org.projectfile.vulnerabilities

Tool-agnostic list of suppressed vulnerability IDs (CVE/GHSA) that fans the same set out to every scanner ignore file the project runs: .trivyignore (trivy), .grype.yaml (grype), osv-scanner.toml (osv). Declare a known-unfixable vuln once and every scanner drops it, so trivy, grype and osv can never disagree on whether it gates publish. generate opts a project out of scanners it does not run (default: all). An entry’s optional name holds the advisory title, cached from osv.dev.

Namespace: org.projectfile.vulnerabilities
Owner: projectfile.org (community-maintained)
Status: proposed

Shape

Illustrative fragment — not a complete projectfile document. Consumers MUST round-trip unknown namespaces even when no shape is published.

---# SPDX-FileCopyrightText: 2026 Damián Búho <damian.buho@proton.me>## SPDX-License-Identifier: CC-BY-4.0# SPDX-License-Identifier: MIT
# Shape: org.projectfile.vulnerabilities extension namespace# Illustrative fragment — not a complete projectfile document.# See registry.yaml for ownership and status.
org:  projectfile:    vulnerabilities:      # generate selects which scanner ignore files to emit. Keys are the      # scanner extKeys ("trivy", "grype", "osv"). OPTIONAL — when omitted,      # every scanner that has at least one suppressed ID gets a file      # ("specify once, fan out everywhere").      generate: [trivy, grype, osv]
      # suppress is the tool-agnostic list of vulnerability IDs (CVE/GHSA) to      # drop from every scanner's report. Each entry fans out to:      #   .trivyignore       (trivy — one ID per line; reason dropped)      #   .grype.yaml        (grype — ignore[].vulnerability; reason as comment)      #   osv-scanner.toml   (osv — [[IgnoredVulns]] id/reason)      # A bare string is accepted as shorthand for an entry with just an id.      # name is OPTIONAL: the advisory’s title, cached here from osv.dev.      suppress:        - id: CVE-2026-31608          name: "linux: kernel headers expose an out-of-bounds read"          reason: unfixable kernel headers shipped by linux-libc-dev        - id: CVE-2025-40190

[org.projectfile.vulnerabilities]generate = [ "trivy", "grype", "osv" ]
[[org.projectfile.vulnerabilities.suppress]]id = "CVE-2026-31608"name = "linux: kernel headers expose an out-of-bounds read"reason = "unfixable kernel headers shipped by linux-libc-dev"
[[org.projectfile.vulnerabilities.suppress]]id = "CVE-2025-40190"

{  "org": {    "projectfile": {      "vulnerabilities": {        "generate": [          "trivy",          "grype",          "osv"        ],        "suppress": [          {            "id": "CVE-2026-31608",            "name": "linux: kernel headers expose an out-of-bounds read",            "reason": "unfixable kernel headers shipped by linux-libc-dev"          },          {            "id": "CVE-2025-40190"          }        ]      }    }  }}

.onion .i2p