From a779d45035ddbb74819f3936c04c994add7c523d Mon Sep 17 00:00:00 2001
From: Cure53 <mario@cure53.de>
Date: Mon, 27 Jul 2026 17:39:54 +0200
Subject: [PATCH] Add ignored vulnerabilities for AngularJS EOL

---
 osv-scanner.toml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/osv-scanner.toml b/osv-scanner.toml
index 8278c74..13fe13e 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -30,6 +30,14 @@ id = "GHSA-4w4v-5hc9-xrr2"
 ignoreUntil = 2027-06-22
 reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
 
+# CVE-2026-11998 (SCE resource-URL policy bypass), published 2026-06-24 - after
+# this block was written. Same terminal situation: AngularJS is EOL, no fixed
+# release exists or will exist, and the fixture must stay vulnerable by design.
+[[IgnoredVulns]]
+id = "GHSA-7x27-g8rg-x87w"
+ignoreUntil = 2027-06-22
+reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
+
 [[IgnoredVulns]]
 id = "GHSA-j58c-ww9w-pwp5"
 ignoreUntil = 2027-06-22