From bad427f49acbfdfa878e0a47582178af60aedc97 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 04:05:15 +0000
Subject: [PATCH] Fix supply chain risk by pinning uv Docker image version

Pin `ghcr.io/astral-sh/uv:latest` to explicit version tag `0.10.8` in
`Dockerfile` to eliminate reliance on mutable tags and prevent potential
supply chain or tag-spoofing attacks.
---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9e516b6..f448c24 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
 # Stage 1: Build stage
 FROM python:3.14-alpine AS build
 
-# Install uv
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+# Install uv (pinned to explicit version to mitigate supply chain and tag-spoofing risks)
+COPY --from=ghcr.io/astral-sh/uv:0.10.8 /uv /uvx /bin/
 
 # Enable bytecode compilation for faster startup
 ENV UV_COMPILE_BYTECODE=1