From 202c8659a295ccc6bdb87f531b3129580383517d Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 20:23:27 +0000
Subject: [PATCH] Pin dependencies

---
 .github/workflows/build.yml | 2 +-
 docker-compose.yml          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 77f78a6..bcecda7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,7 +56,7 @@ jobs:
       packages: write
     steps:
       - name: Delete old container image versions (keep last 4)
-        uses: actions/delete-package-versions@v5
+        uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5
         with:
           package-name: ${{ github.event.repository.name }}
           package-type: container
diff --git a/docker-compose.yml b/docker-compose.yml
index 3f0028c..1a21218 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   mvg-departures:
-    image: ghcr.io/skoelle/mvg-departures:latest
+    image: ghcr.io/skoelle/mvg-departures:latest@sha256:c93ca797aa5dea84611a44d9463dd557816b664d30cdc7e956335f3e7628dcb0
     container_name: mvg-departures
     ports:
       - "8000:8000"