Dependabot alerts show up for archived repositories

[mgol]

When I go to the Dependabot Alerts page for a recent vulnerability in Grunt and filter by my user, it shows up archived repositories in addition to the regular ones. The URL for me is:
https://github.com/advisories/GHSA-m5pj-vjjf-4m3h/dependabot?query=user:mgol

How to stop it from happening?

I even unarchived the repisitory, disabled dependabot security alerts in settings and archived it again but nothing changed.

[rsclarke]

Hey, was the Dependabot Alert raised prior to archiving the project? Perhaps they are treated like other issues and pull requests and must be individually dismissed before archiving.

[mgol]

No, the alert was recent and the repo was archived long ago.

[rsclarke]

Unfortunately I'm not so sure then. From my understanding Dependabot Security Alerts are not raised against archived projects. This seems like a bug or is it occurring on multiple repositories or now stopped?

[mgol]

This specific vulnerability lists two of my archived repositories. It hasn't stopped.