Is there a way to ignore all vulnerabilities for a given lockfile?

[ia0]

I'm currently having an osv-scanner.toml file next to the Cargo.lock file for which I don't care about vulnerabilities:

# This crate is used for benchmarks only. Those alerts can't be fixed because one of the comparison
# point, namely wasm3, is dead although it is the best benchmark reference so far.
IgnoredVulns = [
  { id = "GHSA-crf8-h2wq-2h9x" },
  { id = "GHSA-g98v-hv3f-hcfr" },
  { id = "GHSA-gq4p-4hxv-5rg9" },
  { id = "GHSA-r7qv-8r2h-pg27" },
  { id = "RUSTSEC-2021-0139" },
]

Ideally, I would like something like:

# This crate is used for benchmarks only. Those alerts can't be fixed because one of the comparison
# point, namely wasm3, is dead although it is the best benchmark reference so far.
ignore = true

This is more maintenable and describes the intent better.

I tried to find the schema of the osv-scanner.toml file, but only found the few examples in https://google.github.io/osv-scanner/configuration/.

Thanks!

[another-rex]

This is almost certainly something we want to add!

For now maybe you can try ignoring the packages with [[PackageOverrides]] (which might be fewer than all the vulnerabilities)

[oliverchang]

@G-Rath is this something you'd be able to help us with?

[ia0]

Thanks a lot for the fix!