-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(vulnerabilities): do not force exact patch version for PyPI datasource in GitHub alerts #29586
fix(vulnerabilities): do not force exact patch version for PyPI datasource in GitHub alerts #29586
Conversation
…ource in GitHub alerts
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What about the change to the worker so that it picks the minimal instead of maximum matching version?
Should be warranted for GitHub alerts with this snippet: renovate/lib/workers/repository/process/lookup/index.ts Lines 364 to 366 in e6b04da
For OSV, this is a thing but I wanted to address this in a separate PR - see #29280 (comment) |
Yes you're right, I forgot that this is for non-OSV |
🎉 This PR is included in version 37.401.5 🎉 The release is available on: Your semantic-release bot 📦🚀 |
Follow-up issue: #29600 |
…ource in GitHub alerts (renovatebot#29586)
Changes
GitHub vulnerability alerts may suggest a particular patch version for PyPI dependencies that could be retracted, currently resulting in no PR being created at all. This change relaxes
==
to>=
, so that the first available version is picked.Context
Documentation (please check one with an [x])
How I've tested my work (please select one)
I have verified these changes via:
Test repo: renovate-demo/29572-renovate-python-requests#2