**Policy:** Pull requests to enforce SHA pinning are not supported in this repository and will be closed. For context on why we do not use this feature, please refer to #393.

<!-- Use [x] to mark item done before creation, or just click the checkboxes with device pointer after creation -->
- [ ] This pull request isn't about enforcing SHA pinning.