Can I make Renovate prioritize Vulnerabilities "no matter what"?

[stdedos]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitlab, latest

Please tell us more about your question or problem

prPriority seems to be a packageRules thing.

The documentation says that vulnerabilities skip the queue, but it also says that it's a Github feature.

... but it seems that osvVulnerabilityAlerts "sort-of works" (i.e., I got [SECURITY] candidates)

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    ":automergeDisabled",
    ":automergeRequireAllStatusChecks",
    ":combinePatchMinorReleases",
    ":ignoreModulesAndTests",
    ":ignoreUnstable",
    ":maintainLockFilesDisabled",
    ":prConcurrentLimit20",
    ":separateMajorReleases",
    "config:best-practices",
  ],
  "packageRules": [
    {
      "description": "Renovate configuration for backend",
      "matchFileNames": ["backend/**"],
      "matchManagers": ["bundler"],
      "addLabels": ["backend"],
      "commitMessagePrefix": "<>: Renovate - ",
      // Backend never pins versions.
      "rangeStrategy": "replace",
    },
    {
      "description": "Mark major version upgrades",
      "matchUpdateTypes": ["major"],
      "commitMessageSuffix": " [Major]",
    },
    // This should be a roundabout way of saying "but please open vulnerability MRs"; see
    // https://github.com/renovatebot/renovate/discussions/15490#discussioncomment-2702421.
    {
      "description": "Stables require explicit approval",
      "matchBaseBranches": [
        ...
      ],
      "dependencyDashboardApproval": true,
    }
  ],
  "includePaths": [
    "backend/**",
  ],
  "enabledManagers": [
    "bundler",
  ],
  "addLabels": ["renovate"],
  "assigneesFromCodeOwners": true,
  "assigneesSampleSize": 1,
  "reviewersFromCodeOwners": true,
  "reviewersSampleSize": 2,
  "branchPrefix": "renovate/",
  "ignoreTests": false,
  "minimumReleaseAge": "7d",
  // We do not have `GITHUB_COM_TOKEN` set, so we cannot use `fetchChangeLogs`.
  "fetchChangeLogs": "off",
  // Enable and track Vulnerabilities.
  "osvVulnerabilityAlerts": true,
  "dependencyDashboardOSVVulnerabilitySummary": "all",
  "vulnerabilityAlerts": {
    "rangeStrategy": "bump",
  },
  "baseBranches": [
    "master",
    ...
  ]
}

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[rarkins]

@Churro do you know if the osv vulnerability alerts feature bypasses limits/prioritizes security updates like what happens for Dependabot alerts?

[stdedos]

Okay, but it seems for some reason it's not working on my deployment 😕

I have 10 MRs started, :prConcurrentLimit20, and the Dependency Dashboard shows 12 possible MRs.

I have an .ndjson file, but I'm unable to share it publicly.

[viceice]

you should set a github.com token if you're using osv.

also renovates default install binary source needs it for most managers.

[dencu]

@Churro Could you please explain what isVulnerabilityAlert: true does and where to put that flag?

FYI, I am using self-hosted Renovate and trying to update configuration to be able to create major MRs and security MRs for the same dependency at the same time.

[RahulGautamSingh]

isVulnerabilityAlert is used internally ie. not an option/flag you can use.

What you are trying to achieve is not possible. If there is a vulnerability PR for a package then we prioritize it first and hold back the other releases, once the vul PR is merged you will get the other update PRs.

[dencu]

Okay, that makes sense. Thanks for the explanation.