From 9625cb128a28c9324b057e801493162c5080e624 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 03:53:56 +0000
Subject: [PATCH] chore(deps): pin python docker tag to 05cda97

---
 src/codeprobe/sandbox/Dockerfile.sg_only | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/codeprobe/sandbox/Dockerfile.sg_only b/src/codeprobe/sandbox/Dockerfile.sg_only
index 82e26098..73228a17 100644
--- a/src/codeprobe/sandbox/Dockerfile.sg_only
+++ b/src/codeprobe/sandbox/Dockerfile.sg_only
@@ -3,7 +3,7 @@
 # Provides python + git + ripgrep + coreutils so agents can run read/search/
 # script workloads inside a container whose only writable surfaces are
 # those explicitly bind-mounted :rw by the caller.
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:05cda9777409a9c3ffddd94a4c476b79f0769a0b4857f0c7ed9226b6800b0d6f
 
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONDONTWRITEBYTECODE=1 \