to see how much our internal Actions (and also reusable workflows) are used. But the report seem not get updated correctly..

[MichielOda]

Four years later, and the issue is still occurring...

It doesn't seem to be consistent. Some dependency versions work, while others don't.
For context, I'm an organization admin and Enterprise owner, so this doesn't appear to be an access or permissions issue.
From what I can tell, this only affects GitHub Actions.