mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 15:31:53 +00:00
Kim Gustyr
eee64df614
* fix(extract): pass vulnerability alert state to managers Managers cannot tell whether vulnerability remediation is active, so they cannot decide to extract dependencies which are only useful to a security update, e.g. transitive dependencies in a lock file. Add `hasVulnerabilityAlertsRules` to `ExtractConfig`, derived from any vulnerability source: `osvVulnerabilityAlerts`, or platform alerts, which are turned into `isVulnerabilityAlert` package rules during init. The flag is part of the extraction fingerprint, so cached extract results are invalidated when it changes. * refactor: drop redundant JSDoc on hasVulnerabilityAlertsRules * docs(manager): document hasVulnerabilityAlertsRules on ExtractConfig * fix(extract): omit hasVulnerabilityAlertsRules from fingerprint when false Keeps the extract config hash unchanged for repositories which have no vulnerability alerts, so they do not re-extract once on upgrade.