WARN: Unable to read vulnerability information - Bad credentials

[Atharex]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Azure Devops, v39.119.0

Please tell us more about your question or problem

Using this config to enable patch version updates + security fixes on an Azure Devops repository:

module.exports = {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "platform": "azure",
  "endpoint": "https://dev.azure.com/msazuredev/",
  "token": String(process.env.RENOVATE_TOKEN),
  "repositories": [
    {
      "repository": "<org>/<test-repo>",
      "bumpVersion": "patch",
      "onboarding": false,
      "cloneSubmodules": false,
      "extends": ["config:recommended"],
      "packageRules": [
        {
          "enabled": true,
          "matchPackageNames": ["*"],
          "matchUpdateNames": ["patch"]
        }
      ],
      "osvVulnerabilityAlerts": true
    }
  ],
  "requireConfig": "ignored"
}

Renovatebot uses this config and my personal Github PAT token with the following command:

docker run --rm  --env GITHUB_COM_TOKEN=<github-token> --env RENOVATE_TOKEN=$(System.AccessToken) -v $(pwd)/test-config.js:/usr/src/app/config.js renovate/renovate:latest 

The run creates PRs for patch updates, but complains about not being able to reach the OSV endpoint and consequently does not issue any security PRs.

Is this a config issue, or is something else going wrong?

Logs (if relevant)

Logs

2025-01-21T09:14:29.5049230Z ##[section]Starting: Run Renovate Bot
2025-01-21T09:14:29.5054580Z ==============================================================================
2025-01-21T09:14:29.5054718Z Task         : Command line
2025-01-21T09:14:29.5054779Z Description  : Run a command line script using Bash on Linux and macOS and cmd.exe on Windows
2025-01-21T09:14:29.5054881Z Version      : 2.246.1
2025-01-21T09:14:29.5054965Z Author       : Microsoft Corporation
2025-01-21T09:14:29.5055052Z Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/command-line
2025-01-21T09:14:29.5055167Z ==============================================================================
2025-01-21T09:14:29.6999198Z Generating script.
2025-01-21T09:14:29.7003456Z Script contents:
2025-01-21T09:14:29.7005264Z docker run --rm --env LOG_LEVEL=debug --env GITHUB_COM_TOKEN=*** --env RENOVATE_TOKEN=*** -v $(pwd)/test-config.js:/usr/src/app/config.js renovate/renovate:latest
2025-01-21T09:14:29.7005707Z ========================== Starting Command Output ===========================
2025-01-21T09:14:29.7021305Z [command]/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/ca2297d2-fbfa-40d0-99c0-631c8093a9f7.sh
2025-01-21T09:14:29.8660637Z Unable to find image 'renovate/renovate:latest' locally
2025-01-21T09:14:30.9069870Z latest: Pulling from renovate/renovate
2025-01-21T09:14:31.1573766Z de44b265507a: Pulling fs layer
2025-01-21T09:14:31.1574060Z 584ce8de07d0: Pulling fs layer
2025-01-21T09:14:31.1574250Z 5e5f4380321d: Pulling fs layer
2025-01-21T09:14:31.1574431Z 68b2e0087469: Pulling fs layer
2025-01-21T09:14:31.1574608Z 64bd71980cf4: Pulling fs layer
2025-01-21T09:14:31.1574789Z 05a2efb8e71a: Pulling fs layer
2025-01-21T09:14:31.1574967Z cc2f2c778681: Pulling fs layer
2025-01-21T09:14:31.1575144Z 1aabdb7cf1be: Pulling fs layer
2025-01-21T09:14:31.1575305Z a1cae66fbf00: Pulling fs layer
2025-01-21T09:14:31.1575483Z 684390af527b: Pulling fs layer
2025-01-21T09:14:31.1575658Z 6840804e53ce: Pulling fs layer
2025-01-21T09:14:31.1575844Z 725f54c6024d: Pulling fs layer
2025-01-21T09:14:31.1576021Z 4f4fb700ef54: Pulling fs layer
2025-01-21T09:14:31.1576192Z 68b2e0087469: Waiting
2025-01-21T09:14:31.1576360Z 64bd71980cf4: Waiting
2025-01-21T09:14:31.1576524Z 05a2efb8e71a: Waiting
2025-01-21T09:14:31.1576694Z cc2f2c778681: Waiting
2025-01-21T09:14:31.1576841Z 1aabdb7cf1be: Waiting
2025-01-21T09:14:31.1577004Z a1cae66fbf00: Waiting
2025-01-21T09:14:31.1577587Z 684390af527b: Waiting
2025-01-21T09:14:31.1577831Z 6840804e53ce: Waiting
2025-01-21T09:14:31.1577997Z 725f54c6024d: Waiting
2025-01-21T09:14:31.1578169Z 4f4fb700ef54: Waiting
2025-01-21T09:14:31.4187924Z 584ce8de07d0: Verifying Checksum
2025-01-21T09:14:31.4190765Z 584ce8de07d0: Download complete
2025-01-21T09:14:31.6358519Z de44b265507a: Verifying Checksum
2025-01-21T09:14:31.6359403Z de44b265507a: Download complete
2025-01-21T09:14:31.6405916Z 5e5f4380321d: Verifying Checksum
2025-01-21T09:14:31.6406291Z 5e5f4380321d: Download complete
2025-01-21T09:14:31.9448347Z 68b2e0087469: Verifying Checksum
2025-01-21T09:14:31.9448625Z 68b2e0087469: Download complete
2025-01-21T09:14:32.2114845Z 64bd71980cf4: Verifying Checksum
2025-01-21T09:14:32.2115134Z 64bd71980cf4: Download complete
2025-01-21T09:14:32.4061209Z cc2f2c778681: Verifying Checksum
2025-01-21T09:14:32.4061516Z cc2f2c778681: Download complete
2025-01-21T09:14:32.5449463Z 1aabdb7cf1be: Verifying Checksum
2025-01-21T09:14:32.5457421Z 1aabdb7cf1be: Download complete
2025-01-21T09:14:32.7033316Z a1cae66fbf00: Verifying Checksum
2025-01-21T09:14:32.7033850Z a1cae66fbf00: Download complete
2025-01-21T09:14:32.9909078Z 6840804e53ce: Verifying Checksum
2025-01-21T09:14:32.9910303Z 6840804e53ce: Download complete
2025-01-21T09:14:33.3534230Z 725f54c6024d: Verifying Checksum
2025-01-21T09:14:33.3540572Z 725f54c6024d: Download complete
2025-01-21T09:14:33.7278252Z 4f4fb700ef54: Verifying Checksum
2025-01-21T09:14:33.7286469Z 4f4fb700ef54: Download complete
2025-01-21T09:14:33.8336959Z 684390af527b: Verifying Checksum
2025-01-21T09:14:33.8337637Z 684390af527b: Download complete
2025-01-21T09:14:33.9160022Z 05a2efb8e71a: Verifying Checksum
2025-01-21T09:14:33.9167947Z 05a2efb8e71a: Download complete
2025-01-21T09:14:34.6424218Z de44b265507a: Pull complete
2025-01-21T09:14:37.1404723Z 584ce8de07d0: Pull complete
2025-01-21T09:14:37.9739623Z 5e5f4380321d: Pull complete
2025-01-21T09:14:39.0610191Z 68b2e0087469: Pull complete
2025-01-21T09:14:40.5149880Z 64bd71980cf4: Pull complete
2025-01-21T09:14:52.0296977Z 05a2efb8e71a: Pull complete
2025-01-21T09:14:52.4479658Z cc2f2c778681: Pull complete
2025-01-21T09:14:52.4727762Z 1aabdb7cf1be: Pull complete
2025-01-21T09:14:52.4936772Z a1cae66fbf00: Pull complete
2025-01-21T09:15:08.9075675Z 684390af527b: Pull complete
2025-01-21T09:15:08.9298403Z 6840804e53ce: Pull complete
2025-01-21T09:15:08.9586396Z 725f54c6024d: Pull complete
2025-01-21T09:15:08.9756719Z 4f4fb700ef54: Pull complete
2025-01-21T09:15:08.9841533Z Digest: sha256:e7a5337b70d81b19b934c48242809e3f9449d9991638a635b9178c2aa08f0060
2025-01-21T09:15:08.9868634Z Status: Downloaded newer image for renovate/renovate:latest
2025-01-21T09:15:13.0501709Z DEBUG: Using RE2 regex engine
2025-01-21T09:15:13.0548199Z DEBUG: Parsing configs
2025-01-21T09:15:13.0550285Z DEBUG: Checking for config file in config.js
2025-01-21T09:15:13.0849946Z DEBUG: Converting GITHUB_COM_TOKEN into a global host rule
2025-01-21T09:15:13.0903193Z DEBUG: File config
2025-01-21T09:15:13.0903384Z        "config": {
2025-01-21T09:15:13.0903579Z          "$schema": "https://docs.renovatebot.com/renovate-schema.json",
2025-01-21T09:15:13.0903769Z          "platform": "azure",
2025-01-21T09:15:13.0903946Z          "endpoint": "https://dev.azure.com/msazuredev/",
2025-01-21T09:15:13.0904127Z          "token": "***********",
2025-01-21T09:15:13.0904287Z          "repositories": [
2025-01-21T09:15:13.0904430Z            {
2025-01-21T09:15:13.0904769Z              "repository": "<org>/<repo>",
2025-01-21T09:15:13.0904951Z              "bumpVersion": "patch",
2025-01-21T09:15:13.0905282Z              "onboarding": false,
2025-01-21T09:15:13.0905648Z              "cloneSubmodules": false,
2025-01-21T09:15:13.0906014Z              "extends": ["config:recommended"],
2025-01-21T09:15:13.0907249Z              "packageRules": [
2025-01-21T09:15:13.0908250Z                {
2025-01-21T09:15:13.0908650Z                  "enabled": true,
2025-01-21T09:15:13.0909172Z                  "matchPackageNames": ["*"],
2025-01-21T09:15:13.0909338Z                  "matchUpdateNames": ["patch"]
2025-01-21T09:15:13.0909485Z                }
2025-01-21T09:15:13.0909601Z              ],
2025-01-21T09:15:13.0909935Z              "osvVulnerabilityAlerts": true
2025-01-21T09:15:13.0910278Z            }
2025-01-21T09:15:13.0910428Z          ],
2025-01-21T09:15:13.0910763Z          "requireConfig": "ignored"
2025-01-21T09:15:13.0910916Z        }
2025-01-21T09:15:13.0923425Z DEBUG: CLI config
2025-01-21T09:15:13.0988031Z        "config": {}
2025-01-21T09:15:13.1005942Z DEBUG: Env config
2025-01-21T09:15:13.1006182Z        "config": {
2025-01-21T09:15:13.1006501Z          "hostRules": [
2025-01-21T09:15:13.1006695Z            {"hostType": "github", "matchHost": "github.com", "token": "***********"}
2025-01-21T09:15:13.1006877Z          ],
2025-01-21T09:15:13.1007136Z          "token": "***********"
2025-01-21T09:15:13.1007695Z        }
2025-01-21T09:15:13.1008027Z DEBUG: Combined config
2025-01-21T09:15:13.1022381Z        "config": {
2025-01-21T09:15:13.1022584Z          "$schema": "https://docs.renovatebot.com/renovate-schema.json",
2025-01-21T09:15:13.1022894Z          "platform": "azure",
2025-01-21T09:15:13.1028295Z          "endpoint": "https://dev.azure.com/msazuredev/",
2025-01-21T09:15:13.1047719Z          "token": "***********",
2025-01-21T09:15:13.1047892Z          "repositories": [
2025-01-21T09:15:13.1048031Z            {
2025-01-21T09:15:13.1048205Z              "repository": "<org>/<repo>",
2025-01-21T09:15:13.1048508Z              "bumpVersion": "patch",
2025-01-21T09:15:13.1058473Z              "onboarding": false,
2025-01-21T09:15:13.1058648Z              "cloneSubmodules": false,
2025-01-21T09:15:13.1796667Z              "extends": ["config:recommended"],
2025-01-21T09:15:13.1796901Z              "packageRules": [
2025-01-21T09:15:13.1797063Z                {
2025-01-21T09:15:13.1797223Z                  "enabled": true,
2025-01-21T09:15:13.1798247Z                  "matchPackageNames": ["*"],
2025-01-21T09:15:13.1798457Z                  "matchUpdateNames": ["patch"]
2025-01-21T09:15:13.1798955Z                }
2025-01-21T09:15:13.1799099Z              ],
2025-01-21T09:15:13.1799272Z              "osvVulnerabilityAlerts": true
2025-01-21T09:15:13.1799434Z            }
2025-01-21T09:15:13.1799556Z          ],
2025-01-21T09:15:13.1800077Z          "requireConfig": "ignored",
2025-01-21T09:15:13.1800248Z          "hostRules": [
2025-01-21T09:15:13.1800451Z            {"hostType": "github", "matchHost": "github.com", "token": "***********"}
2025-01-21T09:15:13.1800653Z          ]
2025-01-21T09:15:13.1800791Z        }
2025-01-21T09:15:13.1800962Z DEBUG: Adding trailing slash to endpoint
2025-01-21T09:15:13.1801180Z DEBUG: Enabling forkProcessing while in non-autodiscover mode
2025-01-21T09:15:13.1801419Z DEBUG: Enabling onboardingNoDeps while in non-autodiscover mode
2025-01-21T09:15:13.1801615Z DEBUG: Found valid git version: 2.48.1
2025-01-21T09:15:13.1830853Z DEBUG: Setting global hostRules
2025-01-21T09:15:13.1839952Z DEBUG: Adding token authentication for github.com (hostType=github) to hostRules
2025-01-21T09:15:13.1891285Z DEBUG: Adding token authentication for dev.azure.com (hostType=azure) to hostRules
2025-01-21T09:15:13.1909141Z DEBUG: Using baseDir: /tmp/renovate
2025-01-21T09:15:13.1925578Z DEBUG: Using cacheDir: /tmp/renovate/cache
2025-01-21T09:15:13.3158462Z DEBUG: Using containerbaseDir: /tmp/renovate/cache/containerbase
2025-01-21T09:15:13.3171705Z DEBUG: Initializing Renovate internal cache into /tmp/renovate/cache/renovate/renovate-cache-v1
2025-01-21T09:15:13.3172015Z DEBUG: Commits limit = null
2025-01-21T09:15:13.3232407Z DEBUG: Setting global hostRules
2025-01-21T09:15:13.3245667Z DEBUG: Adding token authentication for github.com (hostType=github) to hostRules
2025-01-21T09:15:13.3266755Z DEBUG: Adding token authentication for dev.azure.com (hostType=azure) to hostRules
2025-01-21T09:15:13.3267014Z DEBUG: validatePresets()
2025-01-21T09:15:14.6662147Z DEBUG: Reinitializing hostRules for repo
2025-01-21T09:15:14.6665685Z DEBUG: Clearing hostRules
2025-01-21T09:15:14.6677911Z DEBUG: Adding token authentication for github.com (hostType=github) to hostRules
2025-01-21T09:15:14.6716312Z DEBUG: Adding token authentication for dev.azure.com (hostType=azure) to hostRules
2025-01-21T09:15:14.6716658Z  INFO: Repository started (repository=<org>/<repo>)
2025-01-21T09:15:14.6716882Z        "renovateVersion": "39.119.0"
2025-01-21T09:15:14.6722381Z DEBUG: Using localDir: /tmp/renovate/repos/azure/<org>/<repo> (repository=<org>/<repo>)
2025-01-21T09:15:14.6728126Z DEBUG: PackageFiles.clear() - Package files deleted (repository=<org>/<repo>)
2025-01-21T09:15:14.6751492Z DEBUG: initRepo("<org>/<repo>") (repository=<org>/<repo>)

...

2025-01-21T09:15:20.4987226Z  INFO: Dependency extraction complete (repository=<org>/<repo>, baseBranch=main)
2025-01-21T09:15:20.4987672Z        "stats": {
2025-01-21T09:15:20.4987836Z          "managers": {
2025-01-21T09:15:20.4987993Z            "bicep": {"fileCount": 10, "depCount": 22},
2025-01-21T09:15:20.4988179Z            "docker-compose": {"fileCount": 2, "depCount": 0},
2025-01-21T09:15:20.4988545Z            "dockerfile": {"fileCount": 2, "depCount": 4},
2025-01-21T09:15:20.4988728Z            "npm": {"fileCount": 1, "depCount": 1},
2025-01-21T09:15:20.4988910Z            "nuget": {"fileCount": 7, "depCount": 104}
2025-01-21T09:15:20.4989291Z          },
2025-01-21T09:15:20.4989460Z          "total": {"fileCount": 22, "depCount": 131}
2025-01-21T09:15:20.4989620Z        }
2025-01-21T09:15:20.4990519Z DEBUG: fetchVulnerabilities() - osvVulnerabilityAlerts=true (repository=<org>/<repo>)
2025-01-21T09:15:20.6990134Z  WARN: Unable to read vulnerability information (repository=<org>/<repo>)
2025-01-21T09:15:20.6990899Z        "err": {
2025-01-21T09:15:20.6991474Z          "name": "HttpError",
2025-01-21T09:15:20.6991701Z          "status": 401,
2025-01-21T09:15:20.6991853Z          "response": {
2025-01-21T09:15:20.6992186Z            "url": "https://api.github.com/repos/renovatebot/osv-offline/releases",
2025-01-21T09:15:20.6992403Z            "status": 401,
2025-01-21T09:15:20.6992571Z            "headers": {
2025-01-21T09:15:20.6992754Z              "access-control-allow-origin": "*",
2025-01-21T09:15:20.6993197Z              "access-control-expose-headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset",
2025-01-21T09:15:20.6994030Z              "content-length": "95",
2025-01-21T09:15:20.6994240Z              "content-security-policy": "default-src 'none'",
2025-01-21T09:15:20.6994467Z              "content-type": "application/json; charset=utf-8",
2025-01-21T09:15:20.6994706Z              "date": "Tue, 21 Jan 2025 09:15:20 GMT",
2025-01-21T09:15:20.6994965Z              "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
2025-01-21T09:15:20.6995194Z              "server": "github.com",
2025-01-21T09:15:20.6995420Z              "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
2025-01-21T09:15:20.6995651Z              "vary": "Accept-Encoding, Accept, X-Requested-With",
2025-01-21T09:15:20.6995873Z              "x-content-type-options": "nosniff",
2025-01-21T09:15:20.6996069Z              "x-frame-options": "deny",
2025-01-21T09:15:20.6996273Z              "x-github-media-type": "github.v3; format=json",
2025-01-21T09:15:20.6996522Z              "x-github-request-id": "23C0:1F5FC7:7153E45:739F2C7:678F65A8",
2025-01-21T09:15:20.6996753Z              "x-ratelimit-limit": "60",
2025-01-21T09:15:20.6996940Z              "x-ratelimit-remaining": "59",
2025-01-21T09:15:20.6997133Z              "x-ratelimit-reset": "1737454520",
2025-01-21T09:15:20.6997328Z              "x-ratelimit-resource": "core",
2025-01-21T09:15:20.6997890Z              "x-ratelimit-used": "1",
2025-01-21T09:15:20.6998055Z              "x-xss-protection": "0"
2025-01-21T09:15:20.6998219Z            },
2025-01-21T09:15:20.6998375Z            "data": {
2025-01-21T09:15:20.6998549Z              "message": "Bad credentials",
2025-01-21T09:15:20.6998757Z              "documentation_url": "https://docs.github.com/rest",
2025-01-21T09:15:20.6998959Z              "status": "401"
2025-01-21T09:15:20.6999113Z            }
2025-01-21T09:15:20.6999263Z          },
2025-01-21T09:15:20.6999422Z          "request": {
2025-01-21T09:15:20.6999571Z            "method": "GET",
2025-01-21T09:15:20.6999784Z            "url": "https://api.github.com/repos/renovatebot/osv-offline/releases",
2025-01-21T09:15:20.6999998Z            "headers": {
2025-01-21T09:15:20.7000191Z              "accept": "application/vnd.github.v3+json",
2025-01-21T09:15:20.7000425Z              "user-agent": "octokit-rest.js/20.1.1 octokit-core.js/5.2.0 Node.js/22",
2025-01-21T09:15:20.7000654Z              "authorization": "***********"
2025-01-21T09:15:20.7000823Z            },
2025-01-21T09:15:20.7001006Z            "request": {"fetch": "[function]", "hook": "[function]"}
2025-01-21T09:15:20.7001185Z          },
2025-01-21T09:15:20.7001360Z          "message": "Bad credentials - https://docs.github.com/rest",
2025-01-21T09:15:20.7002873Z          "stack": "HttpError: Bad credentials - https://**redacted**@[email protected]/node_modules/@octokit/request/dist-node/index.js:125:21\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at tryDownloadDb (/usr/local/renovate/node_modules/.pnpm/@[email protected][email protected]/node_modules/@renovatebot/osv-offline/dist/lib/download.js:46:26)\n    at OsvOffline.initialize (/usr/local/renovate/node_modules/.pnpm/@[email protected][email protected]/node_modules/@renovatebot/osv-offline/dist/lib/osv-offline.js:14:24)\n    at Function.create (/usr/local/renovate/node_modules/.pnpm/@[email protected][email protected]/node_modules/@renovatebot/osv-offline/dist/lib/osv-offline.js:26:9)\n    at Vulnerabilities.initialize (/usr/local/renovate/lib/workers/repository/process/vulnerabilities.ts:59:23)\n    at Function.create (/usr/local/renovate/lib/workers/repository/process/vulnerabilities.ts:64:5)\n    at fetchVulnerabilities (/usr/local/renovate/lib/workers/repository/process/extract-update.ts:198:31)\n    at lookup (/usr/local/renovate/lib/workers/repository/process/extract-update.ts:213:3)\n    at extractDependencies (/usr/local/renovate/lib/workers/repository/process/index.ts:165:11)\n    at Object.renovateRepository (/usr/local/renovate/lib/workers/repository/index.ts:71:9)\n    at attributes.repository (/usr/local/renovate/lib/workers/global/index.ts:206:11)\n    at start (/usr/local/renovate/lib/workers/global/index.ts:191:7)\n    at /usr/local/renovate/lib/renovate.ts:19:22"
2025-01-21T09:15:20.7004426Z        }

...

2025-01-21T09:16:03.2482802Z 
2025-01-21T09:16:03.2581914Z ##[section]Finishing: Run Renovate Bot

[rarkins]

You need to add a token for github.com to your config (GITHUB_COM_TOKEN or a host rule)

[Atharex]

I thought I already do that by injecting the token to renovatebot via --env GITHUB_COM_TOKEN?

[rarkins]

Sorry, missed that.

[rarkins]

OSV offline uses this token logic: https://github.com/renovatebot/osv-offline/blob/d528e96959bb2c3b17ca5854afff486f48732ebb/packages/osv-offline/src/lib/download.ts#L44

Renovate does this:

  private async initialize(): Promise<void> {
    // hard-coded logic to use authentication for github.com based on the githubToken for api.github.com
    const token = findGithubToken(
      find({
        hostType: 'github',
        url: 'https://api.github.com/',
      }),
    );

    this.osvOffline = await OsvOffline.create(token);
  }

In theory, the token you provided should be provided.