GitLab native support for vulnerability alerts

[jrinaudo-gitlab]

Tell us more.

Extend Renovate’s existing vulnerabilityAlerts support to also consume GitLab-native vulnerability alerts, so GitLab projects receive targeted security-fix MRs in the same way GitHub users do today. These MRs should honor the existing vulnerabilityAlerts configuration (for example labels, automerge, schedule, minimumReleaseAge) and bypass normal rate limits and schedules so that security fixes are never queued behind routine updates.

Use GitLab’s Vulnerability report and Dependency list as primary data sources: cross-reference vulnerabilities surfaced in the Vulnerability report with components in the Dependency list to identify vulnerable, Renovate-managed dependencies and automatically propose version bumps that remediate those findings.

[jamietanna]

Sounds like a plan - do we have example(s) for what the API responses look like on a real repo?

(Note to self: #44153 will be a prereq)

[jrinaudo-gitlab]

Project.vulnerabilities and Project.dependencies. Also may be useful Project.dependencyPaths.

I can provide real-valid examples if needed from a demo project but If you have a GitLab environment where these features are enabled you can also use https://gitlab.com/-/graphql-explorer to test manually.

[jamietanna]

If you wouldn't mind sharing some real examples that'd be useful, thanks! I don't think I have any projects handy that have it enabled