- Update all non-major dependencies with digest and pinDigest

Author: blumilk-renovate[bot]

.github/workflows/check-php.yml

@@ -33,20 +33,20 @@ jobs:
           - 5432:5432
 
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 # https://github.com/actions/checkout
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # https://github.com/actions/checkout
 
       - name: Validate composer.json and composer.lock
         run: composer validate
 
       - name: Cache dependencies
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 # https://github.com/actions/cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 # https://github.com/actions/cache
         with:
           path: vendor
           key: ${{ runner.os }}-composer-dependencies-${{ hashFiles('composer.lock') }}
           restore-keys: ${{ runner.os }}-composer-dependencies
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 # 2.31.1 # https://github.com/shivammathur/setup-php
+        uses: shivammathur/setup-php@cf4cade2721270509d5b1c766ab3549210a39a2a # 2.33.0 # https://github.com/shivammathur/setup-php
         with:
           php-version: 8.3
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_pgsql, intl

.github/workflows/deploy-to-dev.yml

@@ -24,7 +24,7 @@ jobs:
         run: echo "BRANCH_NAME=$GITHUB_REF_NAME" >> $GITHUB_ENV
 
       - name: checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           ref: ${{ env.BRANCH_NAME }}
@@ -42,7 +42,7 @@ jobs:
         run: echo "DOCKER_IMAGE_NAME=${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REGISTRY_PROJECT_NAME }}/${{ env.DOCKER_REGISTRY_REPO_NAME }}" >> $GITHUB_ENV
 
       - name: fetch server secrets
-        uses: Infisical/secrets-action@v1.0.8
+        uses: Infisical/secrets-action@08d433afae6a851f9081d0563a01a55fdf96568b # v1.0.11
         with:
           domain: https://infisical.blumilk.pl
           client-id: ${{ secrets.INFISICAL_MACHINE_IDENTITY_GHA_BOT_CLIENT_ID }}
@@ -55,10 +55,10 @@ jobs:
           include-imports: true
 
       - name: set up Docker Buildx
-        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: login to Docker Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ${{ env.DOCKER_REGISTRY }}
           username: ${{ env.DOCKER_REGISTRY_USER_NAME }}
@@ -70,7 +70,7 @@ jobs:
 
       - name: Docker meta for app database
         id: meta-app-database
-        uses: docker/metadata-action@v5.5.1
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
           images: |
             ${{ env.DOCKER_APP_DATABASE_IMAGE_NAME }}
@@ -79,7 +79,7 @@ jobs:
           context: workflow
 
       - name: build and push app database image
-        uses: docker/build-push-action@v5.1.0
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: .
           file: ./environment/.docker/postgres/Dockerfile
@@ -91,7 +91,7 @@ jobs:
 
       - name: Docker meta for app
         id: meta
-        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
           images: ${{ env.DOCKER_IMAGE_NAME }}
           tags: |
@@ -132,7 +132,7 @@ jobs:
 
 
       - name: fetch project deployment secrets
-        uses: Infisical/secrets-action@v1.0.8
+        uses: Infisical/secrets-action@08d433afae6a851f9081d0563a01a55fdf96568b # v1.0.11
         with:
           domain: https://infisical.blumilk.pl
           client-id: ${{ secrets.INFISICAL_MACHINE_IDENTITY_GHA_BOT_CLIENT_ID }}
@@ -145,7 +145,7 @@ jobs:
           include-imports: false
 
       - name: run deployment script over ssh
-        uses: appleboy/ssh-action@v1.2.2
+        uses: appleboy/ssh-action@2ead5e36573f08b82fbfce1504f1a4b05a647c6f # v1.2.2
         with:
           timeout: 10s
           command_timeout: 10m

composer.json

@@ -5,20 +5,20 @@
     "license": "MIT",
     "require": {
         "php": "^8.3",
-        "filament/filament": "^3.2",
-        "filament/spatie-laravel-media-library-plugin": "^3.2",
+        "filament/filament": "^3.3.14",
+        "filament/spatie-laravel-media-library-plugin": "^3.3.15",
         "laravel/framework": "^11.31",
-        "laravel/tinker": "^2.9",
-        "livewire/livewire": "^3.5",
-        "spatie/eloquent-sortable": "^4.4"
+        "laravel/tinker": "^2.10.1",
+        "livewire/livewire": "^3.6.3",
+        "spatie/eloquent-sortable": "^4.4.2"
     },
     "require-dev": {
-        "blumilksoftware/codestyle": "^4.0",
-        "fakerphp/faker": "^1.23",
-        "laravel/telescope": "^5.4",
-        "mockery/mockery": "^1.6",
-        "nunomaduro/collision": "^8.1",
-        "phpunit/phpunit": "^11.0.1"
+        "blumilksoftware/codestyle": "^4.1.0",
+        "fakerphp/faker": "^1.24.1",
+        "laravel/telescope": "^5.7.0",
+        "mockery/mockery": "^1.6.12",
+        "nunomaduro/collision": "^8.8.0",
+        "phpunit/phpunit": "^11.5.20"
     },
     "autoload": {
         "psr-4": {

docker-compose.yml

@@ -75,7 +75,7 @@ services:
     restart: unless-stopped
 
   mailpit:
-    image: axllent/mailpit:v1.22.0@sha256:1ebd4123a99eb6b74799d13d4811f9fc5c3b70df26e1ae536af82987022fcb48
+    image: axllent/mailpit:v1.24.2@sha256:3ad9483ac2dea937ae402b95435ab12c3355d2373a1002a49491db0be536d8fa
     container_name: lmt-mailpit-local
     ports:
       - ${EXTERNAL_MAILPIT_DASHBOARD_PORT:-8052}:8025

environment/.deployment/dev/docker-compose.dev.yml

@@ -43,7 +43,7 @@ services:
       - .deployment
 
   lmt-dev-database:
-    image: registry.blumilk.pl/internal-public/lmt-postgres:dev
+    image: registry.blumilk.pl/internal-public/lmt-postgres:dev@sha256:8e86448ead086651d28c0ed8c75ecb2e7f163718290aa910c1f757848563339f
     pull_policy: always
     container_name: lmt-dev-database-container
     deploy:

environment/.docker/app/Dockerfile

@@ -1,8 +1,8 @@
-FROM registry.blumilk.pl/internal-public/secops-tools-bin:v1.0.0 AS secops-tools-bin
-FROM composer:2.8.6 AS composer
-FROM node:23.7.0-bookworm-slim AS node
+FROM registry.blumilk.pl/internal-public/secops-tools-bin:v1.0.0@sha256:8f2508eb12466da04fdb55b9b24aaf9220a5b1548c12483b8fa31ec24f0ea8da AS secops-tools-bin
+FROM composer:2.8.9@sha256:623d15a4aae78c868a35c3942add4bb9b2f98e4a3ec26e1928c84df14695d4b0 AS composer
+FROM node:23.11.1-bookworm-slim@sha256:148ba5855f7d4db32d877b887be561672fc50113940de812ff69e52dd35c31e6 AS node
 
-FROM php:8.3.10-fpm-bookworm AS base
+FROM php:8.4.7-fpm-bookworm@sha256:0bc125c2ab002cfbabe0954b99c5e63cf0f8e8d39a77f87ff7459b86d0845297 AS base
 
 COPY --from=composer /usr/bin/composer /usr/bin/composer
 
@@ -69,7 +69,7 @@ RUN ln --symbolic /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/
     && chown --no-dereference ${USER_NAME}:root /usr/local/bin/npx
 
 # renovate: datasource=github-tags depName=xdebug/xdebug
-ARG XDEBUG_VERSION=3.4.2
+ARG XDEBUG_VERSION=3.4.3
 ARG INSTALL_XDEBUG=false
 
 RUN if [ ${INSTALL_XDEBUG} = true ]; then \

environment/.docker/postgres/Dockerfile

@@ -1,4 +1,4 @@
-FROM postgres:17.2
+FROM postgres:17.5@sha256:864831322bf2520e7d03d899b01b542de6de9ece6fe29c89f19dc5e1d5568ccf
 
 RUN localedef -i pl_PL -c -f UTF-8 -A /usr/share/locale/locale.alias pl_PL.UTF-8
 ENV LANG=pl_PL.UTF-8