osvVulnerabilityAlerts ignores major.enabled: false and packageRules cannot block major updates for OSV vulnerability fixes

[dn281090pdi]

Tell us more.

When using osvVulnerabilityAlerts: true on a self-hosted Renovate (v43.2.4) with GitLab platform, major updates created by OSV vulnerability fixes cannot be disabled through any configuration option.

OSV vulnerability pipeline creates PRs/MRs for major updates regardless of:

• "major": { "enabled": false } at top level
• packageRules with "matchUpdateTypes": ["major"], "enabled": false (last rule)
• vulnerabilityAlerts.packageRules with "matchUpdateTypes": ["major"], "enabled": false

All three approaches were tested and major MRs are still created.

Expected behavior

At least one of the above configuration options should prevent Renovate from creating branches/MRs for major version updates when the vulnerability fix requires a major bump.

Reproduction

Renovate version: 43.2.4
Platform: GitLab (self-hosted, 18.8.3-ee)
Self-hosted

Config (minimal reproduction):

{
  "osvVulnerabilityAlerts": true,
  "major": {
    "enabled": false
  },
  "packageRules": [
    {
      "matchPackageNames": ["*"],
      "enabled": false
    },
    {
      "description": "Allow patch/minor vulnerability alerts",
      "isVulnerabilityAlert": true,
      "matchUpdateTypes": ["patch", "digest", "minor"],
      "enabled": true
    },
    {
      "description": "Block major updates — last rule",
      "matchUpdateTypes": ["major"],
      "matchPackageNames": ["*"],
      "enabled": false
    }
  ]
}

What happens:

OSV detects vulnerabilities where the fix requires a major version bump (e.g., react-dev-utils 5.0.3 → 11.0.4, webpack-dev-server 3.1.14 → 5.2.1). Despite all major-blocking rules, Renovate creates branches and MRs for these major updates.

[jamietanna]

@RahulGautamSingh this looks like "as expected", right? We generally don't allow a Vulnerability Alert to be ignored? (as we use force.enabled, related: #42679)

[RahulGautamSingh]

Yes, working as expected.

[Churro]

Works as expected. Move these package rules into the "vulnerabilityAlerts": { ... } block. Disabling vulnerability alerts when disabling major updates could mean missing out on vulnerability fixes.

[RahulGautamSingh]

@dn281090pdi Use this suggestion. You need to use vulnerabilityAlerts config option to configure the changes you want.

[dn281090pdi]

I tried this configuration
...
"vulnerabilityAlerts": {
"enabled": true,
"vulnerabilityFixStrategy": "lowest",
"minimumReleaseAge": "3 days",
"packageRules": [
{
"description": "Blcok major vulnerability alerts",
"matchUpdateTypes": ["major"],
"enabled": false
}
]
}
...
but new PR/MR created with major security fixes.

[RahulGautamSingh]

Sorry, even this config would not work as we don't allow users to skip security updates and the packageRules within vulnerabilityAlerts object won't have any effect.

This will be now a feature request, as you originally intended.

[Churro]

Afaik it should work but I missed force initially. What I have working is e.g., this:

  "vulnerabilityAlerts": {
    "enabled": true,
    "force": {
      "packageRules": [
        { "matchManagers": ["gomod"], "matchDepTypes": ["indirect"], "enabled": false }
      ]
    }
  }