### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

osv-scan is red on fork PRs again, this time on gitpython and postcss.

I ran into it on #34527. That PR only touches two JSON cost maps and adds a test file, and both of the scanned lockfiles are byte identical to the base branch, so I ran the scan locally to figure out what was going on. Same osv-scanner v2.3.8 the workflow pins, same command:

``` Total 2 packages affected by 5 known vulnerabilities (0 Critical, 5 High, 0 Medium, 0 Low, 0 Unknown) from 2 ecosystems. 5 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------+---------+---------------+----------------------------------------+ | OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE | +-------------------------------------+------+-----------+-----------+---------+---------------+----------------------------------------+ | https://osv.dev/GHSA-3rp5-jjmw-4wv2 | 7.0 | PyPI | gitpython | 3.1.52 | 3.1.53 | uv.lock | |…