63353 Dependabot improvements

[chihaiaalex]

No description provided.

[haphut]

Good job! Please answer the comments or modify accordingly.

[chihaiaalex]

Done, replied and/or adjusted for all comments.

[haphut]

Great! One more Dependabot trick for Node LTS-only (EDIT: not needed for Node.js anymore, see next comment):

updates:
  - package-ecosystem: "docker"
    ignore:
      - dependency-name: "node"
        versions: [ "25", "27", "29", "31", "33", "35", "37", "39" ]

Source: dependabot/dependabot-core#2247 (comment)

A similar trick can be made for JVM, and it would go something like this:

updates:
  - package-ecosystem: "docker"
    ignore:
      # Ignore non-LTS versions
      - dependency-name: "eclipse-temurin/*"
        # The list can be extended when closer to the end as the release schedule might change in five years.
        versions: [ "26", "27", "28", "30", "31", "32", "34", "35", "36" ]

That trick would enable using this dependabot.yml in infodevops-docker-base-images.

(Obligatory: RenovateBot supports this use case out of the box, again.)

[haphut]

Aha, Node.js is changing their release schedule so all major versions will be LTS. So the trick is only relevant for JVM Docker images. Source: https://nodejs.org/en/blog/announcements/evolving-the-nodejs-release-schedule

[chihaiaalex]

@haphut done, replied and/or adjusted for all comments.