chore(deps): pin dependencies

.devcontainer/docker-compose.yml

@@ -38,7 +38,7 @@ services:
     working_dir: /workspaces/cms
 
   cms_postgres:
-    image: postgres:18.4
+    image: postgres:18.4@sha256:a02db8cac496f15b094798a38254f14d6e00741f709360e5e00bb6668ea31636
     command:
       - postgres
       - -c
@@ -54,7 +54,7 @@ services:
       - cms_postgres_data:/var/lib/postgresql
 
   rustfs:
-    image: rustfs/rustfs:1.0.0-beta.6
+    image: rustfs/rustfs:1.0.0-beta.6@sha256:e620d37756fff072b10bf648c7bb9d370d7e91a928b7e6a5e1ac85bdfb4e4dab
     environment:
       RUSTFS_ACCESS_KEY: ${S3_ACCESS_KEY_ID}
       RUSTFS_SECRET_KEY: ${S3_SECRET_ACCESS_KEY}
@@ -85,7 +85,7 @@ services:
     restart: "no"
 
   imgproxy:
-    image: ghcr.io/revotale/infrastructure-imgproxy:0.0.20
+    image: ghcr.io/revotale/infrastructure-imgproxy:0.0.20@sha256:b876d6788d59e19f770b213b310d990dcacea31ea03f453bf8b7d4ce1806948f
     environment:
       IMGPROXY_ALLOWED_SOURCES: http://devcontainer:3000/,http://rustfs:9000/
     networks:

.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         id: release
         with:
           release-type: simple
@@ -39,11 +39,11 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Prepare Dockerfile for release build action
         run: cp docker/Dockerfile Dockerfile
       - name: Build and push Docker image
-        uses: revotale/docker-multi-arch-release-action@v1.4.0
+        uses: revotale/docker-multi-arch-release-action@139a43ddaa10e2a91bbdb8f44d4af4e9bcaa5993 # v1.4.0
         with:
           context: .
           registry: ghcr.io

.github/workflows/test.yml

@@ -13,17 +13,17 @@ jobs:
       ROOT_WEBSITE_URL: https://revotale.com
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "25.9.0"
       - name: Install pnpm
         run: npm install -g pnpm@11.5.0
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
       - name: Install Task
-        uses: go-task/setup-task@v2
+        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2
       - run: task typegen
       - name: Validate
         run: task validate
@@ -35,6 +35,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Build Docker image
         run: docker build -f docker/Dockerfile .

docker/Dockerfile

@@ -1,6 +1,6 @@
-# syntax=docker.io/docker/dockerfile:1
+# syntax=docker.io/docker/dockerfile:1@sha256:4edf897a3ffa55b89f906fc8cc78afdb3f1834cc9c7083565e611a8a7d5fe99e
 
-FROM node:25.9.0-trixie AS base
+FROM node:25.9.0-trixie@sha256:b6cf8d20ee78aa10f0a6b98242e26d547869801abd6bc3f7094b0a54301dee02 AS base
 RUN npm install -g pnpm@11.23.0
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
@@ -24,7 +24,7 @@ COPY . .
 RUN pnpm run "build:${NEXT_BUILD_MODE}"
 
 # 3. Lightweight production image with standalone output only
-FROM node:25.9.0-trixie AS runner
+FROM node:25.9.0-trixie@sha256:b6cf8d20ee78aa10f0a6b98242e26d547869801abd6bc3f7094b0a54301dee02 AS runner
 WORKDIR /app
 
 ENV NODE_ENV=production

docker/dev.Dockerfile

@@ -1,4 +1,4 @@
-FROM node:25.9.0-trixie AS base
+FROM node:25.9.0-trixie@sha256:b6cf8d20ee78aa10f0a6b98242e26d547869801abd6bc3f7094b0a54301dee02 AS base
 
 RUN npm install -g pnpm@11.23.0
 

package.json

@@ -94,20 +94,20 @@
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.10",
-		"@graphql-codegen/add": "^7.1.0",
+		"@graphql-codegen/add": "7.1.0",
 		"@graphql-codegen/cli": "7.3.1",
 		"@graphql-codegen/client-preset": "6.1.3",
 		"@graphql-codegen/introspection": "6.1.0",
-		"@graphql-codegen/schema-ast": "^6.1.0",
-		"@tailwindcss/postcss": "^4.3.3",
-		"@tailwindcss/typography": "^0.5.20",
-		"@types/escape-html": "^1.0.4",
+		"@graphql-codegen/schema-ast": "6.1.0",
+		"@tailwindcss/postcss": "4.3.3",
+		"@tailwindcss/typography": "0.5.20",
+		"@types/escape-html": "1.0.4",
 		"@types/node": "26.3.0",
 		"@types/react": "^19.2.18",
 		"@types/react-dom": "^19.2.5",
-		"postcss": "^8.5.26",
-		"tailwindcss": "^4.3.3",
-		"tw-animate-css": "^1.4.0",
+		"postcss": "8.5.26",
+		"tailwindcss": "4.3.3",
+		"tw-animate-css": "1.4.0",
 		"typescript": "7.0.2"
 	},
 	"engines": {