Missing Dependabot Alerts and Security updates

[zidik]

After testing out this workflow, I see that it uploads the dependency graph, but I am not receiving Dependabot alerts, as mentioned in the Readme.

I've set up an example project with two vulnerabilities:

• (Critical) CVE-2017-20166 Ecto lacks a protection mechanism, version 2.2.0
• (Low) CVE-2025-1211 Server-side Request Forgery (SSRF) in hackney, versions before 1.21.1.

Thanks to this workflow, Github has the full dependency tree. It recognizes both depencencies (Ecto 2.0.0 and Hackney 1.17). Both of them are in GitHub Security Advisory Database (see links above), but no alerts are generated from Dependabot.

Am I missing something?

[maennchen]

@zidik I'm aware of the issue and am in contact with the GH team. Unfortunately I have no ETA yet on a fix.