AI / RenovateBot Interview Questions
How does Renovate handle security vulnerability updates and CVE patching?
Renovate integrates with the GitHub Security Advisory database (GHSA) and OSV to detect vulnerable dependency versions and can be configured to treat security updates differently from routine updates.
{ "vulnerabilityAlerts": { "enabled": true, "labels": ["security", "vulnerability"], "assignees": ["@security-team"], "prPriority": 10, "schedule": ["at any time"], "automerge": false }, "schedule": ["after 9am and before 5pm every weekday"], "packageRules": [ { "matchDepTypes": ["dependencies"], "matchUpdateTypes": ["patch"], "schedule": ["at any time"], "prPriority": 5 } ] }
| Feature | Detail |
|---|---|
| vulnerabilityAlerts | Separate config block for security-flagged updates |
| Data sources | GitHub Advisory Database (GHSA), OSV |
| prPriority | Higher numbers appear first in the Dependency Dashboard |
| Limitation | Only catches packages with published advisories — pair with dedicated SCA tools |
What does setting 'schedule': ['at any time'] for vulnerabilityAlerts accomplish?
What advisory database does Renovate use as its primary source for vulnerability data on GitHub?
More Related questions...
