1. Added CVE-2026-1703 (resolved in version 26.0) to the expected CVE
list for cpe:2.3:a:pypa:pip:9.0.3:*:*:*:*:python:*:*
2. Changed continuesToUpdate from false to true; pip is an actively
maintained package that continues to receive new CVE entries. Using
continuesToUpdate: true makes the test check that the expected CVEs are
a subset of found CVEs (via Contains) rather than requiring an exact
match (via ElementsMatch), preventing this test from breaking again when
the next pip CVE is published.
Victor Lyuboslavsky
0ff707a316