xtask/tests/fixtures/gix_porcelain_in_server/osv-scanner.toml
# OSV-Scanner: this directory is a deliberate test fixture (xtask/tests), not a workspace
# Gunnar builds or ships. Its Cargo.lock names vulnerable releases ON PURPOSE so a gate test
# can prove it goes red; the advisories it carries are the point, not a defect.
[[PackageOverrides]]
ecosystem = "crates.io"
vulnerability.ignore = true
reason = "deliberate test fixture: the lock exists to make a gate test go red (xtask/tests); nothing here is built into Gunnar"