chore(deps): pin dependencies

.github/workflows/report.yaml

@@ -15,7 +15,7 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Download from Artifacts
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@268677152d06ba59fcec7a7f0b5d961b6ccd7e1e # v2
         with:
           workflow: ${{ github.event.workflow.name }}
           run_id: ${{github.event.workflow_run.id }}

docs/requirements.txt

@@ -1,6 +1,6 @@
-docutils==0.16
+docutils==0.20.1
 sphinx>=4.3.0
 sphinx-copybutton
 sphinx-rtd-theme>=0.5.1
 sphinx-tabs
-urllib3==2.0.2
+urllib3==2.2.1

nix/Dockerfile

@@ -1,7 +1,7 @@
 # This Dockerfile is only used as a development environment for
 # non-nix systems, i.e. Windows.
 
-FROM nixos/nix:latest
+FROM nixos/nix:latest@sha256:273671b9032d06844ec073affa9fb1e75bf7ad863975bec5143e7fa417929fb8
 
 RUN apk --no-cache add \
     wget