From eabbe44a4f8b56d77e2e7916b372a0b19f09fbcc Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 28 Apr 2026 16:31:06 +0000
Subject: [PATCH] build(docker): pin trunk to 0.21.14 in web image

Mirror deploy.yml pin. Eliminates supply-chain drift from
unpinned `cargo install trunk`.

Refs #475
---
 docker/web.Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/web.Dockerfile b/docker/web.Dockerfile
index fa9c3c15..e61a53c2 100644
--- a/docker/web.Dockerfile
+++ b/docker/web.Dockerfile
@@ -1,7 +1,7 @@
 # rust:1.95-slim-bookworm pinned 2026-04-28; bump via `docker buildx imagetools inspect rust:1.95-slim-bookworm`
 FROM rust:1.95-slim-bookworm@sha256:caaf9ca7acd474892186860307d6f28e51fdbc1a4eada459fcff81517cf46a36 AS builder
 RUN rustup target add wasm32-unknown-unknown
-RUN cargo install trunk
+RUN cargo install trunk --version 0.21.14 --locked
 WORKDIR /build
 COPY . .
 RUN cd crates/web && trunk build --release