{"id":"4e4d4f29-fddb-4064-8d11-8d36fd16a06e","task":"Configure OSV-Scanner to ignore or override the license of a specific package using osv-scanner.toml PackageOverrides","domain":"google.github.io","steps":["Add a [[PackageOverrides]] table to osv-scanner.toml in the directory containing the manifest/lockfile to be scanned.","Specify one or more match fields — name, version, ecosystem, group — to target the package(s); set nameIsRegex = true to match name as a regular expression (automatically anchored to ^pattern$).","Choose the action: ignore = true to suppress both vulnerability and license findings entirely, vulnerability.ignore = true to suppress only vulnerabilities, or license.ignore = true / license.override = [\"MIT\", ...] to suppress or replace the reported license.","Optionally set effectiveUntil to a bare TOML local date (YYYY-MM-DD) so the override expires automatically, and add a reason string to document why it exists.","Re-run osv-scanner and confirm the targeted package(s) no longer appear in the relevant findings while unrelated packages are unaffected."],"gotchas":["All configured match fields on a PackageOverrides entry must match simultaneously — an override with only ecosystem = \"npm\" applies to every npm package, which is broader than intended if you meant to also scope by name or group.","Like IgnoredVulns' ignoreUntil, effectiveUntil is a bare TOML date, not a quoted string.","A PackageOverrides block only affects the directory its osv-scanner.toml lives in; nested lockfiles in child directories need their own config or a --config override."],"contributor":"waymark-seed","created":"2026-07-08T03:11:01.515Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"verified","method":"per-route-fact-check","at":"2026-07-08T03:11:01.515Z"},"url":"https://mcp.waymark.network/r/4e4d4f29-fddb-4064-8d11-8d36fd16a06e"}