fix(vulnerabilities): do not force exact patch version for NuGet datasource

[Churro]

Changes

PR #26150 added support for NuGet version ranges and thereby unlocked the possibility to also use them as version constraints in vulnerability fix PRs.

Context

• fix(vulnerabilities): do not force exact patch version in OSV alerts #29666

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

Test repos:

• GitHub alerts: Update dependency NHibernate to 5.4.9 [SECURITY] renovate-demo/26150-nuget-github#2
• OSV: Update dependency NHibernate to 5.4.9 [SECURITY] renovate-demo/26150-nuget-osv#1

[rarkins]

Does Nuget versioning support this syntax?

[Churro]

Does Nuget versioning support this syntax?

Yes, there is also a test for exactly the same range format used in this PR:

renovate/lib/modules/versioning/nuget/parser.spec.ts

Lines 157 to 165 in f183185

	it('parses range without upper bound', () => {
	expect(parseBracketRange('[1.2.3,)')).toEqual({
	type: 'nuget-bracket-range',
	min: { type: 'nuget-version', major: 1, minor: 2, patch: 3 },
	max: undefined,
	minInclusive: true,
	maxInclusive: false,
	});
	});

[rarkins]

Great. Have you been able to verify that this works "end to end" in a real repo?

[Churro]

Great. Have you been able to verify that this works "end to end" in a real repo?

Yes, therefore I've linked two test repos (see above)

[rarkins]

Sorry, I should have checked more closely (on mobile, it was hidden by default)

[renovate-release]

🎉 This issue has been resolved in version 38.59.2 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)
• 38.59.2

Your semantic-release bot 📦🚀