Suppress a known vulnerability in OSV-Scanner using an osv-scanner.toml IgnoredVulns entry with an expiry date

Verified steps

1. Place an osv-scanner.toml file in the same directory as the lockfile/manifest being scanned (config does not propagate to child directories); to apply one config across multiple directories instead, pass --config=/path/to/config.toml to override per-directory discovery for the whole scan.
2. Add a [[IgnoredVulns]] table for each vulnerability to suppress, setting id to the OSV/CVE/GHSA identifier you want ignored.
3. Set ignoreUntil to a bare TOML local date in YYYY-MM-DD format, unquoted (e.g. ignoreUntil = 2026-11-09) — not an RFC3339 timestamp string. This is optional; once the date passes, the ignore expires and osv-scanner resumes failing on that id.
4. Add a reason string field documenting why the exception exists, for audit/reviewability.
5. Be aware that ignoring a vulnerability id also ignores any vulnerabilities OSV considers aliases of that id, so check the aliases in scan output before assuming a suppression is narrowly scoped.
6. Re-run osv-scanner and confirm the suppressed id no longer appears in findings until ignoreUntil passes.