Merge pull request #660 from rajbos/rajbos/fix-pinned-dependencies

fix: pin Docker base image to SHA256 digest

Author: rajbos

sharing-server/Dockerfile

@@ -2,7 +2,7 @@
 
 # ── Build stage ──────────────────────────────────────────────────────────────
 # Uses node:sqlite (built-in, no native compilation needed)
-FROM node:24-slim AS builder
+FROM node:24-slim@sha256:03eae3ef7e88a9de535496fb488d67e02b9d96a063a8967bae657744ecd513f2 AS builder
 
 WORKDIR /app
 
@@ -13,7 +13,7 @@ COPY . .
 RUN npm run build:production
 
 # ── Runtime stage ─────────────────────────────────────────────────────────────
-FROM node:24-slim AS runtime
+FROM node:24-slim@sha256:03eae3ef7e88a9de535496fb488d67e02b9d96a063a8967bae657744ecd513f2 AS runtime
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     tini \