Merge pull request #130 from manics/dependabot-pin-dockerfile

Pin dockerfile SHA, bump monthly with dependabot
jupyterhub · Sep 15, 2024 · 0fd70e6 · 0fd70e6
2 parents cf07279 + b3a37bb
commit 0fd70e6
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
@@ -15,3 +15,10 @@ updates:
       interval: monthly
       time: "05:00"
       timezone: Etc/UTC
+
+  # Bump dockerfile FROM
+  - package-ecosystem: docker
+    directory: /
+    labels: [dependencies]
+    schedule:
+      interval: monthly
diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/jupyter/base-notebook:latest
+FROM quay.io/jupyter/base-notebook@sha256:876e3c3e40c4f0a25d3a16223a158a2d582b1ad77ac94269d43a5f6256eb4eec
 
 USER root