Company security scanner flags and blocks internet access due to "vulnerable" rexml gemspec version

My company runs an (obnoxious) security scan that flags things that may not actually be a security concern, and in this case it has picked up the file `scancode-toolkit/tests/packagedcode/data/rubygems/installed/specifications/rexml-3.2.5.gemspec` as meaning that there is a copy of rexml version 3.2.5 installed that has a potential vulnerability that was fixed in version 3.3.9.

The super obnoxious part is that there is no way to permanently tell them the file is not an issue, and after a little while they block internet access on the computers that detect this "outdated component". Given that this file is checked into the scancode repository, that means I can't have a cloned copy of the scancode repository because the same file will just keep getting detected.

The solution is possibly updating the version referenced in the scancode-toolkit repository, though if scancode is using it for a regression test that looks for vulnerabilities in an old version then there is a certain irony here. Perhaps rather than test data files living in the main repository, they would be better off in a separate repository and included as a git submodule, which would at least enable having a clone of the main scancode-toolkit repository without setting off overzealous security scanners.

The 2nd entry shows the gemspec file in question being flagged. The others got resolved with `brew cleanup -s` to remove the old stuff, but the only solution I have for the scancode-toolkit repository is deleting my local clone.