Security update PRs based on dependency security-vulnerability advisories

[rtyley]

Scala Steward has always been great at updating dependencies to the latest versions, whether those updates are minor bug fixes, feature updates, or something else. However, if we could use sources of dependency security-vulnerability advisories, we could:

• Prevent Scala Steward from updating artifacts to versions that have known security vulnerabilities
• Reduce PR volume to only the most valuable PRs - the ones that fix security vulnerabilities

Considerations

• PRs (at least in public repos) should not advertise the security vulnerability that's being fixed by the update; they should look just like a regular update.
• How would this interact with cooldowns? Would we want a shorter cooldown period based on how severe the vulnerability is?

Data sources for repository security advisories

Many sources of data are commercial - some, like OSV, are currently free.

OSV

• https://osv.dev/#use-the-api
• https://osv.dev/list?ecosystem=Maven
• https://google.github.io/osv.dev/api/
• https://opensource.googleblog.com/2021/02/launching-osv-better-vulnerability.html

Does OSV support all version ranges?

https://osv.dev/vulnerability/GHSA-jppx-w49h-x2qq seems to only list:

Introduced 4.2.0.Final
Fixed 4.2.16.Final

...but we would also want >= 4.1.0.Final, <= 4.1.135.Final - eg because AWS SDK is using 4.1.x.

GitHub security advisories

GitHub provide an API that allows listing all the repository security advisories for a GitHub organisation:

https://docs.github.com/en/rest/security-advisories/repository-advisories?apiVersion=2026-03-10#list-repository-security-advisories-for-an-organization

[mzuehlke]

#535 is sort of related