Pin dependencies

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ jobs:
       # Label used to access the service container
       db:
         # Docker Hub image
-        image: postgres:12.22
+        image: postgres:12.22@sha256:2f2a8c2a7d10862e7fba2602e304523554f9df8244c632dafe2628ccb398fb5c
         # Set health checks to wait until postgres has started
         options: >-
           --health-cmd pg_isready
@@ -23,7 +23,7 @@ jobs:
           - 5432:5432
 
       redis:
-        image: redis:8.2.2
+        image: redis:8.2.2@sha256:4521b581dbddea6e7d81f8fe95ede93f5648aaa66a9dacd581611bf6fe7527bd
         ports:
           - 6379:6379
 
@@ -37,7 +37,7 @@ jobs:
         run: cat Aptfile | sudo xargs apt-get install
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           enable-cache: true
 

Dockerfile

@@ -1,6 +1,6 @@
 # hadolint global ignore=SC2046,DL3002,DL3008,DL3025,DL3042,DL4006
 
-FROM python:3.12-slim AS base
+FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9 AS base
 LABEL maintainer "ODL DevOps <mitx-devops@mit.edu>"
 
 # Add package files, install updated node and pip
@@ -35,7 +35,7 @@ ENV  \
 ENV PATH="/opt/venv/bin:$PATH"
 
 # Install uv
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:latest@sha256:d0a0a753ab981624b49c97abc98821c1c09f4ca69d1ef5cee69c501be3d88479 /uv /uvx /usr/local/bin/
 
 # Install Chromium (commented out lines illustrate the syntax for getting specific chromium versions)
 RUN echo "deb http://deb.debian.org/debian/ sid main" >> /etc/apt/sources.list \

Dockerfile.watch

@@ -1,4 +1,4 @@
-FROM node:24.13
+FROM node:24.13@sha256:00e9195ebd49985a6da8921f419978d85dfe354589755192dc090425ce4da2f7
 
 # Install Playwright system dependencies
 RUN apt-get update && apt-get install -y \

docker-compose.opensearch.base.yml

@@ -1,6 +1,6 @@
 services:
   opensearch:
-    image: opensearchproject/opensearch:3.3.0
+    image: opensearchproject/opensearch:3.3.0@sha256:d96afaf6cbd2a6a3695aeb2f1d48c9a16ad5c8918eb849e5cbf43475f0f8e146
     environment:
       - "cluster.name=opensearch-cluster"
       - "bootstrap.memory_lock=true" # along with the memlock settings below, disables swapping

docker-compose.services.yml

@@ -11,7 +11,7 @@ services:
   db:
     profiles:
       - backend
-    image: postgres:16
+    image: postgres:16@sha256:081f1bc7bd5e143dbb6e487b710bbc27712cdcfaced4c071b8e47349aa1b4171
     healthcheck:
       test: ["CMD", "pg_isready"]
       interval: 3s
@@ -31,7 +31,7 @@ services:
   redis:
     profiles:
       - backend
-    image: redis:8.2.2
+    image: redis:8.2.2@sha256:4521b581dbddea6e7d81f8fe95ede93f5648aaa66a9dacd581611bf6fe7527bd
     healthcheck:
       test: ["CMD", "redis-cli", "ping", "|", "grep", "PONG"]
       interval: 3s
@@ -40,7 +40,7 @@ services:
     ports:
       - "6379"
   qdrant:
-    image: qdrant/qdrant:latest
+    image: qdrant/qdrant:latest@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c
     ports:
       - "6333:6333"
     volumes:
@@ -68,12 +68,12 @@ services:
   tika:
     profiles:
       - backend
-    image: apache/tika:2.5.0
+    image: apache/tika:2.5.0@sha256:d680d1d7136f35de43294e7b80ac495da463f069b0f1d59be1ebac5f0543f075
     ports:
       - "9998:9998"
 
   locust:
-    image: locustio/locust
+    image: locustio/locust@sha256:05bf8d43903b73da784f8c2443f0d46cfc7fa830a605e5e2501a0a25ec80374a
     ports:
       - "8089:8089"
     volumes:
@@ -85,7 +85,7 @@ services:
       - load-testing
 
   locust-worker:
-    image: locustio/locust
+    image: locustio/locust@sha256:05bf8d43903b73da784f8c2443f0d46cfc7fa830a605e5e2501a0a25ec80374a
     volumes:
       - ./load_testing_locust:/mnt/locust
     command: -f /mnt/locust/locustfile.py --worker --master-host locust
@@ -97,7 +97,7 @@ services:
   keycloak:
     profiles:
       - keycloak
-    image: quay.io/keycloak/keycloak:26.4
+    image: quay.io/keycloak/keycloak:26.4@sha256:9409c59bdfb65dbffa20b11e6f18b8abb9281d480c7ca402f51ed3d5977e6007
     depends_on:
       db:
         condition: service_healthy
@@ -123,7 +123,7 @@ services:
   apigateway:
     profiles:
       - apisix
-    image: apache/apisix:3.13.0-debian # versions above this drop the local port on redirects
+    image: apache/apisix:3.13.0-debian@sha256:c5c7a55ebb5c07abc210dbb963a37f41030e12c91d23bacedbaa168fec633bd7 # versions above this drop the local port on redirects
     <<: *default-extra-hosts
     environment:
       - CSRF_COOKIE_DOMAIN=${CSRF_COOKIE_DOMAIN:-.odl.local}

frontends/api/package.json

@@ -22,12 +22,12 @@
     "react": "^19.2.1"
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@testing-library/react": "^16.3.0",
-    "enforce-unique": "^1.3.0",
-    "jest": "^29.7.0",
-    "jest-when": "^3.7.0",
-    "lodash": "^4.17.21",
+    "@faker-js/faker": "10.5.0",
+    "@testing-library/react": "16.3.2",
+    "enforce-unique": "1.3.0",
+    "jest": "29.7.0",
+    "jest-when": "3.7.0",
+    "lodash": "4.18.1",
     "ol-test-utilities": "0.0.0"
   },
   "dependencies": {

frontends/main/Dockerfile.web

@@ -43,7 +43,7 @@
 # heroku container:release --app mitopen-rc-nextjs frontend
 
 
-FROM node:24-alpine AS base
+FROM node:24-alpine@sha256:156b55f92e98ccd5ef49578a8cea0df4679826564bad1c9d4ef04462b9f0ded6 AS base
 
 RUN apk update
 RUN apk add --no-cache libc6-compat && \
@@ -100,7 +100,7 @@ RUN yarn build
 # The standalone server is started directly with node (not `yarn start`), which
 # avoids yarn overhead and is the pattern recommended by Next.js for Docker:
 # https://github.com/vercel/next.js/tree/canary/examples/with-docker
-FROM node:24-alpine AS runner
+FROM node:24-alpine@sha256:156b55f92e98ccd5ef49578a8cea0df4679826564bad1c9d4ef04462b9f0ded6 AS runner
 
 WORKDIR /app
 

frontends/main/package.json

@@ -75,28 +75,28 @@
     "yup": "^1.4.0"
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@happy-dom/jest-environment": "^20.1.0",
-    "@testing-library/jest-dom": "^6.4.8",
-    "@testing-library/react": "^16.3.0",
-    "@testing-library/user-event": "^14.5.2",
-    "@types/jest": "^29.5.12",
-    "@types/lodash": "^4.17.7",
-    "@types/node": "^24.0.0",
-    "@types/papaparse": "^5.5.2",
+    "@faker-js/faker": "10.5.0",
+    "@happy-dom/jest-environment": "20.10.6",
+    "@testing-library/jest-dom": "6.9.1",
+    "@testing-library/react": "16.3.2",
+    "@testing-library/user-event": "14.6.1",
+    "@types/jest": "29.5.14",
+    "@types/lodash": "4.17.24",
+    "@types/node": "24.13.2",
+    "@types/papaparse": "5.5.2",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
-    "@types/react-slick": "^0.23.13",
-    "@types/slick-carousel": "^1",
+    "@types/react-slick": "0.23.13",
+    "@types/slick-carousel": "1.6.40",
     "eslint": "8.57.1",
-    "eslint-config-next": "^16.1.6",
-    "http-proxy-middleware": "^3.0.0",
-    "jest": "^29.7.0",
-    "jest-extended": "^7.0.0",
-    "jest-next-dynamic-ts": "^0.1.1",
-    "next-router-mock": "^1.0.2",
+    "eslint-config-next": "16.2.9",
+    "http-proxy-middleware": "3.0.7",
+    "jest": "29.7.0",
+    "jest-extended": "7.0.0",
+    "jest-next-dynamic-ts": "0.1.1",
+    "next-router-mock": "1.0.5",
     "ol-test-utilities": "0.0.0",
-    "ts-jest": "^29.2.4",
-    "typescript": "^5.5.4"
+    "ts-jest": "29.4.11",
+    "typescript": "5.9.3"
   }
 }

frontends/ol-components/package.json

@@ -45,26 +45,26 @@
     "wheel-indicator": "^1.3.0"
   },
   "devDependencies": {
-    "@chromatic-com/storybook": "^5.0.0",
-    "@faker-js/faker": "^10.0.0",
-    "@storybook/addon-docs": "^10.0.0",
-    "@storybook/addon-links": "^10.0.0",
-    "@storybook/addon-onboarding": "^10.0.0",
-    "@storybook/addon-webpack5-compiler-swc": "^4.0.0",
-    "@storybook/nextjs": "^10.2.4",
+    "@chromatic-com/storybook": "5.2.1",
+    "@faker-js/faker": "10.5.0",
+    "@storybook/addon-docs": "10.4.6",
+    "@storybook/addon-links": "10.4.6",
+    "@storybook/addon-onboarding": "10.4.6",
+    "@storybook/addon-webpack5-compiler-swc": "4.0.3",
+    "@storybook/nextjs": "10.4.6",
     "@storybook/test": "8.6.15",
-    "@testing-library/react": "^16.3.0",
-    "@testing-library/user-event": "^14.5.2",
-    "@types/lodash.throttle": "^4.1.9",
-    "@types/react-google-recaptcha": "^2.1.9",
-    "@types/react-slick": "^0.23.13",
-    "dotenv": "^17.0.0",
-    "lodash": "^4.17.21",
-    "prop-types": "^15.8.1",
-    "sass": "^1.93.3",
-    "sass-embedded": "^1.93.3",
-    "storybook": "^10.2.4",
-    "typescript": "^5.5.4"
+    "@testing-library/react": "16.3.2",
+    "@testing-library/user-event": "14.6.1",
+    "@types/lodash.throttle": "4.1.9",
+    "@types/react-google-recaptcha": "2.1.9",
+    "@types/react-slick": "0.23.13",
+    "dotenv": "17.4.2",
+    "lodash": "4.18.1",
+    "prop-types": "15.8.1",
+    "sass": "1.101.0",
+    "sass-embedded": "1.100.0",
+    "storybook": "10.4.6",
+    "typescript": "5.9.3"
   },
   "peerDependencies": {
     "@mitodl/smoot-design": "^6.27.0",

frontends/ol-test-utilities/package.json

@@ -20,7 +20,7 @@
     "react": "^19.2.1"
   },
   "devDependencies": {
-    "@types/lodash": "^4.17.7",
+    "@types/lodash": "4.17.24",
     "@types/react": "^19.2.7"
   }
 }

frontends/ol-utilities/package.json

@@ -19,10 +19,10 @@
     "qs": "^6.11.0"
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@testing-library/react": "^16.3.0",
-    "@testing-library/user-event": "^14.5.2",
+    "@faker-js/faker": "10.5.0",
+    "@testing-library/react": "16.3.2",
+    "@testing-library/user-event": "14.6.1",
     "ol-test-utilities": "0.0.0",
-    "tiny-invariant": "^1.3.3"
+    "tiny-invariant": "1.3.3"
   }
 }

frontends/package.json

@@ -35,44 +35,44 @@
   },
   "version": "0.0.0",
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@next/eslint-plugin-next": "^16.2.7",
-    "@swc/core": "^1.11.29",
-    "@swc/jest": "^0.2.38",
-    "@testing-library/jest-dom": "^6.4.8",
-    "@testing-library/react": "^16.3.0",
-    "@testing-library/user-event": "^14.5.2",
-    "@types/jest": "^29.5.12",
-    "@types/jest-when": "^3.5.2",
-    "@types/react-google-recaptcha": "^2.1.9",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "@typescript-eslint/typescript-estree": "^8.0.0",
-    "cross-fetch": "^4.0.0",
+    "@faker-js/faker": "10.1.0",
+    "@next/eslint-plugin-next": "16.2.7",
+    "@swc/core": "1.12.6",
+    "@swc/jest": "0.2.38",
+    "@testing-library/jest-dom": "6.5.0",
+    "@testing-library/react": "16.3.0",
+    "@testing-library/user-event": "14.5.2",
+    "@types/jest": "29.5.13",
+    "@types/jest-when": "3.5.5",
+    "@types/react-google-recaptcha": "2.1.9",
+    "@typescript-eslint/eslint-plugin": "8.12.2",
+    "@typescript-eslint/typescript-estree": "8.38.0",
+    "cross-fetch": "4.0.0",
     "eslint": "8.57.1",
-    "eslint-config-mitodl": "^2.1.0",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-import-resolver-typescript": "^4.0.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jest": "^29.0.0",
-    "eslint-plugin-mdx": "^3.0.0",
-    "eslint-plugin-react": "^7.34.3",
-    "eslint-plugin-react-hooks": "^5.0.0",
-    "eslint-plugin-styled-components-a11y": "^2.1.35",
-    "eslint-plugin-testing-library": "^7.0.0",
-    "jest": "^29.7.0",
-    "jest-environment-jsdom": "^29.5.0",
-    "jest-extended": "^7.0.0",
-    "jest-fail-on-console": "^3.3.1",
-    "jest-watch-typeahead": "^3.0.1",
-    "jest-when": "^3.7.0",
-    "postcss-styled-syntax": "^0.7.0",
-    "prettier": "^3.3.3",
-    "prettier-plugin-django-alpine": "^1.2.6",
-    "stylelint": "^16.18.0",
-    "stylelint-config-standard-scss": "^15.0.0",
+    "eslint-config-mitodl": "2.1.0",
+    "eslint-config-prettier": "10.0.1",
+    "eslint-import-resolver-typescript": "4.3.4",
+    "eslint-plugin-import": "2.31.0",
+    "eslint-plugin-jest": "29.0.1",
+    "eslint-plugin-mdx": "3.1.5",
+    "eslint-plugin-react": "7.37.1",
+    "eslint-plugin-react-hooks": "5.1.0",
+    "eslint-plugin-styled-components-a11y": "2.1.35",
+    "eslint-plugin-testing-library": "7.1.1",
+    "jest": "29.7.0",
+    "jest-environment-jsdom": "29.7.0",
+    "jest-extended": "7.0.0",
+    "jest-fail-on-console": "3.3.1",
+    "jest-watch-typeahead": "3.0.1",
+    "jest-when": "3.7.0",
+    "postcss-styled-syntax": "0.7.0",
+    "prettier": "3.3.3",
+    "prettier-plugin-django-alpine": "1.3.0",
+    "stylelint": "16.22.0",
+    "stylelint-config-standard-scss": "15.0.1",
     "syncpack": "14.0.0-alpha.40",
-    "ts-node": "^10.9.2",
-    "typescript": "^5.5.4"
+    "ts-node": "10.9.2",
+    "typescript": "5.6.3"
   },
   "dependencies": {
     "@jest/environment": "^29.7.0",

load_testing/package.json

@@ -6,7 +6,7 @@
   "author": "",
   "license": "ISC",
   "devDependencies": {
-    "@grafana/openapi-to-k6": "^0.4.1",
-    "@types/k6": "^1.7.0"
+    "@grafana/openapi-to-k6": "0.4.1",
+    "@types/k6": "1.7.0"
   }
 }