chore(renovate): Only update to node LTS versions (#5355)

* chore(ci): Use LTS codenames for node base images

* chore(renovate): Only match node LTS versions

* chore(renovate): Pin docker digests

renovate.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:base"],
+  "extends": ["config:base", "docker:pinDigests"],
   "minimumReleaseAge": "5",
   "packageRules": [
     {
@@ -47,6 +47,12 @@
     {
       "groupName": "base-image",
       "matchPackagePrefixes": ["ghcr.io/immich-app/base-server"]
+    },
+    {
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["node"],
+      "versionCompatibility": "^(?<version>[^-]+)(?<compatibility>-.*)?$",
+      "versioning": "node"
     }
   ],
   "ignoreDeps": [

server/Dockerfile

@@ -13,7 +13,7 @@ RUN npm run build
 RUN npm prune --omit=dev --omit=optional
 
 # web build
-FROM node:20.10-alpine3.18 as web
+FROM node:iron-alpine3.18 as web
 
 WORKDIR /usr/src/app
 COPY web/package.json web/package-lock.json ./

web/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20.10-alpine3.18
+FROM node:iron-alpine3.18
 
 WORKDIR /usr/src/app
 COPY --chown=node:node package*.json ./