Config-help: [Question] PRs not opened for vulnerability alerts

[daern91]

Which Renovate are you using?

App

Which platform are you using?

GitHub

Have you checked the logs? Don't forget to include them if relevant

Yes, but they don't seem to output anything relevant in this case.

What is your question?

Do we need to set up any additional settings to get the vulnerability PRs to function? Current config looks like this https://github.com/sphereio/sphere-node-sdk/blob/master/renovate.json (package.json and lock file are also there)
but we never get any PRs for the four alerts we currently have in the repo.

I also saw this comment so I tried with the config provided in this issue: #138

{
  "packageRules": [{
    "packagePatterns": ["*"],
    "enabled": false
  }],
  "vulnerabilityAlerts": {
    "enabled": true
  }
}

But that didn't work either. Renovate just stays silent.

Any ideas on what I'm doing wrong here?

[rarkins]

You're not doing anything wrong, and you shouldn't need to configure any special functionality.

When I use your repo as an example, I see that one of the high risk warnings is js-yaml, which is not a direct dependency. Looking at your package-lock.json, I see that the vulnerable version is caused by [email protected].

Grunt is a direct dependency, specified as "grunt": "^1.0.3",

So Renovate needs to get smarter and realise automatically that grunt is the problem and update it as a security PR. Right now it's not that smart.

In the meantime the simplest thing you could do to get these types of vulnerabilities resolved automatically is to enable "lock file maintenance" by configuring this:

{
  "lockFileMaintenance": {
    "enabled": true
  }
}

Once a week it will totally refresh your lock file and submit a PR. In your case, I think it would clear 3/4 of the vulnerabilities.

[daern91]

Ahhh... I see, that makes a lot of sense. Thanks a lot for the explanation and I'll give lockFileMaintenance a shot.

May I also ask if this functionality is on renovate's roadmap?

[rarkins]

Yes, this month or next