[bryanbeverly]

Two small changes to the shared preset. Both need a v1.0.5 tag, since the
eleven production repos pin it; renovate-config-low-risk extends this file
untagged and picks them up directly.

prPriority: 1 on the lock file maintenance rule. prConcurrentLimit is 5,
and prPriority is set nowhere in this preset or the five it extends, so
everything sorts at the default 0. With priorities tied Renovate sorts by update
type, and lockFileMaintenance is not in that list at all — so in a deep queue
the refresh is not delayed, it is unreachable. thog has 132 branches against 5
slots, which is how its refresh went from March to July before landing, by which
point it moved 446 package resolutions. Note this only decides which branch
claims a free slot: thog has none right now, so
unlimit-branch=renovate/lock-file-maintenance on the dashboard is still needed
to force the current one through.

osvVulnerabilityAlerts: true. Renovate's default alert source is the
Dependabot feed, backed by the GitHub Advisory Database, which misses Go
advisories two ways: some exist only in the Go vulnerability database with no
GHSA for Dependabot to match, and others carry a GHSA whose affected ranges do
not cover the release that is shipping. This has been running on thog as a scoped
trial; this promotes it. It covers direct dependencies only, so the repos where
google.golang.org/grpc is an indirect require are a separate gap, waiting on
renovate#46761 to reach our
hosted instance.

Follow-up after the tag: one thog PR to move its extends to v1.0.5, drop the
now-duplicated repo-level osvVulnerabilityAlerts, and correct its config note
about indirect requires.

---

Note

Medium Risk
Changes org-wide dependency automation: experimental OSV alerting can open more security PRs (with existing automerge), and higher lockfile priority can pull fresher transitive resolutions without the 3-day release-age gate on those refreshes.

Overview
Updates the shared Renovate preset so lock file maintenance PRs get prPriority: 1, so they are not starved behind the default-priority update queue when prConcurrentLimit is tight. The lock-file rule description now calls out that rationale.

Also turns on osvVulnerabilityAlerts: true, adding osv.dev (including the Go vulnerability DB) alongside the existing GitHub/Dependabot advisory feed, with inline description notes on direct-deps-only coverage, shared vulnerabilityAlerts behavior (labels, automerge, no release-age wait), and upstream experimental status.

^{Reviewed by Cursor Bugbot for commit 9297cb7. Bugbot is set up for automated code reviews on this repo. Configure here.}