is "vulnerabilityAlerts" for supported self-hosted renovate on gitlab platform

[prasadthotakura]

I'm trying to use self-hosted renovate(v32.39) that can run part of our gitlab(v14.7.7 enterprise) CI pipeline job for updating ONLY the open source libraries security vulnerabilities. I'm trying following rules in config.json

"packageRules": [  
    {  
      "matchDatasources": ["gradle-version", "maven"],  
      "registryUrls": [  
        "registry1",  
        "registry2",  
        "registry3"  
      ] 
    },
    {
      "matchPackageNames": ["*"],
      "matchUpdateTypes": ["major", "minor", "patch"]
    }
  ],
"vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security bot updates"]
  }

And I see the following debug statement in the logs

DEBUG: No vulnerability alerts found (repository=samplerepo)

I expect MRs to be created only for libraries that have security vulnerabilities. But I see renovate is creating the MRs for libraries that don't have any security vulnerabilities.

is vulnerabilityAlerts supposed to work for gitlab?

[rarkins]

No, it uses GitHub's alerts API for each repo

[prasadthotakura]

It would be great to have similar support for gitlab as well.
Is there any way that we can extend/override to call gitlab APIs instead of github APIs?

[viceice]

no, we working on an alternative, but that needs time.

[rarkins]

It would be great to have similar support for gitlab as well.

Is there any way that we can extend/override to call gitlab APIs instead of github APIs?

Which gitlab API?

[prasadthotakura]

vulnerability_findings API

[rarkins]

Looks to be an ultimate only feature, which is a very small percentage of our gitlab user base.

[philippe-granet]

@prasadthotakura Release https://github.com/renovatebot/renovate/releases/tag/34.129.0 add feature-flagged support for OSV (#20226) (a91ca62)

https://docs.renovatebot.com/configuration-options/#osvvulnerabilityalerts

Renovate integrates with OSV, an open-source vulnerability database, to check if extracted dependencies have known vulnerabilities.
Set osvVulnerabilityAlerts to true to get pull requests with vulnerability fixes (once they are available).