From b3a37bb5557dc9184c033cd357ed808051277720 Mon Sep 17 00:00:00 2001
From: Simon Li <orpheus+devel@gmail.com>
Date: Sat, 14 Sep 2024 23:30:11 +0100
Subject: [PATCH] Pin dockerfile SHA, bump monthly with dependabot

---
 .github/dependabot.yaml | 7 +++++++
 Dockerfile              | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index e66d43e0..33427321 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -15,3 +15,10 @@ updates:
       interval: monthly
       time: "05:00"
       timezone: Etc/UTC
+
+  # Bump dockerfile FROM
+  - package-ecosystem: docker
+    directory: /
+    labels: [dependencies]
+    schedule:
+      interval: monthly
diff --git a/Dockerfile b/Dockerfile
index a000c3a9..fd6746d5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/jupyter/base-notebook:latest
+FROM quay.io/jupyter/base-notebook@sha256:876e3c3e40c4f0a25d3a16223a158a2d582b1ad77ac94269d43a5f6256eb4eec
 
 USER root