mirror of
https://github.com/renovatebot/renovate.git
synced 2026-11-02 10:33:39 +00:00
Jameel Al-Aziz
6c7d345057
* fix(vulnerabilities): scope Go stdlib OSV remediation to the `toolchain` directive The module `go` directive was already excluded from OSV alerts, but the toolchain rule still matched it via shared datasource/packageName and go-mod-directive ranges. * fix(vulnerabilities): scope OSV remediation rules to the vulnerable depType Remediation rules are generated per dependency. When that dep has a depType, constrain the rule so it cannot match another dep that shares datasource and packageName. * fix(vulnerabilities): set matchDepTypes only for Go toolchain OSV rules A generic matchDepTypes would stop an npm `dependencies` rule from also matching `overrides` of the same package. Only the existing toolchain path sets depType on the generated rule.