diff --git a/Cargo.lock b/Cargo.lock
index 4a04a55..65ccb2d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -555,9 +555,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "anza-quinn"
@@ -1389,15 +1389,6 @@ version = "0.4.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d"
 
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "console"
 version = "0.16.3"
@@ -1496,9 +1487,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -2044,11 +2035,10 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
- "concurrent-queue",
  "parking",
  "pin-project-lite",
 ]
@@ -3218,9 +3208,9 @@ dependencies = [
 
 [[package]]
 name = "memmap2"
-version = "0.9.10"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
  "libc",
 ]
@@ -4906,7 +4896,7 @@ dependencies = [
  "itertools 0.12.1",
  "log",
  "lz4",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "modular-bitfield",
  "num_cpus",
  "num_enum",
@@ -5203,7 +5193,7 @@ dependencies = [
  "bv",
  "bytemuck",
  "bytemuck_derive",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "modular-bitfield",
  "num_enum",
  "rand 0.8.6",
@@ -6633,7 +6623,7 @@ dependencies = [
  "libc",
  "log",
  "lz4",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "mockall",
  "modular-bitfield",
  "num-derive",
diff --git a/osv-scanner.toml b/osv-scanner.toml
index b65c288..042b02b 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -69,10 +69,25 @@ reason = "rand 0.7.3 transitive via solana-* deps; fixed versions (0.8.6, 0.9.3)
 # osv-scanner.toml) were removed, matching the sibling vendored crates
 # vendor/solana-invoke and vendor/solana-keypair, which ship no lockfile.
 
-[[IgnoredVulns]]
-id = "RUSTSEC-2026-0173"
-# proc-macro-error2 2.0.1 is a build-time proc-macro helper pulled in transitively
-# via anchor-lang's derive macros. It runs only at compile time and is not part of
-# the on-chain BPF runtime. osv reports no fixed version (FIXED VERSION: --), so this
-# can only be filtered until anchor-lang migrates off proc-macro-error2.
-reason = "proc-macro-error2 2.0.1 transitive via anchor-lang derive macros; build-time proc-macro only, not in on-chain BPF runtime; no upstream fix available"
+# ── Version-scoped package exceptions ───────────────────────────────────────
+#
+# Prefer PackageOverrides over IgnoredVulns when only ONE version of a package
+# is unfixable. IgnoredVulns matches by advisory ID alone, so it would suppress
+# the advisory across the whole scan — including a future regression on a
+# non-dev path. This form pins the exception to the exact version.
+
+[[PackageOverrides]]
+name = "memmap2"
+version = "0.5.10"
+ecosystem = "crates.io"
+ignore = true
+# Reached only through the vendored solana-program-test dev-dependency:
+# solana-genesis-config 3.0.0 -> agave-snapshots -> solana-runtime ->
+# solana-banks-server -> solana-program-test. That chain pins the 0.5.x line,
+# so `cargo update` cannot lift it to 0.9.11 without an upstream Solana bump.
+#
+# The first-order path is NOT excepted — memmap2 0.9.10 was updated to the
+# fixed 0.9.11 in this same change, and because this override is version-scoped
+# RUSTSEC-2026-0186 still fires on any other memmap2 version. Drop this block
+# as soon as Solana moves off memmap2 0.5.
+reason = "memmap2 0.5.10 only, transitive via vendored solana-program-test (dev-dep); 0.9.x path already updated to the fixed 0.9.11; 0.5.x pin requires upstream Solana bump"