Update to pnpm 12.3.4, update vulnerable dependencies

.devcontainer/Dockerfile

@@ -6,7 +6,7 @@ ARG UBUNTU_NAME=noble
 FROM mcr.microsoft.com/dotnet/sdk:${DOTNET_VERSION}-${UBUNTU_NAME}-amd64
 
 ARG NODE_MAJOR=22
-ARG PNPM_VERSION=11.10
+ARG PNPM_VERSION=12.3.4
 
 # Avoid prompts during package installation
 ENV DEBIAN_FRONTEND=noninteractive

.github/workflows/build-and-test.yml

@@ -21,7 +21,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
       # Continue building in other environments to see which are working.
       fail-fast: false
     runs-on: ${{matrix.os}}
@@ -87,6 +87,8 @@ jobs:
         run: dotnet tool install --global dotnet-reportgenerator-globaltool
       - name: "Deps: RealtimeServer pnpm"
         run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))
+      - name: "Build: RealtimeServer"
+        run: cd src/RealtimeServer  && pnpm run build
       - name: "Deps: Backend nuget"
         run: dotnet restore
       - name: "Deps: Frontend pnpm"
@@ -148,7 +150,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
       fail-fast: false
     runs-on: ${{matrix.os}}
     steps:

.github/workflows/ci-lint-prettier.yml

@@ -21,7 +21,7 @@ jobs:
       matrix:
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/ci-production-build.yml

@@ -21,7 +21,7 @@ jobs:
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
         os: [ubuntu-latest]
 
     steps:
@@ -46,7 +46,9 @@ jobs:
         run: |
           set -xueo pipefail
           npm install --global npm@${NPM_VERSION}
-      - name: Build Realtime server dependencies for Angular
+      - name: "Deps: RealtimeServer pnpm"
         run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))
+      - name: "Build: RealtimeServer"
+        run: cd src/RealtimeServer  && pnpm run build
       - name: Angular Frontend Production Build
         run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci)) && pnpm run build

.github/workflows/codeql.yml

@@ -50,7 +50,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
 
     steps:
       - name: Checkout repository

.github/workflows/e2e-tests.yml

@@ -20,7 +20,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
     if: |
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'e2e') ||
@@ -91,7 +91,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
     runs-on: ${{matrix.os}}
     steps:
       - name: Checkout
@@ -168,7 +168,7 @@ jobs:
       matrix:
         os: ["ubuntu-24.04"]
         dotnet_version: ["10.0.x"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
     runs-on: ${{matrix.os}}
     steps:
       - name: Checkout
@@ -255,7 +255,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
     runs-on: ${{matrix.os}}
     steps:
       - name: Checkout
@@ -323,7 +323,7 @@ jobs:
         dotnet_version: ["10.0.x"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
     runs-on: ${{matrix.os}}
     steps:
       - name: Checkout

.github/workflows/release-live.yml

@@ -115,7 +115,7 @@ jobs:
       dotnet_version: "10.0.x"
       node_version: "22.13.0"
       npm_version: "11.11.0"
-      pnpm_version: "11.10.0"
+      pnpm_version: "12.3.4"
       # When bumping OS version, the server will need to authorize the new default rsync args.
       os: "ubuntu-24.04"
 

.github/workflows/release-qa.yml

@@ -136,7 +136,7 @@ jobs:
       dotnet_version: "10.0.x"
       node_version: "22.13.0"
       npm_version: "11.11.0"
-      pnpm_version: "11.10.0"
+      pnpm_version: "12.3.4"
       # When bumping OS version, the server will need to authorize the new default rsync args.
       os: "ubuntu-24.04"
 

.github/workflows/storybook-screenshots.yml

@@ -54,7 +54,7 @@ jobs:
         os: ["ubuntu-24.04"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
     runs-on: ${{matrix.os}}
     steps:
       - name: Checkout base
@@ -96,11 +96,11 @@ jobs:
 
       - name: "Deps: RealtimeServer pnpm"
         run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))
-      - name: "Deps: Frontend pnpm"
-        run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci))
-
       - name: "Build: RealtimeServer"
         run: cd src/RealtimeServer && pnpm run build
+
+      - name: "Deps: Frontend pnpm"
+        run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci))
       - name: "Build: Frontend"
         run: cd src/SIL.XForge.Scripture/ClientApp && pnpm run build
       - name: "Build: Storybook"
@@ -155,7 +155,7 @@ jobs:
         os: ["ubuntu-24.04"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
     runs-on: ${{matrix.os}}
     steps:
       - name: Checkout branch
@@ -196,11 +196,11 @@ jobs:
 
       - name: "Deps: RealtimeServer pnpm"
         run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))
-      - name: "Deps: Frontend pnpm"
-        run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci))
-
       - name: "Build: RealtimeServer"
         run: cd src/RealtimeServer && pnpm run build
+
+      - name: "Deps: Frontend pnpm"
+        run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci))
       - name: "Build: Frontend"
         run: cd src/SIL.XForge.Scripture/ClientApp && pnpm run build
       - name: "Build: Storybook"

.github/workflows/storybook-tests.yml

@@ -16,7 +16,7 @@ jobs:
         os: ["ubuntu-24.04"]
         node_version: ["22.13.0"]
         npm_version: ["11.11.0"]
-        pnpm_version: ["11.10.0"]
+        pnpm_version: ["12.3.4"]
     runs-on: ${{matrix.os}}
     steps:
       - name: Checkout
@@ -66,11 +66,11 @@ jobs:
 
       - name: "Deps: RealtimeServer pnpm"
         run: cd src/RealtimeServer && (pnpm ci || (sleep 3m && pnpm ci))
+      - name: "Build: RealtimeServer"
+        run: cd src/RealtimeServer && pnpm run build
+
       - name: "Deps: Frontend pnpm"
         run: cd src/SIL.XForge.Scripture/ClientApp && (pnpm ci || (sleep 3m && pnpm ci))
-
-      - name: "Build: Backend, RealtimeServer"
-        run: cd src/RealtimeServer && pnpm run build
       - name: "Build: Frontend"
         run: cd src/SIL.XForge.Scripture/ClientApp && pnpm run build
 

.github/workflows/update-npm-audit.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          version: 11.10
+          version: 12.3.4
 
       - name: Set up Node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
@@ -37,6 +37,7 @@ jobs:
         run: |
           cd src/RealtimeServer
           pnpm ci
+          pnpm run build
           pnpm audit --fix update
         continue-on-error: true
 

deploy/vagrant/sfdev/Vagrantfile

@@ -62,7 +62,7 @@ Vagrant.configure("2") do |config|
     echo "== Installing npm =="
     cd ~/code/web-xforge
     retry sudo npm install --global npm@11.11.0
-    retry sudo npm install --global pnpm@11.10
+    retry sudo npm install --global pnpm@12.3.4
 
     # Change apt repo to https to avoid problems from stale proxies
     sudo sed -i 's|http://archive.ubuntu.com|https://archive.ubuntu.com|g' \

scripts/db_tools/package.json

@@ -12,7 +12,7 @@
     "@sillsdev/scripture": "^1.4.3",
     "ajv": "^8.20.0",
     "ajv-bsontype": "^1.0.7",
-    "axios": "^1.19.0",
+    "axios": "^1.20.0",
     "fast-diff": "^1.3.0",
     "mongodb": "^4.17.2",
     "ot-json0": "^1.1.0",
@@ -21,7 +21,7 @@
     "sharedb-access": "^5.0.0",
     "sharedb-mongo": "^1.0.0",
     "socket.io-client": "^4.8.3",
-    "ws": "^8.21.1",
+    "ws": "^8.21.3",
     "yargs": "^17.7.3"
   },
   "devDependencies": {