Draft

.github/workflows/build.yaml

@@ -14,10 +14,10 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 2
-      - uses: astral-sh/setup-uv@v6
+      - uses: astral-sh/setup-uv@b75a909f75acd358c2196fb9a5f1299a9a8868a4 # v6
         with:
           enable-cache: true
       - name: Generate build matrix
@@ -34,23 +34,23 @@ jobs:
     strategy:
       matrix: ${{ fromJSON(needs.generate-matrix.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: astral-sh/setup-uv@b75a909f75acd358c2196fb9a5f1299a9a8868a4 # v6
         with:
           enable-cache: true
       - name: Generate Dockerfile from config
         run: uv run dpn dockerfile --context '${{ toJSON(matrix) }}'
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
         with:
           context: .
           file: dockerfiles/${{ matrix.key }}.Dockerfile
@@ -60,7 +60,7 @@ jobs:
         run: |
           docker run --rm nikolaik/python-nodejs:${{ matrix.key }} sh -c "node --version && npm --version && yarn --version && python --version && pip --version && pipenv --version && poetry --version && uv --version"
       - name: Push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
         with:
           context: .
           file: dockerfiles/${{ matrix.key }}.Dockerfile
@@ -73,8 +73,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: [deploy]
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: astral-sh/setup-uv@b75a909f75acd358c2196fb9a5f1299a9a8868a4 # v6
         with:
           enable-cache: true
       - name: Update versions.json and README.md, then commit and push changes (if any)

.github/workflows/tests.yaml

@@ -8,13 +8,13 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: astral-sh/setup-uv@b75a909f75acd358c2196fb9a5f1299a9a8868a4 # v6.7.0
         with:
           enable-cache: true
       - run: uv run ./bin/lint
       - run: uv run ./bin/test
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.python-version

@@ -1 +1 @@
-3.13.6
+3.13.7

README.md

@@ -3,7 +3,7 @@
 [![Pulls](https://img.shields.io/docker/pulls/nikolaik/python-nodejs.svg?style=flat-square)](https://hub.docker.com/r/nikolaik/python-nodejs/)
 [![CircleCI](https://img.shields.io/circleci/project/github/nikolaik/docker-python-nodejs.svg?style=flat-square)](https://circleci.com/gh/nikolaik/docker-python-nodejs)
 
-Last updated by bot: 2025-08-08
+Last updated by bot: 2025-09-11
 
 The `latest` tag is currently:
 
@@ -24,66 +24,66 @@ To use a specific combination of Python and Node.js see the following table of a
 
 Tag | Python version | Node.js version | Distro
 --- | --- | --- | ---
-`python3.13-nodejs24` | 3.13.6 | 24.5.0 | bookworm
-`python3.13-nodejs24-bullseye` | 3.13.6 | 24.5.0 | bullseye
-`python3.13-nodejs24-slim` | 3.13.6 | 24.5.0 | slim
-`python3.13-nodejs24-alpine` | 3.13.6 | 24.5.0 | alpine
-`python3.13-nodejs22` | 3.13.6 | 22.18.0 | bookworm
-`python3.13-nodejs22-bullseye` | 3.13.6 | 22.18.0 | bullseye
-`python3.13-nodejs22-slim` | 3.13.6 | 22.18.0 | slim
-`python3.13-nodejs22-alpine` | 3.13.6 | 22.18.0 | alpine
-`python3.13-nodejs20` | 3.13.6 | 20.19.4 | bookworm
-`python3.13-nodejs20-bullseye` | 3.13.6 | 20.19.4 | bullseye
-`python3.13-nodejs20-slim` | 3.13.6 | 20.19.4 | slim
-`python3.13-nodejs20-alpine` | 3.13.6 | 20.19.4 | alpine
-`python3.12-nodejs24` | 3.12.11 | 24.5.0 | bookworm
-`python3.12-nodejs24-bullseye` | 3.12.11 | 24.5.0 | bullseye
-`python3.12-nodejs24-slim` | 3.12.11 | 24.5.0 | slim
-`python3.12-nodejs24-alpine` | 3.12.11 | 24.5.0 | alpine
-`python3.12-nodejs22` | 3.12.11 | 22.18.0 | bookworm
-`python3.12-nodejs22-bullseye` | 3.12.11 | 22.18.0 | bullseye
-`python3.12-nodejs22-slim` | 3.12.11 | 22.18.0 | slim
-`python3.12-nodejs22-alpine` | 3.12.11 | 22.18.0 | alpine
-`python3.12-nodejs20` | 3.12.11 | 20.19.4 | bookworm
-`python3.12-nodejs20-bullseye` | 3.12.11 | 20.19.4 | bullseye
-`python3.12-nodejs20-slim` | 3.12.11 | 20.19.4 | slim
-`python3.12-nodejs20-alpine` | 3.12.11 | 20.19.4 | alpine
-`python3.11-nodejs24` | 3.11.13 | 24.5.0 | bookworm
-`python3.11-nodejs24-bullseye` | 3.11.13 | 24.5.0 | bullseye
-`python3.11-nodejs24-slim` | 3.11.13 | 24.5.0 | slim
-`python3.11-nodejs24-alpine` | 3.11.13 | 24.5.0 | alpine
-`python3.11-nodejs22` | 3.11.13 | 22.18.0 | bookworm
-`python3.11-nodejs22-bullseye` | 3.11.13 | 22.18.0 | bullseye
-`python3.11-nodejs22-slim` | 3.11.13 | 22.18.0 | slim
-`python3.11-nodejs22-alpine` | 3.11.13 | 22.18.0 | alpine
-`python3.11-nodejs20` | 3.11.13 | 20.19.4 | bookworm
-`python3.11-nodejs20-bullseye` | 3.11.13 | 20.19.4 | bullseye
-`python3.11-nodejs20-slim` | 3.11.13 | 20.19.4 | slim
-`python3.11-nodejs20-alpine` | 3.11.13 | 20.19.4 | alpine
-`python3.10-nodejs24` | 3.10.18 | 24.5.0 | bookworm
-`python3.10-nodejs24-bullseye` | 3.10.18 | 24.5.0 | bullseye
-`python3.10-nodejs24-slim` | 3.10.18 | 24.5.0 | slim
-`python3.10-nodejs24-alpine` | 3.10.18 | 24.5.0 | alpine
-`python3.10-nodejs22` | 3.10.18 | 22.18.0 | bookworm
-`python3.10-nodejs22-bullseye` | 3.10.18 | 22.18.0 | bullseye
-`python3.10-nodejs22-slim` | 3.10.18 | 22.18.0 | slim
-`python3.10-nodejs22-alpine` | 3.10.18 | 22.18.0 | alpine
-`python3.10-nodejs20` | 3.10.18 | 20.19.4 | bookworm
-`python3.10-nodejs20-bullseye` | 3.10.18 | 20.19.4 | bullseye
-`python3.10-nodejs20-slim` | 3.10.18 | 20.19.4 | slim
-`python3.10-nodejs20-alpine` | 3.10.18 | 20.19.4 | alpine
-`python3.9-nodejs24` | 3.9.23 | 24.5.0 | bookworm
-`python3.9-nodejs24-bullseye` | 3.9.23 | 24.5.0 | bullseye
-`python3.9-nodejs24-slim` | 3.9.23 | 24.5.0 | slim
-`python3.9-nodejs24-alpine` | 3.9.23 | 24.5.0 | alpine
-`python3.9-nodejs22` | 3.9.23 | 22.18.0 | bookworm
-`python3.9-nodejs22-bullseye` | 3.9.23 | 22.18.0 | bullseye
-`python3.9-nodejs22-slim` | 3.9.23 | 22.18.0 | slim
-`python3.9-nodejs22-alpine` | 3.9.23 | 22.18.0 | alpine
-`python3.9-nodejs20` | 3.9.23 | 20.19.4 | bookworm
-`python3.9-nodejs20-bullseye` | 3.9.23 | 20.19.4 | bullseye
-`python3.9-nodejs20-slim` | 3.9.23 | 20.19.4 | slim
-`python3.9-nodejs20-alpine` | 3.9.23 | 20.19.4 | alpine
+`python3.13-nodejs24` | 3.13.7 | 24.8.0 | bookworm
+`python3.13-nodejs24-slim` | 3.13.7 | 24.8.0 | slim
+`python3.13-nodejs24-alpine` | 3.13.7 | 24.8.0 | alpine
+`python3.13-nodejs22` | 3.13.7 | 22.19.0 | bookworm
+`python3.13-nodejs22-slim` | 3.13.7 | 22.19.0 | slim
+`python3.13-nodejs22-alpine` | 3.13.7 | 22.19.0 | alpine
+`python3.13-nodejs20` | 3.13.7 | 20.19.5 | bookworm
+`python3.13-nodejs20-slim` | 3.13.7 | 20.19.5 | slim
+`python3.13-nodejs20-alpine` | 3.13.7 | 20.19.5 | alpine
+`python3.13-nodejs24-bullseye` | 3.13.6 | 24.8.0 | bullseye
+`python3.13-nodejs22-bullseye` | 3.13.6 | 22.19.0 | bullseye
+`python3.13-nodejs20-bullseye` | 3.13.6 | 20.19.5 | bullseye
+`python3.12-nodejs24` | 3.12.11 | 24.8.0 | bookworm
+`python3.12-nodejs24-bullseye` | 3.12.11 | 24.8.0 | bullseye
+`python3.12-nodejs24-slim` | 3.12.11 | 24.8.0 | slim
+`python3.12-nodejs24-alpine` | 3.12.11 | 24.8.0 | alpine
+`python3.12-nodejs22` | 3.12.11 | 22.19.0 | bookworm
+`python3.12-nodejs22-bullseye` | 3.12.11 | 22.19.0 | bullseye
+`python3.12-nodejs22-slim` | 3.12.11 | 22.19.0 | slim
+`python3.12-nodejs22-alpine` | 3.12.11 | 22.19.0 | alpine
+`python3.12-nodejs20` | 3.12.11 | 20.19.5 | bookworm
+`python3.12-nodejs20-bullseye` | 3.12.11 | 20.19.5 | bullseye
+`python3.12-nodejs20-slim` | 3.12.11 | 20.19.5 | slim
+`python3.12-nodejs20-alpine` | 3.12.11 | 20.19.5 | alpine
+`python3.11-nodejs24` | 3.11.13 | 24.8.0 | bookworm
+`python3.11-nodejs24-bullseye` | 3.11.13 | 24.8.0 | bullseye
+`python3.11-nodejs24-slim` | 3.11.13 | 24.8.0 | slim
+`python3.11-nodejs24-alpine` | 3.11.13 | 24.8.0 | alpine
+`python3.11-nodejs22` | 3.11.13 | 22.19.0 | bookworm
+`python3.11-nodejs22-bullseye` | 3.11.13 | 22.19.0 | bullseye
+`python3.11-nodejs22-slim` | 3.11.13 | 22.19.0 | slim
+`python3.11-nodejs22-alpine` | 3.11.13 | 22.19.0 | alpine
+`python3.11-nodejs20` | 3.11.13 | 20.19.5 | bookworm
+`python3.11-nodejs20-bullseye` | 3.11.13 | 20.19.5 | bullseye
+`python3.11-nodejs20-slim` | 3.11.13 | 20.19.5 | slim
+`python3.11-nodejs20-alpine` | 3.11.13 | 20.19.5 | alpine
+`python3.10-nodejs24` | 3.10.18 | 24.8.0 | bookworm
+`python3.10-nodejs24-bullseye` | 3.10.18 | 24.8.0 | bullseye
+`python3.10-nodejs24-slim` | 3.10.18 | 24.8.0 | slim
+`python3.10-nodejs24-alpine` | 3.10.18 | 24.8.0 | alpine
+`python3.10-nodejs22` | 3.10.18 | 22.19.0 | bookworm
+`python3.10-nodejs22-bullseye` | 3.10.18 | 22.19.0 | bullseye
+`python3.10-nodejs22-slim` | 3.10.18 | 22.19.0 | slim
+`python3.10-nodejs22-alpine` | 3.10.18 | 22.19.0 | alpine
+`python3.10-nodejs20` | 3.10.18 | 20.19.5 | bookworm
+`python3.10-nodejs20-bullseye` | 3.10.18 | 20.19.5 | bullseye
+`python3.10-nodejs20-slim` | 3.10.18 | 20.19.5 | slim
+`python3.10-nodejs20-alpine` | 3.10.18 | 20.19.5 | alpine
+`python3.9-nodejs24` | 3.9.23 | 24.8.0 | bookworm
+`python3.9-nodejs24-bullseye` | 3.9.23 | 24.8.0 | bullseye
+`python3.9-nodejs24-slim` | 3.9.23 | 24.8.0 | slim
+`python3.9-nodejs24-alpine` | 3.9.23 | 24.8.0 | alpine
+`python3.9-nodejs22` | 3.9.23 | 22.19.0 | bookworm
+`python3.9-nodejs22-bullseye` | 3.9.23 | 22.19.0 | bullseye
+`python3.9-nodejs22-slim` | 3.9.23 | 22.19.0 | slim
+`python3.9-nodejs22-alpine` | 3.9.23 | 22.19.0 | alpine
+`python3.9-nodejs20` | 3.9.23 | 20.19.5 | bookworm
+`python3.9-nodejs20-bullseye` | 3.9.23 | 20.19.5 | bullseye
+`python3.9-nodejs20-slim` | 3.9.23 | 20.19.5 | slim
+`python3.9-nodejs20-alpine` | 3.9.23 | 20.19.5 | alpine
 
 <!-- TAGS_END -->
 

renovate.json

@@ -1,7 +1,9 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    "customManagers:githubActionsVersions",
+    "helpers:pinGitHubActionDigests"
   ],
   "configMigration": true,
   "packageRules": [
@@ -10,6 +12,33 @@
       "matchDepNames": [
         "ruff"
       ],
+      "addLabels": [
+        "renovate:automerge"
+      ],
+      "automerge": true
+    },
+
+    {
+      "groupName": "Linter dependencies",
+      "description": "Group linter updates",
+      "matchFileNames": [
+        ".pre-commit-config.yaml"
+      ],
+      "addLabels": [
+        "renovate:automerge"
+      ],
+      "automerge": true
+    },
+    {
+      "groupName": "GitHub Actions dependencies",
+      "description": "Group GitHub Actions updates",
+      "matchFileNames": [
+        ".github/**/*.yaml",
+        ".github/**/*.yml"
+      ],
+      "addLabels": [
+        "renovate:automerge"
+      ],
       "automerge": true
     }
   ],