From be8f4ab8149857c7d5b1dfa8568333ad662377be Mon Sep 17 00:00:00 2001
From: Matthias Mair <code@mjmair.com>
Date: Fri, 26 Jun 2026 00:17:45 +0200
Subject: [PATCH] hard pin install script

---
 contrib/container/Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/contrib/container/Dockerfile b/contrib/container/Dockerfile
index 16418375e6..de1ab6ce8e 100644
--- a/contrib/container/Dockerfile
+++ b/contrib/container/Dockerfile
@@ -119,7 +119,8 @@ RUN pip install --user --require-hashes -r base_requirements.txt --no-cache-dir
     rm -rf /root/.cache/pip
 
 # Install frontend build dependencies
-RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.5/install.sh | bash && \
+# pinned to v0.40.5
+RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/1889911f0841e669de0be5bd02c737a3f1fd20fa/install.sh | bash && \
     bash -c "export NVM_DIR="$HOME/.nvm" && source $HOME/.nvm/nvm.sh && \
     nvm install $NODE_VERSION && corepack enable yarn && yarn config set network-timeout 600000 -g"
 RUN bash -c "source $HOME/.nvm/nvm.sh && cd '${INVENTREE_HOME}' && invoke int.frontend-compile --extract"