Update osvVulnerabilityAlerts to allow other range strategies #30854
aarongoldenthal
started this conversation in
Suggest an Idea
Replies: 1 comment
-
Hi there, Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible. Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues. Please follow these steps:
Good luck, The Renovate team |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Tell us more.
It appears the current implementation of osvVulnerabilityAlerts is using a
rangeStrategy
ofauto
orupdate-lockfile
. It would be helpful ifrangeStrategy
would default to the current value for the applicable dependency.For example, today, with Renovate config:
...and an npm package with
"dependencies": { "axios": "^1.7.3" }
, Renovate:package-lock.json
toaxios@1.7.4
to resolve the vulnerabilitynpm
rangeStrategy
and updates thepackage.json
to"dependencies": { "axios": "^1.7.4" }
.This works, but would be helpful if the
rangeStrategy
for the manager were respected initially so it didn't require multiple PRs.Alternatively, or maybe in addition,
osvVulnerabilityAlerts
could be updated to accept the same, or similar, configuration asvulnerabilityAlerts
(which includesrangeStrategy
).Beta Was this translation helpful? Give feedback.
All reactions