Where Does osv-scanner Store Its Config?
osv-scanner reads osv-scanner.toml beside each manifest (non-propagating), with --config overriding everything.
Last updated
osv-scanner pairs each lockfile with a neighboring osv-scanner.toml holding IgnoredVulns and PackageOverrides. Placement is deliberate: configs apply to their own directory only, never to children, so each manifest carries its exceptions.
Overrides match on name, version, ecosystem and group with optional regex, acting on vulnerabilities, licenses or both. License scanning rides the same file, which keeps allow lists next to the ignores they resemble.
Where osv-scanner stores this, by platform
[RepoDir]\osv-scanner.toml
Per-manifest ignores and overrides. Pre-commit hook available (osv-scanner id); --format/--output-file shape reports without touching config.
[RepoDir]/osv-scanner.toml
Same file. ScanGoModVersion and GoVersionOverride fix Go toolchain false positives when the go directive misleads the matcher.
[RepoDir]/osv-scanner.toml
Same layout. Offline matching (--offline-vulnerabilities with downloaded DBs) reuses the same configs for air-gapped runs.
Frequently asked questions
Can I use one global config instead of per-directory files?
Pass --config <path>. The override applies to every scanned file and ignores all in-tree osv-scanner.toml files, which suits centrally managed exception lists.
How do I keep vulnerability exceptions from going stale?
Add an expiry (ignoreUntil/effectiveUntil) plus a reason to every entry. Exceptions without dates rot silently; dated ones resurface for review on schedule.
Notice an outdated path? Let us know.