Context

You see findings in Endor Labs tagged with Approximation, and in some cases the dependency referenced by the finding does not appear to match what is declared in your manifest or installed in your environment. This article explains what an approximated dependency is, why Endor Labs produces them, what causes the version mismatch, and how to reduce or remove them.

Answer

What an approximation is

When Endor Labs cannot fully resolve your project's dependency graph — for example, your project does not have a committed lockfile, the install step did not run successfully, or the build could not be completed — Endor does not skip the project. Instead, it falls back on the unresolved dependency information available in your manifest and makes a best-effort guess at what would actually be installed.

• If a manifest entry is pinned to an exact version, Endor uses that version.

• If a manifest entry is a range or unpinned (for example, ^4.2.0, >=1.0,<2.0, or just a package name), Endor approximates the version, typically by selecting the latest available version.

Any dependency Endor adds through this fallback is tagged with Approximation = true so you can distinguish it from a fully resolved dependency. Findings on approximated dependencies inherit the same Approximation tag.

Why an approximated dependency may show an unexpected version

Two common explanations:

1. The package is in your manifest, but the version is different from what your lockfile would resolve to. For example, your manifest declares requests>=2.0. Your lockfile would resolve to 2.31.0, but because Endor didn't have access to your lockfile, it approximated the version to the latest available release. The vulnerability may apply to that newer version but not to the version you actually have installed. The package itself is genuinely a dependency of your project, only the version Endor used is a best guess. This is a known false-positive case for approximate scans.

2. Resolution failed and Endor fell back to approximation. This is the underlying trigger for approximation in the first place. The remediation is to make resolution succeed (see the next section).

Resolved vs Approximated Dependency

How to remove approximations from your findings

To eliminate approximation as a source of noise:

1. Commit a lockfile to source control (package-lock.json, yarn.lock, Pipfile.lock, go.sum, Cargo.lock, etc.). This is the most reliable fix.

2. Run the Endor scan after installing dependencies, so a resolved dependency graph exists for Endor to analyze.

3. Fix any build or resolution errors surfaced during the scan. These are typically what cause Endor to fall back to approximation.

4. Apply the "Approximate Dependency" exception through a finding policy if a specific approximated finding is not actionable and you've confirmed it is a false positive.

Sources:

• Approximate Scans

• Reachability Analysis — Phantom Dependencies

• Findings