minimumReleaseAgeExclude updated on non-security PRs

[Janpot]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.247.0

Please tell us more about your question or problem

We're seeing entries being added in a PR for date-fns and others while there is no security update. Why is that?

Logs (if relevant)

Logs

https://gist.github.com/Janpot/2164e1ed1d067d78e3f167d708042564

[RahulGautamSingh]

Taking a look.

[RahulGautamSingh]

Hey, I have found the issue. There is a problem in one of your presets:

https://github.com/mui/mui-public/blob/a646322dc5697683ef464c5a05a0de6240de9f05/renovate/default.json#L103

This package rule tried to use isVulnerabilityAlert as a matcher but it is not one, hence this leaks into all deps/PR which use npm datasource converting them into security updates :)

The fix would be to move the task into the top-level vulnerabilityAlerts object (in default.json) and delete the packageRule.