From 66524d9e3d8855eb442e9d774ad9413271dd1402 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Neves?= <andrerfneves@users.noreply.github.com>
Date: Fri, 26 Jun 2026 22:02:45 +0000
Subject: [PATCH] build: pin nginx base image version for reproducible builds

Change FROM nginx:alpine to FROM nginx:1.25-alpine to use a pinned
version tag instead of the floating :alpine tag. The builder stage
already pins Node.js to node:20-alpine, making the production stage
the only unpinned image.

Using a floating tag like :alpine can lead to unexpected build breaks
when nginx releases a new major version. Pinning to the 1.25-alpine
series ensures consistent, reproducible builds while still receiving
patch updates.
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index a089e49..2d88871 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,7 +16,7 @@ COPY . .
 RUN npm run build
 
 # Production stage
-FROM nginx:alpine
+FROM nginx:1.25-alpine
 
 # Copy built assets from builder
 COPY --from=builder /app/build /usr/share/nginx/html