chore(deps): pin dependencies

.devcontainer/Dockerfile.console

@@ -1,5 +1,5 @@
-FROM quay.io/openshift/origin-console:latest
-COPY --from=openshift/origin-cli:latest /usr/bin/oc /usr/local/bin/oc
+FROM quay.io/openshift/origin-console:latest@sha256:359f751d092bf708c55dbc605136843210c89413182c4fb295ff503e26b0fcac
+COPY --from=openshift/origin-cli:latest@sha256:509e052d0f2d531b666b7da9fa49c5558c76ce5d286456f0859c0a49b16d6bf2 /usr/bin/oc /usr/local/bin/oc
 
 ENV OC_URL=$OC_URL
 ENV OC_PASS=$OC_PASS

.devcontainer/Dockerfile.plugin

@@ -1,2 +1,2 @@
-FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:24 as build
-COPY --from=openshift/origin-cli:latest /usr/bin/oc /usr/local/bin/oc
+FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:24@sha256:0cbad76d1987fd35fd78cbc58cbe8c2aa93a8daa45411e52c6c6b63ea2dae202 as build
+COPY --from=openshift/origin-cli:latest@sha256:509e052d0f2d531b666b7da9fa49c5558c76ce5d286456f0859c0a49b16d6bf2 /usr/bin/oc /usr/local/bin/oc

.github/workflows/ci.yaml

@@ -30,7 +30,7 @@ jobs:
         with:
           node-version: 'lts/*'
           cache: 'yarn'
-      - uses: bahmutov/npm-install@v1.12.1
+      - uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1.12.1
       - run: yarn format
 
   lint:
@@ -44,7 +44,7 @@ jobs:
         with:
           node-version: 'lts/*'
           cache: 'yarn'
-      - uses: bahmutov/npm-install@v1.12.1
+      - uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1.12.1
       - run: yarn lint
 
   type-check:
@@ -58,7 +58,7 @@ jobs:
         with:
           node-version: 'lts/*'
           cache: 'yarn'
-      - uses: bahmutov/npm-install@v1.12.1
+      - uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1.12.1
       - run: yarn type-check:plugin
 
   test:
@@ -76,7 +76,7 @@ jobs:
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'yarn'
-    - uses: bahmutov/npm-install@v1.12.1
+    - uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1.12.1
     - run: yarn test:ci
 
   test-backend:

Dockerfile

@@ -1,6 +1,6 @@
 ARG APP_DIR=/opt/app-root/src
 
-FROM registry.access.redhat.com/ubi9/nodejs-22:9.8-1780452712 AS frontend_build
+FROM registry.access.redhat.com/ubi9/nodejs-22:9.8-1780452712@sha256:6a3eed5bfd580871fde7329421ce0b2ae533e28792f6db1accbd77602e271ad7 AS frontend_build
 USER root
 WORKDIR /usr/src/app
 ADD console-extensions.ts console-plugin-metadata.ts eslint.config.js i18next-parser.config.js package.json yarn.lock .prettierrc.yml tsconfig.json webpack.config.ts /usr/src/app/
@@ -13,13 +13,13 @@ RUN (command -v corepack || npm install --global corepack) && \
 RUN echo "nodeLinker: node-modules" > .yarnrc.yml
 RUN yarn install && yarn build
 
-FROM registry.access.redhat.com/ubi9/nodejs-22:9.8-1780452712 AS backend_build
+FROM registry.access.redhat.com/ubi9/nodejs-22:9.8-1780452712@sha256:6a3eed5bfd580871fde7329421ce0b2ae533e28792f6db1accbd77602e271ad7 AS backend_build
 USER root
 WORKDIR /usr/src/app
 ADD backend /usr/src/app
 RUN npm ci && npm run build
 
-FROM registry.access.redhat.com/ubi9/nodejs-22-minimal:9.8-1779828907
+FROM registry.access.redhat.com/ubi9/nodejs-22-minimal:9.8-1779828907@sha256:75a2c4753c2475d715e31304ec1effef61770713e6e9fdafdcb80351dbdf3ba5
 ARG APP_DIR
 ENV SRVDIR="${APP_DIR}"
 LABEL io.cryostat.component=console-plugin

charts/openshift-console-plugin/values.yaml

@@ -2,7 +2,7 @@
 plugin:
   name: cryostat-plugin
   description: ""
-  image: quay.io/cryostat/cryostat-openshift-console-plugin:latest
+  image: quay.io/cryostat/cryostat-openshift-console-plugin:latest@sha256:7b8afab58c4e31d33d5333d373e0a962cd8dde27fa784ef385b06d7366281546
   imagePullPolicy: Always
   replicas: 2
   port: 9443

package.json

@@ -129,7 +129,7 @@
   "resolutions": {
     "@types/react": "17.0.93",
     "lodash": "4.18.1",
-    "dompurify": "^3.4.0"
+    "dompurify": "3.4.11"
   },
   "config": {
     "api_schema_path": "https://raw.githubusercontent.com/cryostatio/cryostat/refs/heads/main/schema/openapi.yaml"