Verify OSV alert logic (and maybe make code changes as needed)

[HonkingGoose]

Describe the proposed change(s).

Check if the OSV alert logic is correct, and behaving like we want. @churro wanted to check this for us, so here's the issue to track that work.

Relevant discussion

Quotes come from:

• OSV disables upgrading to patched version #29280

@rarkins said:

Renovate's other vulnerability handling (GitHub alerts, or Mend's SCA products) use >= for this reason plus this logic:

renovate/lib/workers/repository/process/lookup/index.ts

Lines 364 to 366 in 9e2ca6b

	if (config.isVulnerabilityAlert && !config.osvVulnerabilityAlerts) {
	filteredReleases = filteredReleases.slice(0, 1);
	}

In other words it becomes "take the first release which exists greater than or equal to x.y.z". Usually it's x.y.z but sometimes it can be higher due to reasons like this.

I wasn't involved in the OSV implementation although you can see from the code I linked to that @Churro was aware of it when implementing

Response from @Churro

I don't remember why back then I thought it's necessary to treat OSV alerts differently but I can verify this over the next few days.

Tip

You may want to check out our fork of @astellingwerf's reproduction for Discussion 29280 and Issue 29342 to confirm if the OSV logic is working as intended.

[HonkingGoose]

See comment:

• OSV disables upgrading to patched version #29280 (comment)