Why pin Docker base images (and not use :latest or python:slim)
Why it matters
A floating tag — :latest, or a tag with no version like python:slim — resolves to a different image on every build, so two builds of the same commit can behave differently in production.
How to fix it
Replace floating tags with explicit ones, for example FROM python:3.11-slim or FROM node:20-alpine. Pin by digest for the strongest guarantee.
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.