# If using SBOM input, automatically generate CPEs when packages have none
add-cpes-if-none: true

# ignore:
#   # This is the full set of supported rule fields:
#   - vulnerability: CVE-2008-4318
#     fix-state: unknown
#     package:
#       name: libcurl
#       version: 1.5.1
#       type: npm
#       location: "/usr/local/lib/node_modules/**"

#   # We can make rules to match just by vulnerability ID:
#   - vulnerability: CVE-2014-54321

#   # ...or just by a single package field:
#   - package:
#       type: gem