# What the OpenSSF Scorecard's Vulnerabilities check reads before it flags a
# module. Scorecard runs osv-scanner over go.mod, which has no idea which
# packages of a module are imported; govulncheck (its own workflow) does, and
# is the authority on whether an advisory reaches this binary. An advisory
# belongs here only when govulncheck has already said it is unreachable and
# there is no version to move to -- an ignore for a fixable finding is a fix
# not taken. Every entry names why, and a fix that later ships removes it.
#
# osv-scanner reads the configuration that sits beside the manifest it scans,
# so the npm lockfiles this repository carries are covered by a copy of these
# rules beside each lockfile.

[[IgnoredVulns]]
id = "GO-2026-5932"
reason = "golang.org/x/crypto/openpgp is unmaintained by design and affected at every version; nothing in this module's import graph reaches that package (`go list -deps ./... | grep openpgp` is empty, and govulncheck agrees)."