feat: open pull requests for security advisories

[cryptodev-2s]

Explanation

Renovate currently opens nothing for security advisories. Every run logs:

WARN: Cannot access vulnerability alerts. Please ensure permissions have been granted. (repository=MetaMask/core)

osvVulnerabilityAlerts makes it read advisories from osv.dev instead of GitHub's alerts API, which needs no new token permission. That matters here: granting the App a permission it does not already hold fails at the exchange with a 500 rather than degrading, which is what happened with statuses: write in #10316 and had to be reverted by #10317. This route works today with the token we already have.

No other config is needed. Renovate's vulnerabilityAlerts defaults already do the right thing for us:

Default	Effect here
dependencyDashboardApproval: false	security fixes bypass our approval gate
minimumReleaseAge: null	and the three day age gate
prCreation: 'immediate', prConcurrentLimit: 0	not queued or capped
rangeStrategy: 'update-lockfile'	lockfile only, so no changelog entry is required
commitMessageSuffix: '[SECURITY]'	visible in the commit

Important

Dependabot security updates are still enabled, so for a while both bots will open a pull request for the same advisory. That is the point at which we can decide whether Renovate replaces Dependabot here, and it is worth watching for the first few advisories rather than assuming.

Two known limits: osvVulnerabilityAlerts is marked experimental upstream (renovate#20542), and the Cannot access vulnerability alerts warning will keep appearing, since Renovate still tries GitHub's API as well.

References

Follows #10495. Part of WPC-1161.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Single Renovate config flag with no application code changes; main operational note is possible duplicate security PRs alongside Dependabot and upstream’s experimental OSV support.

Overview
Turns on osvVulnerabilityAlerts in renovate.json so Renovate can open pull requests for known vulnerabilities using osv.dev instead of GitHub’s vulnerability alerts API, which the current App token cannot access (and expanding permissions has failed before).

Security fix PRs should still follow Renovate’s built-in vulnerability defaults (immediate creation, bypass of the dependency dashboard approval and 3-day minimumReleaseAge, [SECURITY] suffix, lockfile-focused updates). Dependabot security updates remain on, so duplicate advisory PRs are possible until the team decides to consolidate bots.

^{Reviewed by Cursor Bugbot for commit 4468bca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4468bca. Configure here.}

[cursor]

Security PRs may miss fresh patches

Medium Severity

osvVulnerabilityAlerts plus the existing 3-day minimumReleaseAge can drop a just-released patched version as pending before vulnerabilityAlerts overrides apply. A [SECURITY] PR may then target an older still-vulnerable release, so merging it does not remediate the advisory.

 

^{Reviewed by Cursor Bugbot for commit 4468bca. Configure here.}