Security Updates for PNPM

[deivid-rodriguez]

Is there an existing issue for this?

• I have searched the existing issues

Feature description

We have shipped support for PNPM version updates recently. However, we are still missing the proper logic to implement security update support.

In particular, we need to implement the proper logic to be able to propose updates to the minimum fixed version, given a security advisory.

In addition to that, some other internal changes will be needed to enable this feature, but this issue tracks the changes related to the update logic.

For reference, here is a previous PR implementing the same kind of thing for Github Actions.

[deivid-rodriguez]

Dependabot alerts and Security Updates to try and fix them have now been enabled for PNPM 🎉

So let me close this ticket now. Feel free to report any issues you find separately.

Thanks!