diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 0000000..0e963a1
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,3 @@
+[[IgnoredVulns]]
+id = "GHSA-hp3w-g68c-fv3c"
+reason = "sprintf-js is a transitive dev-only dependency (via argparse) and is not included in the dist bundle, so there is no production impact."