fix(vulnerabilities): do not force exact patch version in OSV alerts

[Churro]

Changes

OSV vulnerability alerts may suggest a particular patch version that could be retracted, currently resulting in no PR being created at all. This change relaxes == to >=, so that the first available version is picked.

This PR also removes an extra condition for OSV that caused advisories with last_affected field set to suggest the newest version, rather than the minimal patched version. Advisories usually populate the fixed version, not the last_affected field, so this was infrequently used. Now this the change to >= e.g., for pypi, the security fix PR would suggest version 2.32.3 to address CVE-2024-35195 in requests <= 2.32.0, whereas the minimal patched version is 2.32.2 (see test repo).

Context

• Closes Verify OSV alert logic (and maybe make code changes as needed) #29342
• Fixes OSV disables upgrading to patched version #29280
• GitHub vulnerability alerts: do not limit to single version #29600
• Python package `requests` not being updated to latest version #29572
• fix(vulnerabilities): describe last_affected version as ecosystem-specific version constraint #27363 (review)

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

• Test repo with requests: Update dependency requests to v2.32.2 [SECURITY] renovate-demo/29280-osv-requests#1
• Test repo with different managers: https://github.com/renovate-demo/29666-osv/pulls

[Churro]

Update: As requested, I've now extended the change to cover not only pypi but all managers.

New test repo: https://github.com/renovate-demo/29666-osv/pulls

[renovate-release]

🎉 This PR is included in version 37.408.2 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)
• 37.408.2

Your semantic-release bot 📦🚀