Security PR not opened?

[juju4]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.66.4

Please tell us more about your question or problem

In https://developer.mend.io/github/juju4/velociraptor-offline-collections/-/job/7e465286-f70a-4076-9e79-93b0c3173997, there is correct identification of GHSA-752w-5fwx-jx9f for pyjwt in "DEBUG: alert package rules" and "DEBUG: branches info extended"

Can you help me understand why not opening PR ASAP as per config?

Thanks

Note: it does not seem related to #10480

Logs (if relevant)

Logs

DEBUG: syncBranchState() (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: syncBranchState(): Branch cache not found, creating minimal branchState (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: getBranchPr(renovate/pypi-pyjwt-vulnerability) (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: findPr(renovate/pypi-pyjwt-vulnerability, undefined, open) (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: branchExists=false (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: dependencyDashboardCheck=undefined (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: Check for closed PR because recreating closed PRs is disabled. (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: findPr(renovate/pypi-pyjwt-vulnerability, chore(deps): update dependency pyjwt to v2.12.0 [security], !open) (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: prAlreadyExisted=false (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: Branch renovate/pypi-pyjwt-vulnerability creation is disabled because mode=silent (branch="renovate/pypi-pyjwt-vulnerability")
DEBUG: syncBranchState() (branch="renovate/azure-sdk-for-python-monorepo")

[...]

DEBUG: remainingBranches=renovate/pyjwt-2.x
DEBUG: findPr(renovate/pyjwt-2.x, undefined, open)
DEBUG: Found PR #10
DEBUG: branch.isModified(): using git to calculate against baseBranch "main"
DEBUG: branch.isModified() = false
DEBUG: setCachedModifiedResult(): Branch cache not present
INFO: Autoclosing PR
{
  "branchName": "renovate/pyjwt-2.x",
  "prNo": 10,
  "prTitle": "chore(deps): update dependency pyjwt to v2.12.1"
}

DEBUG: updatePr(10, chore(deps): update dependency pyjwt to v2.12.1 - autoclosed, body)
DEBUG: PR updated...prNo: 10
DEBUG: Deleted remote branch: renovate/pyjwt-2.x
DEBUG: No local branch to delete with name: renovate/pyjwt-2.x
DEBUG: PackageFiles.clear() - Package files deleted

[...]

DEBUG: branches info extended
{
  "branchesInformation": [
    {
      "branchName": "renovate/pypi-pyjwt-vulnerability",
      "prNo": null,
      "prTitle": "chore(deps): update dependency pyjwt to v2.12.0 [security]",
      "result": "needs-approval",
      "upgrades": [
        {
          "datasource": "pypi",
          "depName": "PyJWT",
          "displayPending": "",
          "fixedVersion": "2.11.0",
          "currentVersion": "2.11.0",
          "currentValue": "==2.11.0",
          "newValue": "==2.12.0",
          "newVersion": "2.12.0",
          "packageFile": "requirements.txt",
          "updateType": "minor",
          "packageName": "pyjwt"
        }
      ]
    },

[jamietanna]

Looking in the logs for the branch name, I see:

DEBUG: Branch renovate/pypi-pyjwt-vulnerability creation is disabled because mode=silent (branch="renovate/pypi-pyjwt-vulnerability")

In this mode, Renovate (on the Mend Developer Platform) won't create PRs automagically

[juju4]

Thanks Jamie.
I confirm that I see that in WebUI but I have not set that, not in my renovate.json or maybe inherited from config:best-practices? it does not seem so per https://github.com/renovatebot/renovate/blob/main/docs/usage/upgrade-best-practices.md
It does not match with PR are/were created for usual non-major or major updates.
Why would affect only vulnerabilityAlerts?
Or maybe more as it seems I got less automerge/minor updates in March than Feb or Jan in my repositories.

fix is adding mode=full in renovate matching packageRules, correct?
per https://docs.renovatebot.com/configuration-options/#mode

[juju4]

I got somewhat confirmation that there is an issue with renovate as github marked most/all renovate dependency dashboard issues as stalled following 30d inactivity and I don't think it is possible, typicaly because of minor updates to github actions.

[jamietanna]

To confirm, this is not something controlled through your renovate.json, but a Mend Developer Platform UI config option

(It allows control without necessarily changing the renovate.json)

If you toggle that setting in the UI, you'll start getting updates again