# CVEs open by version, per external component -- DOCUMENTATION,
# not a gate. The test reports the difference to this file and
# does NOT fail on it: this count is what the advisories say
# about our version BEFORE reachability, and it cannot reach 0
# while an advisory names no fixed release. What the test does
# assert is the AFFECTED count, after reachability, against 0.
# Asserting this one meant an expectation of 19 let 19 open CVEs
# pass, which is the one thing a CVE gate must not do.
# A line here says: this component carries an advisory we cannot
# close ourselves. Why it does not affect us is in NAFCVE.doc.txt.
# Format: PACKAGE	COUNT	WHY
lmdb	1	Debian's record has no fixed version, so it reads as open at every version; we are not affected -- the defect is in mdb_load.c, which we do not link (NAFCVE.doc.txt)