From cedf55b955ef6b3ac786246f5df5790b794451ad Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Wed, 26 Aug 2026 22:21:25 +0200
Subject: [PATCH] supply-chain: pin frontend base images and lock npm install

---
 frontend/Dockerfile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 237e7597..6e4d833a 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -1,14 +1,14 @@
-FROM node:20-alpine AS build
+FROM node:20.20.2-alpine3.23@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS build
 
 WORKDIR /app
 
-COPY package.json package-lock.json* ./
-RUN npm install
+COPY package.json package-lock.json ./
+RUN npm ci
 
 COPY . .
 RUN npm run build
 
-FROM nginx:1.27-alpine AS runtime
+FROM nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS runtime
 
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist /usr/share/nginx/html