Pin dependencies

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ jobs:
       # Label used to access the service container
       db:
         # Docker Hub image
-        image: postgres:18.3
+        image: postgres:18.3@sha256:52e6ffd11fddd081ae63880b635b2a61c14008c17fc98cdc7ce5472265516dd0
         # Set health checks to wait until postgres has started
         options: >-
           --health-cmd pg_isready
@@ -24,7 +24,7 @@ jobs:
           - 5433:5433
 
       redis:
-        image: redis:7.4.6
+        image: redis:7.4.6@sha256:a9cc41d6d01da2aa26c219e4f99ecbeead955a7b656c1c499cce8922311b2514
         ports:
           - 6379:6379
 
@@ -38,7 +38,7 @@ jobs:
         run: cat Aptfile | sudo xargs apt-get install -y
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           enable-cache: true
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.13.7
+FROM python:3.13.7@sha256:fe841081ec55481496a4ab25e538833741295d57d2abdec8d38d74d65fb4715b
 LABEL maintainer "ODL DevOps <mitx-devops@mit.edu>"
 
 # Add package files, install updated node and pip
@@ -11,7 +11,7 @@ RUN apt-get install -y $(grep -vE "^\s*#" apt.txt  | tr "\n" " ")
 RUN apt-get update && apt-get install libpq-dev postgresql-client -y
 
 # Install uv
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:latest@sha256:240fb85ab0f263ef12f492d8476aa3a2e4e1e333f7d67fbdd923d00a506a516a /uv /uvx /usr/local/bin/
 
 # Add, and run as, non-root user.
 RUN mkdir /src

docker-compose.apps.yml

@@ -39,7 +39,7 @@ services:
 
   watch:
     working_dir: /src
-    image: node:22.22
+    image: node:22.22@sha256:ecabd1cb6956d7acfffe8af6bbfbe2df42362269fd28c227f36367213d0bb777
     entrypoint: ["/bin/sh", "-c"]
     command:
       - |

docker-compose.services.yml

@@ -1,6 +1,6 @@
 services:
   db:
-    image: postgres:18.3
+    image: postgres:18.3@sha256:52e6ffd11fddd081ae63880b635b2a61c14008c17fc98cdc7ce5472265516dd0
     healthcheck:
       test: ["CMD", "pg_isready"]
       interval: 3s
@@ -28,7 +28,7 @@ services:
       - ./config/postgres:/docker-entrypoint-initdb.d
 
   redis:
-    image: redis:7.4.6
+    image: redis:7.4.6@sha256:a9cc41d6d01da2aa26c219e4f99ecbeead955a7b656c1c499cce8922311b2514
     healthcheck:
       test: ["CMD", "redis-cli", "ping", "|", "grep", "PONG"]
       interval: 3s
@@ -61,7 +61,7 @@ services:
       - ./config:/etc/nginx/templates
 
   litellm:
-    image: ghcr.io/berriai/litellm:main-stable
+    image: ghcr.io/berriai/litellm:main-stable@sha256:9e1536c6a9219519f024f221706b20b012ca5176988164798adc5c7fe011e5d5
     ports:
       - "4000:4000"
     env_file:
@@ -89,7 +89,7 @@ services:
       - ./config/litellm_config.yml:/app/litellm_config.yml
 
   keycloak:
-    image: quay.io/keycloak/keycloak:26.5
+    image: quay.io/keycloak/keycloak:26.5@sha256:45ae20191531eb608ddb0b775d012b40d3e4f942697f3214694887dd7c108d13
     depends_on:
       - db
     ports:

frontend-demo/package.json

@@ -36,46 +36,46 @@
     "yup": "^1.6.1"
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@swc/core": "^1.9.3",
-    "@swc/jest": "^0.2.37",
-    "@testing-library/dom": "^10.4.0",
-    "@testing-library/jest-dom": "^6.6.3",
-    "@testing-library/react": "^16.0.1",
-    "@testing-library/user-event": "^14.5.2",
-    "@types/http-proxy": "^1",
-    "@types/jest": "^29.5.14",
-    "@types/jest-when": "^3",
-    "@types/lodash": "^4.17.13",
-    "@types/node": "^22.0.0",
+    "@faker-js/faker": "10.1.0",
+    "@swc/core": "1.14.0",
+    "@swc/jest": "0.2.39",
+    "@testing-library/dom": "10.4.1",
+    "@testing-library/jest-dom": "6.9.1",
+    "@testing-library/react": "16.3.0",
+    "@testing-library/user-event": "14.6.1",
+    "@types/http-proxy": "1.17.17",
+    "@types/jest": "29.5.14",
+    "@types/jest-when": "3.5.5",
+    "@types/lodash": "4.17.20",
+    "@types/node": "22.18.13",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "@typescript-eslint/eslint-plugin": "^8.13.0",
-    "@typescript-eslint/typescript-estree": "^8.13.0",
-    "eslint": "^8",
-    "eslint-config-mitodl": "^2.1.0",
+    "@typescript-eslint/eslint-plugin": "8.46.2",
+    "@typescript-eslint/typescript-estree": "8.46.2",
+    "eslint": "8.57.1",
+    "eslint-config-mitodl": "2.1.0",
     "eslint-config-next": "15.5.12",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-import-resolver-typescript": "^4.0.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jest": "^29.0.0",
-    "eslint-plugin-mdx": "^3.0.0",
-    "eslint-plugin-react": "^7.34.3",
-    "eslint-plugin-react-hooks": "^7.0.0",
-    "eslint-plugin-styled-components-a11y": "^2.1.35",
-    "eslint-plugin-testing-library": "^7.0.0",
-    "http-proxy": "^1.18.1",
-    "jest": "^29.7.0",
-    "jest-environment-jsdom": "^29.5.0",
-    "jest-extended": "^7.0.0",
-    "jest-fail-on-console": "^3.2.0",
-    "jest-watch-typeahead": "^2.2.2",
-    "jest-when": "^3.6.0",
+    "eslint-config-prettier": "10.1.8",
+    "eslint-import-resolver-typescript": "4.4.4",
+    "eslint-plugin-import": "2.32.0",
+    "eslint-plugin-jest": "29.0.1",
+    "eslint-plugin-mdx": "3.6.2",
+    "eslint-plugin-react": "7.37.5",
+    "eslint-plugin-react-hooks": "7.0.1",
+    "eslint-plugin-styled-components-a11y": "2.2.1",
+    "eslint-plugin-testing-library": "7.13.3",
+    "http-proxy": "1.18.1",
+    "jest": "29.7.0",
+    "jest-environment-jsdom": "29.7.0",
+    "jest-extended": "7.0.0",
+    "jest-fail-on-console": "3.3.1",
+    "jest-watch-typeahead": "2.2.2",
+    "jest-when": "3.7.0",
     "next": "^15.0.2",
-    "prettier": "^3.3.3",
-    "serve": "^14.2.4",
-    "ts-node": "^10.9.2",
-    "type-fest": "^5.0.0",
-    "typescript": "^5.6.3"
+    "prettier": "3.6.2",
+    "serve": "14.2.5",
+    "ts-node": "10.9.2",
+    "type-fest": "5.4.1",
+    "typescript": "5.9.3"
   }
 }