pin urls to a specific commitish, because in the case the font gets an update hashes will change on the master and therefore break, as @zimbatm pointed out in #11574.