osv-scanner.toml

# Accepted OSV exceptions must also have an active, unexpired record in
# config/dependency-risks.toml.

[[IgnoredVulns]]
id = "PYSEC-2026-2132"
reason = "DR-005-click-command-injection: Semgrep 1.169.0 requires Click 8.1.x; Agent Maintainer does not use click.edit()."
ignoreUntil = 2026-07-28

[[IgnoredVulns]]
id = "CVE-2026-7246"
reason = "DR-005-click-command-injection: alias of PYSEC-2026-2132 under the same time-bounded Semgrep constraint."
ignoreUntil = 2026-07-28

[[IgnoredVulns]]
id = "GHSA-47fr-3ffg-hgmw"
reason = "DR-005-click-command-injection: alias of PYSEC-2026-2132 under the same time-bounded Semgrep constraint."
ignoreUntil = 2026-07-28

[[IgnoredVulns]]
id = "CVE-2026-52869"
reason = "DR-006-semgrep-mcp-vulnerabilities: Semgrep 1.170.0 pins MCP 1.23.3; Agent Maintainer does not expose MCP server transports."
ignoreUntil = 2026-07-31

[[IgnoredVulns]]
id = "GHSA-jpw9-pfvf-9f58"
reason = "DR-006-semgrep-mcp-vulnerabilities: alias of CVE-2026-52869 under the same time-bounded Semgrep constraint."
ignoreUntil = 2026-07-31

[[IgnoredVulns]]
id = "CVE-2026-52870"
reason = "DR-006-semgrep-mcp-vulnerabilities: Semgrep 1.170.0 pins MCP 1.23.3; Agent Maintainer does not enable experimental MCP tasks."
ignoreUntil = 2026-07-31

[[IgnoredVulns]]
id = "GHSA-hvrp-rf83-w775"
reason = "DR-006-semgrep-mcp-vulnerabilities: alias of CVE-2026-52870 under the same time-bounded Semgrep constraint."
ignoreUntil = 2026-07-31

[[IgnoredVulns]]
id = "CVE-2026-59950"
reason = "DR-006-semgrep-mcp-vulnerabilities: Semgrep 1.170.0 pins MCP 1.23.3; Agent Maintainer does not expose the deprecated MCP WebSocket transport."
ignoreUntil = 2026-07-31

[[IgnoredVulns]]
id = "GHSA-vj7q-gjh5-988w"
reason = "DR-006-semgrep-mcp-vulnerabilities: alias of CVE-2026-59950 under the same time-bounded Semgrep constraint."
ignoreUntil = 2026-07-31