Vulnerability PR ignores package rules

[daniluk4000]

What would you like help with?

I think I found a bug

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Github

Please tell us more about your question or problem

yandex-maps-unofficial/vue-yandex-maps#354

https://github.com/yandex-maps-unofficial/vue-yandex-maps/blob/master/.github/renovate.json5#L15

We have a rule that should not update Nuxt 2 package, but security update still does that.

In my point of view, this could be a bug, because I can't find anything in config that we are doing wrong.

Thanks!

Logs (if relevant)

No response

[rarkins]

Vulnerability updates use allowedVersions themselves so this is behaving as designed. If there are no v2 updates anticipated then you could disable that dependency

[daniluk4000]

Sorry, how? Can't find anything in docs for that

[rarkins]

Set enabled=false