On the Accuracy of GitHub's Dependency Graph

What is it about?

GitHub's Dependency Graph is a simple way to visualize the dependencies and dependents of a software project hosted on GitHub. We want to asses the accuracy of the information contained in the Dependency Graph and any implication that may arise on the tools based on it.

Featured Image

Photo by Roman Synkevych on Unsplash

Photo by Roman Synkevych on Unsplash

Why is it important?

The majority of the analyzed projects have inaccuracies on their GitHub’s dependency graph, either in dependents or dependencies. Moreover, the dependency information from manifest/lock files and GitHub’s dependency graph does not always match. Thus, might affect the output of tools based on GitHub’s dependency graph (e.g., Dependabot and SBOM generators) as well as the outcomes of past empirical studies.