diff --git a/cmd/server/Dockerfile b/cmd/server/Dockerfile
index 55890a0..acdf74d 100644
--- a/cmd/server/Dockerfile
+++ b/cmd/server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:latest as builder
+FROM golang:latest@sha256:672a2286da3ee7a854c3e0a56e0838918d0dbb1c18652992930293312de898a6 as builder
 
 ENV CGO_ENABLED=0
 
@@ -18,7 +18,7 @@
 WORKDIR /go/src/gomodules.avm99963.com/twpt-server/cmd/server
 RUN go install gomodules.avm99963.com/twpt-server/cmd/server
 
-FROM alpine
+FROM alpine@sha256:51b67269f354137895d43f3b3d810bfacd3945438e94dc5ac55fdac340352f48
 LABEL maintainer "me@avm99963.com"
 
 RUN apk add --no-cache tini
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index a67ce0d..b222ec4 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -25,7 +25,7 @@
     networks:
       - backend
   db:
-    image: mariadb
+    image: mariadb@sha256:9da6213d1a5714c4585c9c0003c51510b320d6f60e53d78701fe1e194126249f
     environment:
       MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
       MARIADB_DATABASE: twpt
diff --git a/docker-compose.yml b/docker-compose.yml
index ca974ad..0b3b1b9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -26,7 +26,7 @@
       - backend
     restart: unless-stopped
   db:
-    image: mariadb
+    image: mariadb@sha256:9da6213d1a5714c4585c9c0003c51510b320d6f60e53d78701fe1e194126249f
     environment:
       MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
       MARIADB_DATABASE: twpt
diff --git a/docker/envoy-dev/Dockerfile b/docker/envoy-dev/Dockerfile
index a2c877b..5bfbc81 100644
--- a/docker/envoy-dev/Dockerfile
+++ b/docker/envoy-dev/Dockerfile
@@ -1,4 +1,4 @@
-FROM envoyproxy/envoy:v1.18-latest
+FROM envoyproxy/envoy:v1.18-latest@sha256:0f1c9e46ce1d07faea29e768e703aef50b43564434ed0eb4a195c8d4e8a08327
 
 COPY envoy.yaml /etc/envoy/envoy.yaml
 
diff --git a/docker/envoy/Dockerfile b/docker/envoy/Dockerfile
index a2c877b..5bfbc81 100644
--- a/docker/envoy/Dockerfile
+++ b/docker/envoy/Dockerfile
@@ -1,4 +1,4 @@
-FROM envoyproxy/envoy:v1.18-latest
+FROM envoyproxy/envoy:v1.18-latest@sha256:0f1c9e46ce1d07faea29e768e703aef50b43564434ed0eb4a195c8d4e8a08327
 
 COPY envoy.yaml /etc/envoy/envoy.yaml
 
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index e04e3b9..b55e33d 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -10,7 +10,7 @@
 
 RUN ./node_modules/webpack-cli/bin/cli.js --mode production
 
-FROM nginx:1.21-alpine
+FROM nginx:1.21-alpine@sha256:a74534e76ee1121d418fa7394ca930eb67440deda413848bc67c68138535b989
 LABEL maintainer "me@avm99963.com"
 
 COPY --from=build-stage /app/dist /usr/share/nginx/html
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index b166490..ae9c9b7 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -16,16 +16,16 @@
         "vuex": "^4.0.2"
       },
       "devDependencies": {
-        "css-loader": "^6.2.0",
-        "html-webpack-plugin": "^5.3.2",
-        "json5": "^1.0.1",
-        "sass": "^1.38.1",
-        "sass-loader": "^12.1.0",
-        "style-loader": "^3.2.1",
-        "vue-style-loader": "^4.1.3",
-        "webpack": "^5.51.1",
-        "webpack-cli": "^4.8.0",
-        "webpack-dev-server": "^4.0.0"
+        "css-loader": "6.2.0",
+        "html-webpack-plugin": "5.3.2",
+        "json5": "1.0.1",
+        "sass": "1.38.1",
+        "sass-loader": "12.1.0",
+        "style-loader": "3.2.1",
+        "vue-style-loader": "4.1.3",
+        "webpack": "5.51.1",
+        "webpack-cli": "4.8.0",
+        "webpack-dev-server": "4.7.2"
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
@@ -5228,7 +5228,7 @@
     "node_modules/vue-style-loader/node_modules/hash-sum": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-1.0.2.tgz",
-      "integrity": "sha1-M7QHd3VMZDJXPBIMw4CLvRDUfwQ=",
+      "integrity": "sha512-fUs4B4L+mlt8/XAtSOGMUO1TXmAelItBPtJG7CyHJfYTdDjwisntGO2JQz7oUsatOY9o68+57eziUVNw/mRHmA==",
       "dev": true
     },
     "node_modules/vuex": {
@@ -5496,9 +5496,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/ajv": {
-      "version": "8.8.2",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.8.2.tgz",
-      "integrity": "sha512-x9VuX+R/jcFj1DHo/fCp99esgGDWiHENrKxaCENuCxpoMCmAt/COCGVDwA7kleEpEzJjDnvh3yGoOuLu0Dtllw==",
+      "version": "8.12.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.12.0.tgz",
+      "integrity": "sha512-sRu1kpcO9yLtYxBKvqfTeh9KzZEwO3STyX1HT+4CaDzC6HpTGYhIhPIzj9XuKU7KYDwnaeh5hcOwjy1QuJzBPA==",
       "dev": true,
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -5536,9 +5536,9 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/colorette": {
-      "version": "2.0.16",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.16.tgz",
-      "integrity": "sha512-hUewv7oMjCp+wkBv5Rm0v87eJhq4woh5rSR+42YSQJKecCqgIqNkZ6lAlQms/BwHPJA5NKMRlpxPRv0n8HQW6g==",
+      "version": "2.0.20",
+      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
+      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
       "dev": true
     },
     "node_modules/webpack-dev-server/node_modules/json-schema-traverse": {
@@ -5548,15 +5548,15 @@
       "dev": true
     },
     "node_modules/webpack-dev-server/node_modules/schema-utils": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
-      "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.2.0.tgz",
+      "integrity": "sha512-L0jRsrPpjdckP3oPug3/VxNKt2trR8TcabrM6FOAAlvC/9Phcmm+cuAgTlxBqdBR1WJx7Naj9WHw+aOmheSVbw==",
       "dev": true,
       "dependencies": {
         "@types/json-schema": "^7.0.9",
-        "ajv": "^8.8.0",
+        "ajv": "^8.9.0",
         "ajv-formats": "^2.1.1",
-        "ajv-keywords": "^5.0.0"
+        "ajv-keywords": "^5.1.0"
       },
       "engines": {
         "node": ">= 12.13.0"
@@ -5567,12 +5567,12 @@
       }
     },
     "node_modules/webpack-dev-server/node_modules/strip-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.0.tgz",
-      "integrity": "sha512-UhDTSnGF1dc0DRbUqr1aXwNoY3RgVkSWG8BrpnuFIxhP57IqbS7IRta2Gfiavds4yCxc5+fEAVVOgBZWnYkvzg==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz",
+      "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==",
       "dev": true,
       "dependencies": {
-        "ansi-regex": "^6.0.0"
+        "ansi-regex": "^6.0.1"
       },
       "engines": {
         "node": ">=12"
@@ -9986,7 +9986,7 @@
         "hash-sum": {
           "version": "1.0.2",
           "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-1.0.2.tgz",
-          "integrity": "sha1-M7QHd3VMZDJXPBIMw4CLvRDUfwQ=",
+          "integrity": "sha512-fUs4B4L+mlt8/XAtSOGMUO1TXmAelItBPtJG7CyHJfYTdDjwisntGO2JQz7oUsatOY9o68+57eziUVNw/mRHmA==",
           "dev": true
         }
       }
@@ -10175,9 +10175,9 @@
       },
       "dependencies": {
         "ajv": {
-          "version": "8.8.2",
-          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.8.2.tgz",
-          "integrity": "sha512-x9VuX+R/jcFj1DHo/fCp99esgGDWiHENrKxaCENuCxpoMCmAt/COCGVDwA7kleEpEzJjDnvh3yGoOuLu0Dtllw==",
+          "version": "8.12.0",
+          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.12.0.tgz",
+          "integrity": "sha512-sRu1kpcO9yLtYxBKvqfTeh9KzZEwO3STyX1HT+4CaDzC6HpTGYhIhPIzj9XuKU7KYDwnaeh5hcOwjy1QuJzBPA==",
           "dev": true,
           "requires": {
             "fast-deep-equal": "^3.1.1",
@@ -10202,9 +10202,9 @@
           "dev": true
         },
         "colorette": {
-          "version": "2.0.16",
-          "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.16.tgz",
-          "integrity": "sha512-hUewv7oMjCp+wkBv5Rm0v87eJhq4woh5rSR+42YSQJKecCqgIqNkZ6lAlQms/BwHPJA5NKMRlpxPRv0n8HQW6g==",
+          "version": "2.0.20",
+          "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
+          "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
           "dev": true
         },
         "json-schema-traverse": {
@@ -10214,24 +10214,24 @@
           "dev": true
         },
         "schema-utils": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
-          "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+          "version": "4.2.0",
+          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.2.0.tgz",
+          "integrity": "sha512-L0jRsrPpjdckP3oPug3/VxNKt2trR8TcabrM6FOAAlvC/9Phcmm+cuAgTlxBqdBR1WJx7Naj9WHw+aOmheSVbw==",
           "dev": true,
           "requires": {
             "@types/json-schema": "^7.0.9",
-            "ajv": "^8.8.0",
+            "ajv": "^8.9.0",
             "ajv-formats": "^2.1.1",
-            "ajv-keywords": "^5.0.0"
+            "ajv-keywords": "^5.1.0"
           }
         },
         "strip-ansi": {
-          "version": "7.0.0",
-          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.0.tgz",
-          "integrity": "sha512-UhDTSnGF1dc0DRbUqr1aXwNoY3RgVkSWG8BrpnuFIxhP57IqbS7IRta2Gfiavds4yCxc5+fEAVVOgBZWnYkvzg==",
+          "version": "7.1.0",
+          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz",
+          "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==",
           "dev": true,
           "requires": {
-            "ansi-regex": "^6.0.0"
+            "ansi-regex": "^6.0.1"
           }
         }
       }
diff --git a/frontend/package.json b/frontend/package.json
index afdb2d6..8f0211d 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,15 +1,15 @@
 {
   "devDependencies": {
-    "css-loader": "^6.2.0",
-    "html-webpack-plugin": "^5.3.2",
-    "json5": "^1.0.1",
-    "sass": "^1.38.1",
-    "sass-loader": "^12.1.0",
-    "style-loader": "^3.2.1",
-    "vue-style-loader": "^4.1.3",
-    "webpack": "^5.51.1",
-    "webpack-cli": "^4.8.0",
-    "webpack-dev-server": "^4.0.0"
+    "css-loader": "6.2.0",
+    "html-webpack-plugin": "5.3.2",
+    "json5": "1.0.1",
+    "sass": "1.38.1",
+    "sass-loader": "12.1.0",
+    "style-loader": "3.2.1",
+    "vue-style-loader": "4.1.3",
+    "webpack": "5.51.1",
+    "webpack-cli": "4.8.0",
+    "webpack-dev-server": "4.7.2"
   },
   "dependencies": {
     "@vue/compiler-sfc": "^3.2.6",