feat(vulnerabilities): set, maintain and expose vulnerabilitySeverity for templated fields

docs/usage/configuration-options.md

@@ -1563,6 +1563,8 @@ If you wish for Renovate to process only select paths in the repository, use `in
 Alternatively, if you need to just _exclude_ certain paths in the repository then consider `ignorePaths` instead.
 If you are more interested in including only certain package managers (e.g. `npm`), then consider `enabledManagers` instead.
 
+## includeVulnerabilitySeverity
+
 ## internalChecksAsSuccess
 
 By default, internal Renovate checks such as `renovate/stability-days` are not counted towards a branch being "green" or not.

lib/config/options/index.ts

@@ -1728,7 +1728,8 @@ const options: RenovateOptions[] = [
       dependencyDashboardApproval: false,
       minimumReleaseAge: null,
       rangeStrategy: 'update-lockfile',
-      commitMessageSuffix: '[SECURITY]',
+      commitMessageSuffix:
+        '[SECURITY{{#if includeVulnerabilitySeverity}}-{{{vulnerabilitySeverity}}}{{/if}}]',
       branchTopic: `{{{datasource}}}-{{{depName}}}-vulnerability`,
       prCreation: 'immediate',
     },
@@ -1838,6 +1839,14 @@ const options: RenovateOptions[] = [
     cli: false,
     advancedUse: true,
   },
+  {
+    name: 'includeVulnerabilitySeverity',
+    description:
+      'Whether to include the vulnerability severity in the PR title.',
+    type: 'boolean',
+    default: false,
+    cli: false,
+  },
   {
     name: 'prBodyTemplate',
     description:
@@ -1864,6 +1873,7 @@ const options: RenovateOptions[] = [
     default: false,
     cli: false,
   },
+
   {
     name: 'prHeader',
     description: 'Text added here will be placed first in the PR body.',

lib/config/types.ts

@@ -309,6 +309,7 @@ export interface PackageRule
     UpdateConfig,
     Record<string, unknown> {
   description?: string | string[];
+  isVulnerabilityAlert?: boolean;
   matchFiles?: string[];
   matchPaths?: string[];
   matchLanguages?: string[];
@@ -333,6 +334,7 @@ export interface PackageRule
   matchUpdateTypes?: UpdateType[];
   matchConfidence?: MergeConfidence[];
   registryUrls?: string[] | null;
+  vulnerabilitySeverity?: string;
 }
 
 export interface ValidationMessage {

lib/modules/manager/types.ts

@@ -174,6 +174,7 @@ export interface Upgrade<T = Record<string, any>> extends PackageDependency<T> {
   isLockFileMaintenance?: boolean;
   isRemediation?: boolean;
   isVulnerabilityAlert?: boolean;
+  vulnerabilitySeverity?: string;
   registryUrls?: string[] | null;
   currentVersion?: string;
   replaceString?: string;

lib/util/template/index.ts

@@ -90,6 +90,8 @@ export const allowedFields = {
   displayTo: 'The to value, formatted for display',
   hasReleaseNotes: 'true if the upgrade has release notes',
   indentation: 'The indentation of the dependency being updated',
+  includeVulnerabilitySeverity:
+    'true if the upgrade should include the severity',
   isLockfileUpdate: 'true if the branch is a lock file update',
   isMajor: 'true if the upgrade is major',
   isPatch: 'true if the upgrade is a patch upgrade',
@@ -100,6 +102,7 @@ export const allowedFields = {
   isRange: 'true if the new value is a range',
   isSingleVersion:
     'true if the upgrade is to a single version rather than a range',
+  isVulnerabilityAlert: 'true if the upgrade is a vulnerability alert',
   logJSON: 'ChangeLogResult object for the upgrade',
   manager: 'The (package) manager which detected the dependency',
   newDigest: 'The new digest value',
@@ -143,6 +146,7 @@ export const allowedFields = {
   version: 'The version number of the changelog',
   versioning: 'The versioning scheme in use',
   versions: 'An array of ChangeLogRelease objects in the upgrade',
+  vulnerabilitySeverity: 'The vulnerability severity is present',
 };
 
 const prBodyFields = [

lib/workers/repository/init/__snapshots__/vulnerability.spec.ts.snap

@@ -18,7 +18,7 @@ exports[`workers/repository/init/vulnerability detectVulnerabilityAlerts() retur
     "allowedVersions": "1.8.3",
     "force": {
       "branchTopic": "{{{datasource}}}-{{{depName}}}-vulnerability",
-      "commitMessageSuffix": "[SECURITY]",
+      "commitMessageSuffix": "[SECURITY{{#if includeVulnerabilitySeverity}}-{{{vulnerabilitySeverity}}}{{/if}}]",
       "dependencyDashboardApproval": false,
       "groupName": null,
       "minimumReleaseAge": null,
@@ -48,7 +48,7 @@ go",
     "allowedVersions": "1.8.3",
     "force": {
       "branchTopic": "{{{datasource}}}-{{{depName}}}-vulnerability",
-      "commitMessageSuffix": "[SECURITY]",
+      "commitMessageSuffix": "[SECURITY{{#if includeVulnerabilitySeverity}}-{{{vulnerabilitySeverity}}}{{/if}}]",
       "dependencyDashboardApproval": false,
       "groupName": null,
       "minimumReleaseAge": null,
@@ -78,7 +78,7 @@ actions",
     "allowedVersions": "==2.2.1.0",
     "force": {
       "branchTopic": "{{{datasource}}}-{{{depName}}}-vulnerability",
-      "commitMessageSuffix": "[SECURITY]",
+      "commitMessageSuffix": "[SECURITY{{#if includeVulnerabilitySeverity}}-{{{vulnerabilitySeverity}}}{{/if}}]",
       "dependencyDashboardApproval": false,
       "groupName": null,
       "minimumReleaseAge": null,
@@ -123,7 +123,7 @@ Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validati
     "allowedVersions": "2.7.9.4",
     "force": {
       "branchTopic": "{{{datasource}}}-{{{depName}}}-vulnerability",
-      "commitMessageSuffix": "[SECURITY]",
+      "commitMessageSuffix": "[SECURITY{{#if includeVulnerabilitySeverity}}-{{{vulnerabilitySeverity}}}{{/if}}]",
       "dependencyDashboardApproval": false,
       "groupName": null,
       "minimumReleaseAge": null,

lib/workers/repository/process/vulnerabilities.ts

@@ -454,12 +454,16 @@ export class Vulnerabilities {
     logger.debug(
       `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`
     );
+
+    const severityLevel = vulnerability.database_specific?.severity as string;
+
     return {
       matchDatasources: [datasource],
       matchPackageNames: [packageName],
       matchCurrentVersion: depVersion,
       allowedVersions: fixedVersion,
       isVulnerabilityAlert: true,
+      vulnerabilitySeverity: severityLevel,
       prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),
       force: {
         ...packageFileConfig.vulnerabilityAlerts,