Project migrated to UV still showing Poetry findings

[nicholas-lockhart-indico]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Discussion Details

Our team has recently started using the Dependabot functionality, which has led us to reviewing the Dependency Graph. We have a repository that we updated from poetry to uv three weeks ago. When looking at the Dependency Graph, we see entries from the uv.lock file, but we also see entries from the poetry.lock file, which no longer exists. We did a refresh on the Dependency Graph, and it shows that it did update with a specific commit. However, the poetry.lock file entries are still present. There is a link on the Dependency Graph that is supposed to lead to the poetry.lock file that it is referencing, but that link gives a 404.

Is there some sort of cache that needs to be cleared to remove these phantom poetry.lock entries? What are we missing to get these entries to fully disappear?

[Mehrab-Javadzadeh]

That doesn't sound like the expected behavior.
If the poetry.lock file has been removed from the repository and the Dependency Graph has already been refreshed against a newer commit, I'd expect those dependencies to disappear as well. The fact that the link to the old lock file returns a 404 makes it seem like the graph is holding onto stale metadata.
I don't think there's a cache that repository owners can clear manually. This sounds more like something on GitHub's side.

Hopefully someone from the GitHub team can confirm whether this is a known issue with the Dependency Graph or Dependabot indexing. In the meantime, it might also be helpful to mention whether the repository is public or private and whether the poetry.lock file was removed from the default branch, as those details could help narrow it down.

[iawaisahmd]

If poetry.lock has been removed from the default branch and the Dependency Graph has already been refreshed against a commit where it no longer exists, those findings should normally disappear. There isn't a user-facing cache you can clear for the Dependency Graph.

The lingering entries and 404 link suggest stale dependency metadata rather than a repository configuration issue. If the refresh doesn't resolve it after some time, it's likely something GitHub Support will need to investigate on the backend.