chore(deps): pin dependencies

.github/workflows/build-and-push-reusable.yml

@@ -46,12 +46,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4.0.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -83,11 +83,11 @@ jobs:
           echo "ref=${IMAGE_REF}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.0.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v6.0.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
           images: ${{ env.REGISTRY }}/${{ steps.namespace.outputs.owner }}/${{ inputs.image_name }}
           tags: |
@@ -96,7 +96,7 @@ jobs:
             type=raw,value=${{ steps.pkg.outputs.version }},enable=${{ steps.pkg.outputs.version != '' }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7.0.0
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}

.github/workflows/build-backend.yml

@@ -35,7 +35,7 @@ jobs:
       should_build: ${{ steps.check.outputs.should_build }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
 
@@ -67,15 +67,15 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ env.GITHUB_OWNER }}
           repositories: ${{ env.APP_REPO_NAME }},${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
 
@@ -124,15 +124,15 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ env.GITHUB_OWNER }}
           repositories: ${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout app-of-apps repo
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ env.GITHUB_OWNER }}/${{ env.APP_OF_APPS_REPO }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/build-frontend.yml

@@ -35,7 +35,7 @@ jobs:
       should_build: ${{ steps.check.outputs.should_build }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
 
@@ -67,15 +67,15 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ env.GITHUB_OWNER }}
           repositories: ${{ env.APP_REPO_NAME }},${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
 
@@ -124,15 +124,15 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ env.GITHUB_OWNER }}
           repositories: ${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout app-of-apps repo
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ env.GITHUB_OWNER }}/${{ env.APP_OF_APPS_REPO }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/build-keycloak.yml

@@ -34,7 +34,7 @@ jobs:
       should_build: ${{ steps.check.outputs.should_build }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
 
@@ -66,15 +66,15 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ env.GITHUB_OWNER }}
           repositories: ${{ env.APP_REPO_NAME }},${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
 
@@ -120,15 +120,15 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3.0.0
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ env.GITHUB_OWNER }}
           repositories: ${{ env.APP_OF_APPS_REPO }}
 
       - name: Checkout app-of-apps repo
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: ${{ env.GITHUB_OWNER }}/${{ env.APP_OF_APPS_REPO }}
           token: ${{ steps.app-token.outputs.token }}

be/dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-bullseye AS base
+FROM node:22-bullseye@sha256:b65845e07a46fcae018a6c6eedbe247d00103a5ebee99dd71e73436bcc882660 AS base
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
   ghostscript \

be/package.json

@@ -49,34 +49,34 @@
     "typeorm": "^0.3.20"
   },
   "devDependencies": {
-    "@nestjs/cli": "^10.0.0",
-    "@nestjs/schematics": "^10.0.0",
-    "@nestjs/testing": "^10.0.0",
-    "@swc/cli": "^0.5.2",
-    "@swc/core": "^1.4.4",
-    "@types/cookie-parser": "^1.4.7",
-    "@types/express": "^4.17.17",
-    "@types/express-session": "^1.18.0",
-    "@types/jest": "^29.5.2",
-    "@types/multer": "^1.4.11",
-    "@types/node": "^20.3.1",
-    "@types/passport-jwt": "^4.0.1",
-    "@types/passport-local": "^1.0.38",
-    "@types/supertest": "^6.0.0",
-    "@typescript-eslint/eslint-plugin": "^6.0.0",
-    "@typescript-eslint/parser": "^6.0.0",
-    "eslint": "^8.42.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-prettier": "^5.0.0",
-    "jest": "^29.5.0",
-    "prettier": "^3.0.0",
-    "source-map-support": "^0.5.21",
-    "supertest": "^6.3.3",
-    "ts-jest": "^29.1.0",
-    "ts-loader": "^9.4.3",
-    "ts-node": "^10.9.1",
-    "tsconfig-paths": "^4.2.0",
-    "typescript": "^5.1.3"
+    "@nestjs/cli": "10.4.9",
+    "@nestjs/schematics": "10.2.3",
+    "@nestjs/testing": "10.4.22",
+    "@swc/cli": "0.5.2",
+    "@swc/core": "1.15.43",
+    "@types/cookie-parser": "1.4.10",
+    "@types/express": "4.17.25",
+    "@types/express-session": "1.19.0",
+    "@types/jest": "29.5.14",
+    "@types/multer": "1.4.13",
+    "@types/node": "20.19.43",
+    "@types/passport-jwt": "4.0.1",
+    "@types/passport-local": "1.0.38",
+    "@types/supertest": "6.0.3",
+    "@typescript-eslint/eslint-plugin": "6.21.0",
+    "@typescript-eslint/parser": "6.21.0",
+    "eslint": "8.57.1",
+    "eslint-config-prettier": "9.1.2",
+    "eslint-plugin-prettier": "5.5.6",
+    "jest": "29.7.0",
+    "prettier": "3.9.4",
+    "source-map-support": "0.5.21",
+    "supertest": "6.3.4",
+    "ts-jest": "29.4.11",
+    "ts-loader": "9.6.2",
+    "ts-node": "10.9.2",
+    "tsconfig-paths": "4.2.0",
+    "typescript": "5.9.3"
   },
   "jest": {
     "moduleFileExtensions": [

deploy/docker-compose.development.yml

@@ -33,7 +33,7 @@ services:
       - app-network
 
   certbot:
-    image: certbot/certbot
+    image: certbot/certbot@sha256:0107d084c225631fc64a8313e19adb07275f7296fde338f7dfa93986c80b2e3e
     container_name: certbot
     volumes:
       - certbot-etc:/etc/letsencrypt

deploy/docker-compose.local.yml

@@ -46,7 +46,7 @@ services:
       - "--hostname=localhost"
 
   keycloak_db:
-    image: postgres
+    image: postgres@sha256:4aabea78cf39b90e834caf3af7d602a18565f6fe2508705c8d01aa63245c2e20
     container_name: keycloak_db
     restart: always
     # set shared memory limit when using docker-compose

deploy/docker-compose.yml

@@ -28,7 +28,7 @@ services:
       - app-network
 
   keycloak_db:
-    image: postgres
+    image: postgres@sha256:4aabea78cf39b90e834caf3af7d602a18565f6fe2508705c8d01aa63245c2e20
     container_name: keycloak_db
     restart: always
     # set shared memory limit when using docker-compose

deploy/reverse-proxy/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   reverse-proxy:
-    image: nginx:alpine
+    image: nginx:alpine@sha256:54f2a904c251d5a34adf545a72d32515a15e08418dae0266e23be2e18c66fefa
     container_name: reverse_proxy
     configs:
       - source: nginx_conf
@@ -17,7 +17,7 @@ services:
       - app-network
 
   certbot:
-    image: certbot/certbot
+    image: certbot/certbot@sha256:0107d084c225631fc64a8313e19adb07275f7296fde338f7dfa93986c80b2e3e
     container_name: certbot
     volumes:
       - certbot-etc:/etc/letsencrypt

fe/dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS base
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS base
 
 WORKDIR /app
 
@@ -13,7 +13,7 @@ COPY . .
 FROM base AS build
 RUN npm run build
 
-FROM nginx:latest
+FROM nginx:latest@sha256:ec4ed8b5299e5e90694af7750eb6dffd2627317d30544d056b0371f8082f7bce
 COPY --from=build /app/dist /var/www/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 WORKDIR /var/www/html

fe/dockerfile.develop

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS base
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS base
 
 WORKDIR /app
 

fe/package.json

@@ -35,15 +35,15 @@
   "devDependencies": {
     "@types/react": "^19.0.4",
     "@types/react-dom": "^19.0.2",
-    "@typescript-eslint/eslint-plugin": "^8.19.1",
-    "@typescript-eslint/parser": "^8.19.1",
-    "@vitejs/plugin-react-swc": "^3.7.2",
-    "autoprefixer": "^10.4.20",
-    "eslint": "^9.18.0",
-    "eslint-plugin-react-hooks": "^5.1.0",
-    "eslint-plugin-react-refresh": "^0.4.16",
-    "prettier-plugin-tailwindcss": "^0.6.9",
-    "typescript": "^5.7.3",
-    "vite": "^6.0.7"
+    "@typescript-eslint/eslint-plugin": "8.62.1",
+    "@typescript-eslint/parser": "8.62.1",
+    "@vitejs/plugin-react-swc": "3.11.0",
+    "autoprefixer": "10.5.2",
+    "eslint": "9.39.4",
+    "eslint-plugin-react-hooks": "5.2.0",
+    "eslint-plugin-react-refresh": "0.4.26",
+    "prettier-plugin-tailwindcss": "0.6.14",
+    "typescript": "5.9.3",
+    "vite": "6.4.3"
   }
 }

keycloak/dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS theme-builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS theme-builder
 
 RUN apk update && apk add --no-cache openjdk17 maven
 
@@ -10,7 +10,7 @@ RUN npm ci
 COPY theme-app/ ./
 RUN npm run build-keycloak-theme
 
-FROM quay.io/keycloak/keycloak:latest AS builder
+FROM quay.io/keycloak/keycloak:latest@sha256:0aae0de7fca85525f727d3354df17896092de8bb26ae4c12d89c77e5df8cbce4 AS builder
 
 # Enable health and metrics support
 ENV KC_HEALTH_ENABLED=true
@@ -20,7 +20,7 @@ WORKDIR /opt/keycloak
 COPY --from=theme-builder /app/theme-app/dist_keycloak/keycloak-theme-for-kc-all-other-versions.jar /opt/keycloak/providers/
 RUN /opt/keycloak/bin/kc.sh build
 
-FROM quay.io/keycloak/keycloak:latest
+FROM quay.io/keycloak/keycloak:latest@sha256:0aae0de7fca85525f727d3354df17896092de8bb26ae4c12d89c77e5df8cbce4
 COPY --from=builder /opt/keycloak/ /opt/keycloak/
 
 # Copy the startup script

keycloak/dockerfile.dev

@@ -1,4 +1,4 @@
-FROM quay.io/keycloak/keycloak:latest AS builder
+FROM quay.io/keycloak/keycloak:latest@sha256:0aae0de7fca85525f727d3354df17896092de8bb26ae4c12d89c77e5df8cbce4 AS builder
 
 # Enable health and metrics support
 ENV KC_HEALTH_ENABLED=true
@@ -9,7 +9,7 @@ WORKDIR /opt/keycloak
 RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -ext "SAN:c=DNS:localhost,IP:127.0.0.1" -keystore conf/server.keystore
 RUN /opt/keycloak/bin/kc.sh build
 
-FROM quay.io/keycloak/keycloak:latest
+FROM quay.io/keycloak/keycloak:latest@sha256:0aae0de7fca85525f727d3354df17896092de8bb26ae4c12d89c77e5df8cbce4
 COPY --from=builder /opt/keycloak/ /opt/keycloak/
 
 ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]