Our dependency checker has had a few incidents reporting false positives which has resulted in the deps being added to the ignore file. This is obviously unideal and we should see if perhaps another tool may be better suited.