Update default.json

Signed-off-by: Todd Baert <todd.baert@dynatrace.com>

Author: toddbaert

default.json

@@ -20,13 +20,6 @@
     "groupName": "vulnerable-dependencies"
   },
   "packageRules": [
-    {
-      "description": "Automerge fixes for vulnerabilities",
-      "dependencyDashboardApproval": false,
-      "semanticCommitType": "fix",
-      "semanticCommitScope": "security",
-      "groupName": "vulnerable-dependencies"
-    },
     {
       "description": "Automerge minor updates if they are not 0.x releases",
       "matchUpdateTypes": ["minor"],
@@ -65,6 +58,14 @@
         "devDependencies"
       ],
       "automerge": true
+    },
+    {
+      "description": "Automerge fixes for vulnerabilities",
+      "dependencyDashboardApproval": false,
+      "semanticCommitType": "fix",
+      "semanticCommitScope": "security",
+      "matchUpdateTypes": ["patch", "minor"],
+      "groupName": "vulnerable-dependencies"
     }
   ]
 }