Pin dockerfile SHA, bump monthly with dependabot

jupyterhub · Sep 14, 2024 · b3a37bb · b3a37bb
1 parent 30e67eb
commit b3a37bb
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
@@ -15,3 +15,10 @@ updates:
       interval: monthly
       time: "05:00"
       timezone: Etc/UTC
+
+  # Bump dockerfile FROM
+  - package-ecosystem: docker
+    directory: /
+    labels: [dependencies]
+    schedule:
+      interval: monthly
diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/jupyter/base-notebook:latest
+FROM quay.io/jupyter/base-notebook@sha256:876e3c3e40c4f0a25d3a16223a158a2d582b1ad77ac94269d43a5f6256eb4eec
 
 USER root