feat(vulnerabilities): set, maintain and expose vulnerabilitySeverity for templated fields

[setchy]

Changes

Set vulnerabilitySeverity for package rules, maintain the highest rating for the update group and expose for use in any template-eligible fields, such as commitMessageSuffix.

Demonstration repository: https://github.com/setchy/renovate-demo-osv-severity

Context

#21937

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[setchy]

Update to draft PR pushed that addresses #21937 (comment) from @Churro, albeit in a somewhat hacky method

[setchy]

Demonstration repository also created - https://github.com/setchy/renovate-demo-osv-severity

[setchy]

An alternate name to highestVulnerabilitySeverity might be aggregateVulnerabilitySeverity. Also open to other suggestions

[Churro]

Update to draft PR pushed that addresses #21937 (comment) from @Churro, albeit in a somewhat hacky method

Probably that was a misunderstanding but I didn't intend to recommend the implementation a hacky solution in my comment. I'm convinced there is a more elegant way to implement this in renovate but, personally, I'd rather spend longer tinkering with a nicer solution than implementing this with a crowbar.

[setchy]

Update to draft PR pushed that addresses #21937 (comment) from @Churro, albeit in a somewhat hacky method

Probably that was a misunderstanding but I didn't intend to recommend the implementation a hacky solution in my comment. I'm convinced there is a more elegant way to implement this in renovate but, personally, I'd rather spend longer tinkering with a nicer solution than implementing this with a crowbar.

I was only referring to the multiple vulnerabilities piece you pointed out. was not suggesting you recommended this method of implementation - sorry if it came across that way. 😄

as always, absolutely happy to iterate on these PRs to find the best solution. I did spend a few hours this morning trying to find the "right place" before flattening etc occurs, but need further input.

[setchy]

Reworked the implementation this morning. Removed the crowbar approach 😅

Feedback of course welcomed.

Demo repo updated: https://github.com/setchy/renovate-demo-osv-severity/pulls

[renovate-release]

🎉 This PR is included in version 35.80.0 🎉

The release is available on:

• GitHub release
• 35.80.0

Your semantic-release bot 📦🚀