chore(deps): pin dependencies

.devcontainer/stack/keycloak/compose.yml

@@ -8,7 +8,7 @@
 # this file.
 services:
   keycloak:
-    image: quay.io/keycloak/keycloak:26.7.4
+    image: quay.io/keycloak/keycloak:26.7.4@sha256:82a77884f3af238beab1e7afd63b5f530e1b5c0590bd7aa60b40a40463e29b2c
     restart: unless-stopped
     command: start-dev --import-realm
     env_file:

.devcontainer/stack/mqtt/compose.yml

@@ -5,7 +5,7 @@
 # this file's own directory (see ../README.md's "Devcontainer stack pattern").
 services:
   mqtt:
-    image: eclipse-mosquitto:2.0.22
+    image: eclipse-mosquitto:2.0.22@sha256:81a6193ae693942a3231cd3ac52875b02b7e3a19da671b2fb4b55cc874c5b279
     restart: unless-stopped
     volumes:
       - ./mosquitto.conf:/mosquitto/config/mosquitto.conf:ro

.devcontainer/stack/postgres/compose.yml

@@ -6,7 +6,7 @@
 # ../README.md's "Devcontainer stack pattern" section.
 services:
   postgres:
-    image: postgres:18.6-alpine
+    image: postgres:18.6-alpine@sha256:9ba53c7d41ea093baf5c1ba635ba5434c4f979880527d49bb7d9237d3193085b
     restart: unless-stopped
     env_file:
       - ./postgres.env

.devcontainer/stack/redis/compose.yml

@@ -2,7 +2,7 @@
 # compose-generated default network (see ../README.md).
 services:
   redis:
-    image: valkey/valkey:9.1.2-alpine
+    image: valkey/valkey:9.1.2-alpine@sha256:48332870af354a799964c0012ae1194a0bf2bf894eb508f945810596dc2d8d11
     restart: unless-stopped
     command: valkey-server --appendonly yes
     volumes:

.devcontainer/stack/s3/compose.yml

@@ -6,7 +6,7 @@
 # ../README.md's "Devcontainer stack pattern" section.
 services:
   s3:
-    image: rustfs/rustfs:1.0.0-rc.5-glibc
+    image: rustfs/rustfs:1.0.0-rc.5-glibc@sha256:d14642b8ade7438d75543a357ef2c9dfa7ac06575995163fc692642a24816a51
     restart: unless-stopped
     environment:
       RUSTFS_VOLUMES: /data/rustfs0

.devcontainer/stack/selenium/compose.yml

@@ -7,7 +7,7 @@
 # the devcontainer itself (see tests/e2e/README.md).
 services:
   selenium:
-    image: selenium/standalone-chromium:151.0.7922.108-chromedriver-151.0.7922.108-grid-4.47.0-20260808
+    image: selenium/standalone-chromium:151.0.7922.108-chromedriver-151.0.7922.108-grid-4.47.0-20260808@sha256:1d3d834a2ce93f26cc0d0ae3c61abd189755b32649f5c356c6c5cf9502aa397e
     restart: unless-stopped
     shm_size: 2gb
     # The grid reports itself up before its one node finishes registering;

.devcontainer/stack/umami/compose.yml

@@ -10,7 +10,7 @@ services:
   # Not docker-entrypoint-initdb.d, which Postgres skips on an existing
   # volume. Connects with the stack's Postgres credentials.
   umami-db-init:
-    image: postgres:18.6-alpine
+    image: postgres:18.6-alpine@sha256:9ba53c7d41ea093baf5c1ba635ba5434c4f979880527d49bb7d9237d3193085b
     restart: "no"
     env_file:
       - ../postgres/postgres.env
@@ -47,7 +47,7 @@ services:
   # analytics.env, the same file myapp loads).
   # user_id is the admin user created by Umami's migration 01_init.
   umami-seed:
-    image: postgres:18.6-alpine
+    image: postgres:18.6-alpine@sha256:9ba53c7d41ea093baf5c1ba635ba5434c4f979880527d49bb7d9237d3193085b
     restart: "no"
     env_file:
       - ../postgres/postgres.env

Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.28
+# syntax=docker/dockerfile:1.28@sha256:bb22d9815c728170f72750f4e5b0d672e06176142e1d602c7e66c050100b7e5b
 # Runtime image (builder → runner), the repo's only top-level Dockerfile, in
 # the layout template-docker expects (docs/TEMPLATE.md's "Image layer"). The
 # devcontainer image is the base-owned .devcontainer/Dockerfile's `develop`

compose.yml

@@ -38,7 +38,7 @@ services:
   # writes the same key pair under RustFS's required filenames
   # (RUSTFS_TLS_PATH expects exactly rustfs_cert.pem/rustfs_key.pem).
   smoke-tls-cert:
-    image: alpine/openssl:latest
+    image: alpine/openssl:latest@sha256:6821afa2476e11be343f29275f2ca24291720ff0a7148bd131fd8e314ff26d9e
     entrypoint: ["sh", "-c"]
     command:
       # chmod: this container runs as root, but Keycloak's image runs as
@@ -140,7 +140,7 @@ services:
   # inline (configs: below) and the password file is built at startup from
   # the smoke-only credentials, so no secret-shaped file is checked in.
   mqtt:
-    image: eclipse-mosquitto:2.0.22
+    image: eclipse-mosquitto:2.0.22@sha256:81a6193ae693942a3231cd3ac52875b02b7e3a19da671b2fb4b55cc874c5b279
     entrypoint: ["sh", "-c"]
     command:
       - >-