chore(deps): pin dependencies

Author: renovate[bot]

backend-go/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24 AS build
+FROM golang:1.24@sha256:39d9e7d9c5d9c9e4baf0d8fff579f06d5032c0f4425cdec9e86732e8e4e374dc AS build
 WORKDIR /workspace/app
 # pre-copy/cache go.mod for pre-downloading dependencies and only redownloading them in subsequent builds if they change
 COPY go.mod go.sum ./
@@ -12,7 +12,7 @@ RUN mkdir -p /workspace/app/target/application
 RUN CGO_ENABLED=0 GOOS=linux go build -v -o /workspace/app/target/application ./...
 HEALTHCHECK --interval=3000s --timeout=30s CMD go version || exit 1
 
-FROM alpine:3.21
+FROM alpine:3.21@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
 ARG DEPENDENCY=/workspace/app/target/application
 RUN apk add --no-cache bash
 RUN addgroup -S appgroup && adduser -S 1001 -G appgroup

backend-go/db/Dockerfile

@@ -1,4 +1,4 @@
-FROM flyway/flyway:11-alpine
+FROM flyway/flyway:11-alpine@sha256:e5c941be8cda7f641cdd80f267bc45297fb6d04ea9275f60d408cd4ba4f52354
 
 # Non-root user
 RUN adduser -D app

backend-java/Dockerfile

@@ -9,7 +9,7 @@ COPY --chown=quarkus:quarkus . ./
 RUN ./mvnw package -Pnative -DskipTests
 
 # "A base image to run Quarkus native application using UBI Micro"
-FROM quay.io/quarkus/quarkus-micro-image:2.0
+FROM quay.io/quarkus/quarkus-micro-image:2.0@sha256:8439095bcd7a0ead18db87d2fc17bdc9b9a62df07ddeb65590b09f92d79bcadb
 
 # Port and health check
 EXPOSE 3000

backend-py/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.13.3 AS build
+FROM python:3.13.3@sha256:3abe339a3bc81ffabcecf9393445594124de6420b3cfddf248c52b1115218f04 AS build
 
 # Disable cache dir, disable upgrade message, create .venv in project dir
 ARG PIP_NO_CACHE_DIR=off \
@@ -12,7 +12,7 @@ RUN pip install poetry==1.6.1
 RUN poetry install --no-root -vvv --without dev --sync
 
 # Deploy
-FROM python:3.13.3-slim  AS deploy
+FROM python:3.13.3-slim@sha256:914bf5c12ea40a97a78b2bff97fbdb766cc36ec903bfb4358faf2b74d73b555b  AS deploy
 
 # Output to stdout/stderr, don't create .pyc files, etc.
 ENV PYTHONUNBUFFERED=1 \

backend-py/db/Dockerfile

@@ -1,4 +1,4 @@
-FROM flyway/flyway:11-alpine
+FROM flyway/flyway:11-alpine@sha256:e5c941be8cda7f641cdd80f267bc45297fb6d04ea9275f60d408cd4ba4f52354
 # Non-root user
 RUN adduser -D app
 USER app

charts/app/values.yaml

@@ -115,7 +115,7 @@ bitnami-pg:
   image:
     registry: ghcr.io
     repository: bcgov/nr-containers/bitnami/postgresql
-    tag: 15.10.0
+    tag: 15.10.0@sha256:708df150b32fddb3d4b8afb8ba2377b667beac2679b3a30ee855b4d2181f87d2
   auth:
     existingSecret: '{{ .Release.Name }}'
     username: 'quickstart'

docker-compose.yml

@@ -37,7 +37,7 @@ x-python-vars: &python-vars
 
 services:
   database:
-    image: postgres:15
+    image: postgres:15@sha256:b8e11f8a8b383e19589a086a78b10f9ca69a39d6c9dcdd9342a8697544e8b3a0
     container_name: database
     environment:
       <<: *postgres-vars
@@ -47,7 +47,7 @@ services:
 
   migrations-go:
     profiles: ["go", "all"]
-    image: flyway/flyway:9-alpine
+    image: flyway/flyway:9-alpine@sha256:966538712a19b0f79ac24344d1373c8cc5e405427ec4b93a6d9e827c821bba8f
     container_name: migrations-go
     command: info migrate info
     volumes: ["./backend-go/db/migrations:/flyway/sql:ro"]
@@ -60,7 +60,7 @@ services:
 
   migrations-py:
     profiles: ["python", "all"]
-    image: flyway/flyway:9-alpine
+    image: flyway/flyway:9-alpine@sha256:966538712a19b0f79ac24344d1373c8cc5e405427ec4b93a6d9e827c821bba8f
     container_name: migrations-py
     command: info migrate info
     volumes: ["./backend-py/db/migrations:/flyway/sql:ro"]
@@ -89,7 +89,7 @@ services:
 
   backend-py-model-generator:
     profiles: ["python", "all"]
-    image: python:3.11-slim-buster # DO NOT change, as it breaks the module.
+    image: python:3.11-slim-buster@sha256:c46b0ae5728c2247b99903098ade3176a58e274d9c7d2efeaaab3e0621a53935 # DO NOT change, as it breaks the module.
     container_name: backend-py-model-generator
     environment:
       <<: *postgres-vars
@@ -103,7 +103,7 @@ services:
 
   backend-py:
     profiles: ["python", "all"]
-    image: python:3.13
+    image: python:3.13@sha256:3abe339a3bc81ffabcecf9393445594124de6420b3cfddf248c52b1115218f04
     container_name: backend-py
     entrypoint: /application/start-local.sh
     volumes: ["./backend-py:/application", "/application/.venv"]
@@ -119,7 +119,7 @@ services:
 
   backend-py-test:
     profiles: ["python", "all"]
-    image: python:3.13
+    image: python:3.13@sha256:3abe339a3bc81ffabcecf9393445594124de6420b3cfddf248c52b1115218f04
     container_name: backend-py-test
     entrypoint: /application/run-unit-tests.sh
     volumes: ["./backend-py:/application", "/application/.venv"]