osv-scanner.toml

# OSV-Scanner suppressions for the databricks-sql-nodejs security gate.
#
# Each entry suppresses a CVE that is a documented false positive
# against an artifact we ship, or is a dev-only finding that doesn't
# reach the shipped `dist/`. Every entry has a justification.
#
# Trade-off worth noting: [[IgnoredVulns]] entries are CVE-id global --
# they ignore the CVE across all packages OSV reports it against, not
# just the artifact we have in mind. The alternative
# ([[PackageOverrides]] with `vulnerability.ignore = true`) is
# per-package but blanket-ignores ALL vulnerabilities on that package,
# which is much worse. OSV-Scanner v2.3.8 does NOT support an
# intersection ("this CVE on this package only").
#
# See google.github.io/osv-scanner/configuration/ for the schema.
#
# CONVENTION: use suppressions sparingly, only with a strong reason
# (unreachable code path + no fix available, or dev-only + not shipped).
# EVERY [[IgnoredVulns]] entry MUST set `ignoreUntil = "YYYY-MM-DD"`
# (~6 months out). OSV-Scanner v2.3.8 honors it natively; when it lapses
# the finding re-surfaces, forcing a re-review instead of a permanent
# silent ignore.
#
# Example:
#   [[IgnoredVulns]]
#   id = "GHSA-xxxx-xxxx-xxxx"
#   ignoreUntil = "2026-01-15"
#   reason = "dev-only (eslint toolchain); not reachable from shipped dist/."
#
# This file starts empty -- populate iteratively as the first scan run
# surfaces real false positives or dev-only findings worth excluding.
# Do not pre-populate with speculative suppressions.
#
# NOTE (brace-expansion / CVE-2026-14257, GHSA-mh99-v99m-4gvg): this OOM
# DoS is intentionally NOT suppressed. Its affected range is
# `introduced=0, fixed=5.0.8` and 5.0.8 is not yet published to npm
# (latest is 2.1.2), so there is no version to bump to -- it cannot be
# resolved today. It is left visible so the scan keeps surfacing it and
# it gets picked up as soon as a fix is published, rather than being
# silently ignored. (It is dev-only -- pulled in transitively via
# minimatch under eslint/mocha/nyc, not in the production tree, and not
# bundled in the shipped dist/ -- so the exposure is limited to the local
# lint/test toolchain.) The sibling CVE-2026-13149 (GHSA-3jxr-9vmj-r5cp)
# IS fixed, via package.json `overrides` (brace-expansion@1 -> 1.1.16,
# @2 -> 2.1.2).