Vuln4Real: A methodology for counting actually vulnerable dependencies