chore: exclude test fixtures from Socket dependency scanning

The redirect golden fixtures commit manifests/lockfiles that deliberately pin old, vulnerable dependency versions — they are the test inputs for a security-patching tool. Socket's PR scan flagged their CVEs (Puma, Flask) as project dependency alerts; socket.yml now scopes scanning away from the fixture trees. Assisted-by: Claude Code:claude-fable-5
Mikola Lysenko (mikolalysenko) · Jul 2, 2026 · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026
commit e93f21c9dfe1c9bc567cd0701c14d0c75987cd57
diff --git a/socket.yml b/socket.yml
@@ -0,0 +1,11 @@
+# Socket (socket.dev) scanner configuration.
+#
+# The redirect golden fixtures commit manifests/lockfiles that DELIBERATELY
+# pin old, vulnerable dependency versions — they are the test inputs for a
+# security-patching tool, and the vulnerable pins are the point. Exclude them
+# from dependency scanning so their CVEs don't block PRs as if they were real
+# project dependencies.
+version: 2
+projectIgnorePaths:
+  - "crates/socket-patch-core/tests/fixtures/**"
+  - "crates/socket-patch-cli/tests/fixtures/**"