# Negative fixture for CVE-2026-73296: UFO pinned at the 3.0.8 fix, which adds
# inbound auth to the mobile MCP servers. The rule must not fire here.
git+https://github.com/microsoft/UFO@3.0.8
mcp>=1.28.1
