renovate: A user's request to rebase a PR can bypass strict `minimumReleaseAge` internal checks

It was previously possible for a user interaction with a Renovate PR to cause Renovate to incorrectly update to the latest version of a dependency, ignoring any minimumReleaseAge checks.

For instance, with a PR with updates such as:

| Package | Update | Change | Pending | |---|---|---|---| | anthropics/claude-code | patch | 2.1.246 → 2.1.247 | 2.1.259 (+6) | | anthropics/claude-code | patch | v2.1.246 → v2.1.247 | v2.1.259 (+6) |

We can see that Renovate only updates to 2.1.247 (as it has passed the minimumReleaseAge), and that there are other updates waiting to age.

When a user (with a minimum of i.e. Write access to the repo on GitHub) clicks the If you want to rebase/retry this PR, check this box checkbox to rebase the PR, Renovate would then update the PR to i.e.

| Package | Update | Change | |---|---|---| | anthropics/claude-code | patch | 2.1.258 → 2.1.259 | | anthropics/claude-code | patch | v2.1.258 → v2.1.259 |

This was only possible when a user requested this, and Renovate itself did not perform this change when a branch needed rebasing, for instance when there was a conflict in it.

This would allow for a potentially malicious dependency to have been pushed to the PR, and potentially start running CI, which is something Minimum Release Age aims to prevent.

This PR would have a pending renovate/stability-days status check on it, with "Waiting for status to be reported — Updates have not met minimum release age requirement".

Impact

• If you have minimumReleaseAge set
• If you have any dependencies that have updateType=digest updates
• A dependency of yours releases a version
• Renovate raises a PR for that version
• Later, a dependency releases new versions
• A human clicks the If you want to rebase/retry this PR, check this box

Patches

This is patched in Renovate 44.61.3.

Workarounds

Modify [prbodytemplate](https://docs.renovatebot.com/configuration-options/#prbodytemplate) to remove the checkbox actions and/or set [dependencyDashboard=true](https://docs.renovatebot.com/configuration-options/#dependencydashboard).