Pin dependencies

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
       # Label used to access the service container
       db:
         # Docker Hub image
-        image: postgres:12.22
+        image: postgres:12.22@sha256:2f2a8c2a7d10862e7fba2602e304523554f9df8244c632dafe2628ccb398fb5c
         # Set health checks to wait until postgres has started
         options: >-
           --health-cmd pg_isready
@@ -27,7 +27,7 @@ jobs:
           - 5432:5432
 
       redis:
-        image: redis:8.2.2
+        image: redis:8.2.2@sha256:4521b581dbddea6e7d81f8fe95ede93f5648aaa66a9dacd581611bf6fe7527bd
         ports:
           - 6379:6379
 

Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1
+# syntax=docker/dockerfile:1@sha256:87999aa3d42bdc6bea60565083ee17e86d1f3339802f543c0d03998580f9cb89
 # hadolint global ignore=SC2046,DL3002,DL3008,DL3025,DL3042,DL4006
 
 FROM mitodl/ol-python-base:3.12 AS base

Dockerfile.watch

@@ -1,4 +1,4 @@
-FROM node:24.13
+FROM node:24.13@sha256:00e9195ebd49985a6da8921f419978d85dfe354589755192dc090425ce4da2f7
 
 # Install Playwright system dependencies
 RUN apt-get update && apt-get install -y \

docker-compose.opensearch.base.yml

@@ -1,6 +1,6 @@
 services:
   opensearch:
-    image: opensearchproject/opensearch:3.3.0
+    image: opensearchproject/opensearch:3.3.0@sha256:d96afaf6cbd2a6a3695aeb2f1d48c9a16ad5c8918eb849e5cbf43475f0f8e146
     environment:
       - "cluster.name=opensearch-cluster"
       - "bootstrap.memory_lock=true" # along with the memlock settings below, disables swapping

docker-compose.services.yml

@@ -31,7 +31,7 @@ services:
   redis:
     profiles:
       - backend
-    image: redis:8.2.2
+    image: redis:8.2.2@sha256:4521b581dbddea6e7d81f8fe95ede93f5648aaa66a9dacd581611bf6fe7527bd
     healthcheck:
       test: ["CMD", "redis-cli", "ping", "|", "grep", "PONG"]
       interval: 3s
@@ -40,7 +40,7 @@ services:
     ports:
       - "6379"
   qdrant:
-    image: qdrant/qdrant:latest
+    image: qdrant/qdrant:latest@sha256:057ee3a8da769fe7310dd3537b4dc7583bf87a95ce8ac43c0af5a46bc580d1fc
     ports:
       - "6333:6333"
     volumes:
@@ -68,12 +68,12 @@ services:
   tika:
     profiles:
       - backend
-    image: apache/tika:2.5.0
+    image: apache/tika:2.5.0@sha256:d680d1d7136f35de43294e7b80ac495da463f069b0f1d59be1ebac5f0543f075
     ports:
       - "9998:9998"
 
   locust:
-    image: locustio/locust
+    image: locustio/locust@sha256:0d7e43081c5f9437aed6513dc5827ec6984f024d00141a201a5b6be6e9a63e5d
     ports:
       - "8089:8089"
     volumes:
@@ -85,7 +85,7 @@ services:
       - load-testing
 
   locust-worker:
-    image: locustio/locust
+    image: locustio/locust@sha256:0d7e43081c5f9437aed6513dc5827ec6984f024d00141a201a5b6be6e9a63e5d
     volumes:
       - ./load_testing_locust:/mnt/locust
     command: -f /mnt/locust/locustfile.py --worker --master-host locust
@@ -123,7 +123,7 @@ services:
   apigateway:
     profiles:
       - apisix
-    image: apache/apisix:3.13.0-debian # versions above this drop the local port on redirects
+    image: apache/apisix:3.13.0-debian@sha256:c5c7a55ebb5c07abc210dbb963a37f41030e12c91d23bacedbaa168fec633bd7 # versions above this drop the local port on redirects
     <<: *default-extra-hosts
     environment:
       - CSRF_COOKIE_DOMAIN=${CSRF_COOKIE_DOMAIN:-.odl.local}

frontends/api/package.json

@@ -25,12 +25,12 @@
     "react": "^19.2.1"
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@testing-library/react": "^16.3.0",
-    "enforce-unique": "^1.3.0",
-    "jest": "^29.7.0",
-    "jest-when": "^3.7.0",
-    "lodash": "^4.17.21",
+    "@faker-js/faker": "10.5.0",
+    "@testing-library/react": "16.3.2",
+    "enforce-unique": "1.3.0",
+    "jest": "29.7.0",
+    "jest-when": "3.7.0",
+    "lodash": "4.18.1",
     "ol-test-utilities": "0.0.0"
   },
   "dependencies": {

frontends/main/package.json

@@ -78,28 +78,28 @@
     "yup": "^1.4.0"
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@happy-dom/jest-environment": "^20.1.0",
-    "@testing-library/jest-dom": "^6.4.8",
-    "@testing-library/react": "^16.3.0",
-    "@testing-library/user-event": "^14.5.2",
-    "@types/jest": "^29.5.12",
-    "@types/lodash": "^4.17.7",
-    "@types/node": "^24.0.0",
-    "@types/papaparse": "^5.5.2",
+    "@faker-js/faker": "10.5.0",
+    "@happy-dom/jest-environment": "20.11.2",
+    "@testing-library/jest-dom": "6.9.1",
+    "@testing-library/react": "16.3.2",
+    "@testing-library/user-event": "14.6.3",
+    "@types/jest": "29.5.14",
+    "@types/lodash": "4.17.25",
+    "@types/node": "24.13.3",
+    "@types/papaparse": "5.5.2",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
-    "@types/react-slick": "^0.23.13",
-    "@types/slick-carousel": "^1",
+    "@types/react-slick": "0.23.13",
+    "@types/slick-carousel": "1.6.40",
     "eslint": "8.57.1",
-    "eslint-config-next": "^16.1.6",
-    "http-proxy-middleware": "^3.0.0",
-    "jest": "^29.7.0",
-    "jest-extended": "^7.0.0",
-    "jest-next-dynamic-ts": "^0.1.1",
-    "next-router-mock": "^1.0.2",
+    "eslint-config-next": "16.3.0",
+    "http-proxy-middleware": "3.0.7",
+    "jest": "29.7.0",
+    "jest-extended": "7.0.0",
+    "jest-next-dynamic-ts": "0.1.1",
+    "next-router-mock": "1.0.5",
     "ol-test-utilities": "0.0.0",
-    "ts-jest": "^29.2.4",
-    "typescript": "^5.5.4"
+    "ts-jest": "29.4.12",
+    "typescript": "5.9.3"
   }
 }

frontends/ol-components/package.json

@@ -45,26 +45,26 @@
     "wheel-indicator": "^1.3.0"
   },
   "devDependencies": {
-    "@chromatic-com/storybook": "^5.0.0",
-    "@faker-js/faker": "^10.0.0",
-    "@storybook/addon-docs": "^10.0.0",
-    "@storybook/addon-links": "^10.0.0",
-    "@storybook/addon-onboarding": "^10.0.0",
-    "@storybook/addon-webpack5-compiler-swc": "^4.0.0",
-    "@storybook/nextjs": "^10.2.4",
+    "@chromatic-com/storybook": "5.3.0",
+    "@faker-js/faker": "10.5.0",
+    "@storybook/addon-docs": "10.5.7",
+    "@storybook/addon-links": "10.5.7",
+    "@storybook/addon-onboarding": "10.5.7",
+    "@storybook/addon-webpack5-compiler-swc": "4.0.3",
+    "@storybook/nextjs": "10.5.7",
     "@storybook/test": "8.6.15",
-    "@testing-library/react": "^16.3.0",
-    "@testing-library/user-event": "^14.5.2",
-    "@types/lodash.throttle": "^4.1.9",
-    "@types/react-google-recaptcha": "^2.1.9",
-    "@types/react-slick": "^0.23.13",
-    "dotenv": "^17.0.0",
-    "lodash": "^4.17.21",
-    "prop-types": "^15.8.1",
-    "sass": "^1.93.3",
-    "sass-embedded": "^1.93.3",
-    "storybook": "^10.2.4",
-    "typescript": "^5.5.4"
+    "@testing-library/react": "16.3.2",
+    "@testing-library/user-event": "14.6.3",
+    "@types/lodash.throttle": "4.1.9",
+    "@types/react-google-recaptcha": "2.1.9",
+    "@types/react-slick": "0.23.13",
+    "dotenv": "17.4.2",
+    "lodash": "4.18.1",
+    "prop-types": "15.8.1",
+    "sass": "1.102.0",
+    "sass-embedded": "1.100.0",
+    "storybook": "10.5.7",
+    "typescript": "5.9.3"
   },
   "peerDependencies": {
     "@mitodl/smoot-design": "6.31.1",

frontends/ol-test-utilities/package.json

@@ -20,7 +20,7 @@
     "react": "^19.2.1"
   },
   "devDependencies": {
-    "@types/lodash": "^4.17.7",
+    "@types/lodash": "4.17.25",
     "@types/react": "^19.2.7"
   }
 }

frontends/ol-utilities/package.json

@@ -19,10 +19,10 @@
     "qs": "^6.11.0"
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@testing-library/react": "^16.3.0",
-    "@testing-library/user-event": "^14.5.2",
+    "@faker-js/faker": "10.5.0",
+    "@testing-library/react": "16.3.2",
+    "@testing-library/user-event": "14.6.3",
     "ol-test-utilities": "0.0.0",
-    "tiny-invariant": "^1.3.3"
+    "tiny-invariant": "1.3.3"
   }
 }

frontends/package.json

@@ -35,44 +35,44 @@
   },
   "version": "0.0.0",
   "devDependencies": {
-    "@faker-js/faker": "^10.0.0",
-    "@next/eslint-plugin-next": "^16.2.7",
-    "@swc/core": "^1.11.29",
-    "@swc/jest": "^0.2.38",
-    "@testing-library/jest-dom": "^6.4.8",
-    "@testing-library/react": "^16.3.0",
-    "@testing-library/user-event": "^14.5.2",
-    "@types/jest": "^29.5.12",
-    "@types/jest-when": "^3.5.2",
-    "@types/react-google-recaptcha": "^2.1.9",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "@typescript-eslint/typescript-estree": "^8.0.0",
-    "cross-fetch": "^4.0.0",
+    "@faker-js/faker": "10.1.0",
+    "@next/eslint-plugin-next": "16.2.7",
+    "@swc/core": "1.12.6",
+    "@swc/jest": "0.2.38",
+    "@testing-library/jest-dom": "6.5.0",
+    "@testing-library/react": "16.3.0",
+    "@testing-library/user-event": "14.5.2",
+    "@types/jest": "29.5.13",
+    "@types/jest-when": "3.5.5",
+    "@types/react-google-recaptcha": "2.1.9",
+    "@typescript-eslint/eslint-plugin": "8.12.2",
+    "@typescript-eslint/typescript-estree": "8.38.0",
+    "cross-fetch": "4.0.0",
     "eslint": "8.57.1",
-    "eslint-config-mitodl": "^2.1.0",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-import-resolver-typescript": "^4.0.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jest": "^29.0.0",
-    "eslint-plugin-mdx": "^3.0.0",
-    "eslint-plugin-react": "^7.34.3",
-    "eslint-plugin-react-hooks": "^5.0.0",
-    "eslint-plugin-styled-components-a11y": "^2.1.35",
-    "eslint-plugin-testing-library": "^7.0.0",
-    "jest": "^29.7.0",
-    "jest-environment-jsdom": "^29.5.0",
-    "jest-extended": "^7.0.0",
-    "jest-fail-on-console": "^3.3.1",
-    "jest-watch-typeahead": "^3.0.1",
-    "jest-when": "^3.7.0",
-    "postcss-styled-syntax": "^0.7.0",
-    "prettier": "^3.3.3",
-    "prettier-plugin-django-alpine": "^1.2.6",
-    "stylelint": "^16.18.0",
-    "stylelint-config-standard-scss": "^15.0.0",
+    "eslint-config-mitodl": "2.1.0",
+    "eslint-config-prettier": "10.0.1",
+    "eslint-import-resolver-typescript": "4.3.4",
+    "eslint-plugin-import": "2.31.0",
+    "eslint-plugin-jest": "29.0.1",
+    "eslint-plugin-mdx": "3.1.5",
+    "eslint-plugin-react": "7.37.1",
+    "eslint-plugin-react-hooks": "5.1.0",
+    "eslint-plugin-styled-components-a11y": "2.1.35",
+    "eslint-plugin-testing-library": "7.1.1",
+    "jest": "29.7.0",
+    "jest-environment-jsdom": "29.7.0",
+    "jest-extended": "7.0.0",
+    "jest-fail-on-console": "3.3.1",
+    "jest-watch-typeahead": "3.0.1",
+    "jest-when": "3.7.0",
+    "postcss-styled-syntax": "0.7.0",
+    "prettier": "3.3.3",
+    "prettier-plugin-django-alpine": "1.3.0",
+    "stylelint": "16.22.0",
+    "stylelint-config-standard-scss": "15.0.1",
     "syncpack": "14.0.0-alpha.40",
-    "ts-node": "^10.9.2",
-    "typescript": "^5.5.4"
+    "ts-node": "10.9.2",
+    "typescript": "5.6.3"
   },
   "dependencies": {
     "@jest/environment": "^29.7.0",

load_testing/package.json

@@ -6,8 +6,8 @@
   "author": "",
   "license": "ISC",
   "devDependencies": {
-    "@grafana/openapi-to-k6": "^0.4.1",
-    "@types/k6": "^1.7.0"
+    "@grafana/openapi-to-k6": "0.4.1",
+    "@types/k6": "1.7.0"
   },
   "overrides": {
     "@asyncapi/specs": "6.11.1"

package.json

@@ -34,8 +34,8 @@
     "video.js": "^8.23.7"
   },
   "devDependencies": {
-    "@playwright/test": "^1.58.1",
+    "@playwright/test": "1.58.1",
     "frontends": "workspace:^",
-    "type-fest": "^5.4.3"
+    "type-fest": "5.4.3"
   }
 }