Update hugo, build, test etc.

.github/workflows/build.yml

@@ -5,7 +5,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: Tests
       run: ./bin/test.sh
     - name: Build

.github/workflows/docker.yml

@@ -5,6 +5,6 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: Build the Docker image
       run: docker build -t decred/dcrweb:$(date +%s) .

Dockerfile

@@ -2,8 +2,8 @@
 FROM alpine:latest
 
 ARG HUGO_BASEURL
-ENV HUGO_BASEURL ${HUGO_BASEURL:-https://decred.org/}
-ENV HUGO_VERSION 0.134.0
+ENV HUGO_BASEURL="${HUGO_BASEURL:-https://decred.org/}"
+ENV HUGO_VERSION="0.152.2"
 
 LABEL description="gohugo build"
 LABEL version="1.0"
@@ -25,7 +25,7 @@ RUN bin/build-hugo.sh
 # Serve image (stable nginx version)
 # This cannot use Alpine because test/Dockerfile builds on this image and
 # expects it to have apt-get.
-FROM nginx:1.26
+FROM nginx:1.28
 
 LABEL description="dcrweb server"
 LABEL version="1.0"

bin/test.sh

@@ -11,10 +11,16 @@ echo -n "Starting nu validator "
 # run nu-validator service
 docker stop validator 2>/dev/null
 
+# validator image pulled by the digest (immutable id) to avoid supply-chain attacks.
+# validator no longer does numbered releases, this is the latest as of November 2025.
+validator_version="sha256:bced7e1a07762be88a6514302c68c37dae98c60f62deb48db7b0a2ab91bb9041"
+
 docker run \
     -d --rm \
     --name validator \
-    -p 8888:8888 ghcr.io/validator/validator:23.4.11 || exit 1
+    -p 8888:8888 \
+    ghcr.io/validator/validator@$validator_version \
+    || exit 1
 
 # wait for the validator service to start up
 

bin/watch.sh

@@ -9,7 +9,7 @@ rm -rf src/public src/resources
 
 HUGO=hugo
 if [[ ! $(type -P  ${HUGO}) ]]; then
-    HUGO="go run -v -tags extended github.com/gohugoio/hugo@latest"
+    HUGO="go run -v -tags extended github.com/gohugoio/hugo@v0.152.2"
 fi
 
 ${HUGO} version

test/Dockerfile

@@ -6,11 +6,11 @@ RUN apt-get update && apt-get install -y curl
 
 COPY package.json run-test.sh ./
 
-ENV NVM_DIR /usr/local/nvm
-ENV NODE_VERSION v20
+ENV NVM_DIR="/usr/local/nvm"
+ENV NODE_VERSION="v24"
 
 RUN mkdir -p $NVM_DIR && \
-    curl -s -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
+    curl -s -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash
 
 # install node and npm
 RUN . $NVM_DIR/nvm.sh \