osv-scanner.toml

# OSV-Scanner suppressions for the databricks-sql-nodejs security gate.
#
# Each entry suppresses a CVE that is a documented false positive
# against an artifact we ship, or is a dev-only finding that doesn't
# reach the shipped `dist/`. Every entry has a justification.
#
# Trade-off worth noting: [[IgnoredVulns]] entries are CVE-id global --
# they ignore the CVE across all packages OSV reports it against, not
# just the artifact we have in mind. The alternative
# ([[PackageOverrides]] with `vulnerability.ignore = true`) is
# per-package but blanket-ignores ALL vulnerabilities on that package,
# which is much worse. OSV-Scanner v2.3.8 does NOT support an
# intersection ("this CVE on this package only").
#
# See google.github.io/osv-scanner/configuration/ for the schema.
#
# CONVENTION: use suppressions sparingly, only with a strong reason
# (unreachable code path + no fix available, or dev-only + not shipped).
# EVERY [[IgnoredVulns]] entry MUST set `ignoreUntil = YYYY-MM-DD`
# (~6 months out). OSV-Scanner v2.3.8 honors it natively; when it lapses
# the finding re-surfaces, forcing a re-review instead of a permanent
# silent ignore.
#
# Example:
#   [[IgnoredVulns]]
#   id = "GHSA-xxxx-xxxx-xxxx"
#   ignoreUntil = 2026-01-15  # bare TOML date; a quoted string fails to parse
#   reason = "dev-only (eslint toolchain); not reachable from shipped dist/."
#
# This file starts empty -- populate iteratively as the first scan run
# surfaces real false positives or dev-only findings worth excluding.
# Do not pre-populate with speculative suppressions.

[[IgnoredVulns]]
id = "GHSA-vfj7-8cjw-p6xm"
ignoreUntil = 2026-12-06
reason = "braces: no fixed release (3.0.3 is latest). Dev-only (mocha -> chokidar, globby -> fast-glob -> micromatch); not in shipped dist/."