From a8b95aea57526213f14ee9a54899e15798646907 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 17 Oct 2026 04:04:40 +0000 Subject: [PATCH] chore(deps): pin non-major docker dependencies --- docker/Dockerfile | 2 +- docker/soundstage.Dockerfile | 2 +- docker/tps-office.Dockerfile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 3a72a33c..bd3e189d 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -20,7 +20,7 @@ RUN set -eux; \ # in the SAME logical line as the pinned checkout+build — a later RUN cannot swap # the binary and recompute the baseline. -FROM node:24-bookworm-slim AS base +FROM node:24.22.0-bookworm-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5 AS base ARG TPS_VERSION=0.5.4 # The shipped path installs the PUBLISHED @tpsdev-ai/agent version supplied by # docker.yml's workflow dispatch input as TPS_VERSION. The workflow checks that diff --git a/docker/soundstage.Dockerfile b/docker/soundstage.Dockerfile index fdff5a63..0bf9dd6d 100644 --- a/docker/soundstage.Dockerfile +++ b/docker/soundstage.Dockerfile @@ -4,7 +4,7 @@ # Includes: Node 22, OpenClaw CLI, bash, git # No outbound network needed at runtime. -FROM node:22-alpine +FROM node:22.23.3-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402 # Install system deps needed by openclaw (koffi needs cmake + build tools) RUN apk add --no-cache git bash cmake make g++ python3 linux-headers && \ diff --git a/docker/tps-office.Dockerfile b/docker/tps-office.Dockerfile index ee97a465..d0a3b129 100644 --- a/docker/tps-office.Dockerfile +++ b/docker/tps-office.Dockerfile @@ -1,5 +1,5 @@ # CP32 Branch Office image -FROM node:24-bookworm-slim AS base +FROM node:24.22.0-bookworm-slim@sha256:a5f4366e834695d5f363b920c104953a535d3a9864d1bdf74566a0ebe01daee5 AS base # Security: no root package installs after this layer # Harden: disable npm update notifier, reduce attack surface