From cda1e4a2b7fe1a4bc2484ebd8a260a4591d6a509 Mon Sep 17 00:00:00 2001
From: uartnet <140632163+uartnet@users.noreply.github.com>
Date: Sun, 23 Aug 2026 03:28:35 +0200
Subject: [PATCH] chore(deps): refresh build toolchain

---
 .github/workflows/build.yml            |  2 +-
 .github/workflows/conan.yml            | 38 +++++++++++++-------------
 .github/workflows/release-packages.yml | 36 ++++++++++++------------
 .github/workflows/release-please.yml   |  2 +-
 .github/workflows/reliability.yml      |  6 ++--
 build-docker-linuxbrew.sh              |  1 +
 conan/Dockerfile                       | 10 +++----
 conan/compose.yaml                     |  2 +-
 docker/Dockerfile.conan.android        | 10 ++++---
 docker/Dockerfile.conan.emscripten     |  8 ++++--
 docker/Dockerfile.conan.glibc          |  4 +--
 docker/Dockerfile.conan.mingw          | 10 ++++---
 docker/Dockerfile.conan.musl           |  2 +-
 docker/Dockerfile.debian               |  8 +++---
 docker/Dockerfile.linuxbrew            |  6 ++--
 requirements.txt                       |  6 ++--
 16 files changed, 79 insertions(+), 72 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3254773..de553d4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,7 +26,7 @@ jobs:
     if: ${{ github.actor == vars.CI_ALLOWED_ACTOR }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: python3 test/test_release_workflow.py
diff --git a/.github/workflows/conan.yml b/.github/workflows/conan.yml
index 5abe621..7b053f1 100644
--- a/.github/workflows/conan.yml
+++ b/.github/workflows/conan.yml
@@ -8,7 +8,7 @@ on:
 permissions:
   contents: read
 env:
-  CONAN_VERSION: "2.26.2"
+  CONAN_VERSION: "2.31.2"
 jobs:
   build:
     name: Linux ${{ matrix.linkage }} libraries, ${{ matrix.plugin_mode }} plugins
@@ -55,13 +55,13 @@ jobs:
             pkg-config \
             tar \
             xz-utils
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         with:
           path: ~/.conan2/p
@@ -73,7 +73,7 @@ jobs:
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-${{ matrix.plugin_mode }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: compiler-cache
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -136,12 +136,12 @@ jobs:
         run: |
           set -euo pipefail
           conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: ~/.conan2/p
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.compiler-cache.outputs.cache-hit != 'true' }}
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -175,13 +175,13 @@ jobs:
             plugin_mode: dynamic
             static_plugins: "False"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         with:
           path: ~/.conan2/p
@@ -193,7 +193,7 @@ jobs:
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-${{ matrix.plugin_mode }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: compiler-cache
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -245,12 +245,12 @@ jobs:
         run: |
           set -euo pipefail
           conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: ~/.conan2/p
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.compiler-cache.outputs.cache-hit != 'true' }}
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -272,13 +272,13 @@ jobs:
           - linkage: static
             shared: "False"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         with:
           path: ~/.conan2/p
@@ -288,7 +288,7 @@ jobs:
             conan2-v2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-${{ matrix.linkage }}-
             conan2-${{ env.CONAN_VERSION }}-${{ runner.os }}-${{ runner.arch }}-${{ inputs.channel }}-
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: compiler-cache
         with:
           path: ${{ env.CCACHE_DIR }}
@@ -342,12 +342,12 @@ jobs:
         if: ${{ always() && !cancelled() }}
         shell: pwsh
         run: conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: ~/.conan2/p
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && steps.compiler-cache.outputs.cache-hit != 'true' }}
         with:
           path: ${{ env.CCACHE_DIR }}
diff --git a/.github/workflows/release-packages.yml b/.github/workflows/release-packages.yml
index 55609d0..a309327 100644
--- a/.github/workflows/release-packages.yml
+++ b/.github/workflows/release-packages.yml
@@ -42,7 +42,7 @@ concurrency:
 
 env:
   CHANNEL: "${{ inputs.channel || (github.ref_type == 'tag' && 'stable' || 'dev') }}"
-  CONAN_VERSION: "2.26.2"
+  CONAN_VERSION: "2.31.2"
   CONAN_REMOTE_NAME: "${{ vars.CONAN_REMOTE_NAME }}"
   CONAN_REMOTE_URL: "${{ vars.CONAN_REMOTE_URL }}"
   CONAN_REMOTE_USERNAME: "${{ vars.CONAN_REMOTE_USERNAME }}"
@@ -115,19 +115,19 @@ jobs:
       LINUX_BUILD_SHARED: "off"
       LINUX_ARCHS: ${{ matrix.target.os == 'linux' && matrix.target.arch || '' }}
       LINUX_TCLIBCS: musl
-      LLVM_MINGW_VERSION: "20251118"
+      LLVM_MINGW_VERSION: "20260616"
       OSS: ${{ matrix.target.os }}
       USE_DOCKER: "off"
       WINDOWS_BUILD_SHARED: "off"
       WINDOWS_ARCHS: ${{ matrix.target.os == 'windows' && matrix.target.arch || '' }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         if: ${{ matrix.target.arch == 'x86_64' || matrix.target.arch == 'arm64' }}
         with:
@@ -243,14 +243,14 @@ jobs:
       - name: Trim Conan cache
         if: ${{ always() && !cancelled() }}
         run: conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ always() && !cancelled() && (matrix.target.arch == 'x86_64' || matrix.target.arch == 'arm64') && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: |
             ~/.conan2/p
             ~/.cache/ccache
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cpp-release-candidate-${{ github.sha }}-${{ matrix.target.os }}-${{ matrix.target.arch }}
           path: candidate
@@ -272,13 +272,13 @@ jobs:
       OSS: macos
       USE_DOCKER: "off"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: conan-cache
         with:
           path: |
@@ -369,14 +369,14 @@ jobs:
       - name: Trim Conan cache
         if: ${{ success() }}
         run: conan cache clean "*" --source --build --download --temp
-      - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ success() && steps.conan-cache.outputs.cache-hit != 'true' }}
         with:
           path: |
             ~/.conan2/p
             ~/.cache/ccache
           key: ${{ steps.conan-cache.outputs.cache-primary-key }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cpp-release-candidate-${{ github.sha }}-macos
           path: candidate
@@ -462,14 +462,14 @@ jobs:
       WINDOWS_BUILD_SHARED: "off"
       WINDOWS_ARCHS: ${{ matrix.target.os == 'windows' && matrix.target.arch || '' }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cpp-release-candidate-${{ github.sha }}-${{ matrix.target.os }}-${{ matrix.target.arch }}
           path: candidate
@@ -521,14 +521,14 @@ jobs:
       OSS: macos
       USE_DOCKER: "off"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: cpp-release-candidate-${{ github.sha }}-macos
           path: candidate
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index b29aa23..484a366 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -10,6 +10,6 @@ jobs:
     if: ${{ github.actor == vars.CI_ALLOWED_ACTOR }}
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
diff --git a/.github/workflows/reliability.yml b/.github/workflows/reliability.yml
index 9313135..42eb337 100644
--- a/.github/workflows/reliability.yml
+++ b/.github/workflows/reliability.yml
@@ -26,7 +26,7 @@ jobs:
           - name: Thread sanitizer
             preset: tsan
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install native dependencies
@@ -43,7 +43,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install native dependencies
@@ -72,7 +72,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install native dependencies
diff --git a/build-docker-linuxbrew.sh b/build-docker-linuxbrew.sh
index 8373e98..4734af0 100755
--- a/build-docker-linuxbrew.sh
+++ b/build-docker-linuxbrew.sh
@@ -3,6 +3,7 @@ set -euo pipefail
 
 docker buildx build . \
   -f docker/Dockerfile.linuxbrew \
+  --platform linux/amd64 \
   -t "registry.rstream.io/rstream-cpp-linuxbrew:$(cat version.txt)-snapshot-$(date +%F)" \
   -t registry.rstream.io/rstream-cpp-linuxbrew:latest \
   --load \
diff --git a/conan/Dockerfile b/conan/Dockerfile
index b4cb6d9..0b37013 100644
--- a/conan/Dockerfile
+++ b/conan/Dockerfile
@@ -1,10 +1,10 @@
-FROM alpine:latest AS alpine
+FROM alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS alpine
 
 RUN apk update && apk add libstdc++
 
-FROM ubuntu:24.04
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 # Install build tools
 RUN apt-get update && apt-get -y install --no-install-recommends \
@@ -26,7 +26,7 @@ RUN apt-get update && apt-get -y install --no-install-recommends \
 
 RUN apt-get update && apt-get -y install --no-install-recommends nasm
 
-ARG LLVM_MINGW_VERSION=20251118
+ARG LLVM_MINGW_VERSION=20260616
 
 RUN set -eux; \
     host_arch="$(dpkg --print-architecture)"; \
@@ -49,7 +49,7 @@ COPY --from=alpine /usr/lib/libstdc++.so.6 /usr/lib/*-linux-musl/libstdc++.so.6
 COPY --from=alpine /usr/lib/libgcc_s.so.1 /usr/lib/*-linux-musl/libgcc_s.so.1
 
 # Install conan
-ARG CONAN_VERSION=2.26.2
+ARG CONAN_VERSION=2.31.2
 
 RUN PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade "conan==${CONAN_VERSION}" PyYAML
 
diff --git a/conan/compose.yaml b/conan/compose.yaml
index 35803c4..9c1fcd1 100644
--- a/conan/compose.yaml
+++ b/conan/compose.yaml
@@ -6,7 +6,7 @@ services:
       context: ./
       dockerfile: Dockerfile
       args:
-        CONAN_VERSION: ${CONAN_VERSION:-2.26.2}
+        CONAN_VERSION: ${CONAN_VERSION:-2.31.2}
         CONAN_REMOTE_NAME: ${CONAN_REMOTE_NAME:-rstream}
         CONAN_REMOTE_URL: ${CONAN_REMOTE_URL:-}
         CONAN_REMOTE_USERNAME: ${CONAN_REMOTE_USERNAME:-}
diff --git a/docker/Dockerfile.conan.android b/docker/Dockerfile.conan.android
index bdffc8e..556742b 100644
--- a/docker/Dockerfile.conan.android
+++ b/docker/Dockerfile.conan.android
@@ -1,12 +1,14 @@
-FROM ubuntu:24.04 AS build
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517 AS build
 
-ENV ANDROID_ARCH armv8
+ENV ANDROID_ARCH=armv8
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get -y install --no-install-recommends build-essential git cmake ninja-build tar gzip pkg-config jq
 
-RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade conan
+ARG CONAN_VERSION=2.31.2
+
+RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade "conan==${CONAN_VERSION}"
 
 RUN conan profile detect
 
diff --git a/docker/Dockerfile.conan.emscripten b/docker/Dockerfile.conan.emscripten
index 5392329..0fcde34 100644
--- a/docker/Dockerfile.conan.emscripten
+++ b/docker/Dockerfile.conan.emscripten
@@ -1,10 +1,12 @@
-FROM ubuntu:24.04 AS build
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517 AS build
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get -y install --no-install-recommends build-essential git cmake ninja-build tar gzip pkg-config jq
 
-RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade conan
+ARG CONAN_VERSION=2.31.2
+
+RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade "conan==${CONAN_VERSION}"
 
 RUN conan profile detect
 
diff --git a/docker/Dockerfile.conan.glibc b/docker/Dockerfile.conan.glibc
index 015fa8e..48f0d1f 100644
--- a/docker/Dockerfile.conan.glibc
+++ b/docker/Dockerfile.conan.glibc
@@ -1,4 +1,4 @@
-ARG BASE=ubuntu:24.04
+ARG BASE=ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 
 FROM $BASE AS build
 
@@ -6,7 +6,7 @@ ARG BUILD_TYPE="Release"
 
 ARG BUILD_LIBS_TYPE="shared"
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN mkdir -p /rstream/build
 
diff --git a/docker/Dockerfile.conan.mingw b/docker/Dockerfile.conan.mingw
index 483db66..af05d51 100644
--- a/docker/Dockerfile.conan.mingw
+++ b/docker/Dockerfile.conan.mingw
@@ -1,12 +1,14 @@
-FROM ubuntu:24.04 AS build
+FROM ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517 AS build
 
-ENV MINGW_ARCH x86_64
+ENV MINGW_ARCH=x86_64
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get -y install --no-install-recommends build-essential git cmake ninja-build tar gzip pkg-config jq
 
-RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade conan
+ARG CONAN_VERSION=2.31.2
+
+RUN apt-get update && apt-get -y install --no-install-recommends python3-dev python3-numpy python3-pip && PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --upgrade "conan==${CONAN_VERSION}"
 
 RUN apt-get update && apt-get -y install --no-install-recommends mingw-w64 nasm
 
diff --git a/docker/Dockerfile.conan.musl b/docker/Dockerfile.conan.musl
index 5a4a030..4592220 100644
--- a/docker/Dockerfile.conan.musl
+++ b/docker/Dockerfile.conan.musl
@@ -1,4 +1,4 @@
-ARG BASE=alpine:3.19
+ARG BASE=alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
 
 FROM $BASE AS build
 
diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian
index ecc46bd..def42d1 100644
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@@ -1,8 +1,8 @@
-ARG BASE=ubuntu:24.04
+ARG BASE=ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 
 FROM $BASE AS build
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get -y install --no-install-recommends devscripts
 
@@ -18,7 +18,7 @@ RUN debuild -b -uc -us
 
 FROM $BASE AS test_package
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN mkdir -p /rstream
 
@@ -38,7 +38,7 @@ RUN test_package
 
 FROM $BASE AS final
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN mkdir -p /rstream
 
diff --git a/docker/Dockerfile.linuxbrew b/docker/Dockerfile.linuxbrew
index c2970c3..2c1719f 100644
--- a/docker/Dockerfile.linuxbrew
+++ b/docker/Dockerfile.linuxbrew
@@ -1,8 +1,8 @@
-ARG BASE=ubuntu:24.04
+ARG BASE=ubuntu:24.04@sha256:33ceb71981b602c1a7443a53469e4dba065f7503eab3078a2d7a57a2ab987517
 
-FROM --platform=linux/amd64 $BASE AS build
+FROM $BASE AS build
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get -y install --no-install-recommends build-essential curl file git ruby-full locales sudo
 
diff --git a/requirements.txt b/requirements.txt
index b5063a2..2d5de6b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,3 @@
-asciichartpy
-click
-docopt
+asciichartpy==1.5.25
+click==8.4.2
+docopt==0.6.2