Docker: pnpm version ARG is out of stage scope; plugin builds fail with pnpm 12

Start with src/static/js/pluginfw/installer.ts and the Dockerfile's pnpm installation stages; reproduce the failure with the provided docker buildx command. Check the corresponding develop Docker configuration noted in the report, then verify that plugin builds succeed and that the PnpmVersion build argument produces the requested pnpm version.

Describe the bug
Building the v3.3.3 production image with any non-empty ETHERPAD_PLUGINS value fails in the subsequent pnpm run plugins i step, before the requested plugin is installed. The failure is in the plugin installer's migration precheck: pnpm ls --long --json --depth=0 --no-production → error: unexpected argument '--no-production' found

(pnpm 12.3.4 has removed that flag; its hint is --no-prod).

A secondary bug was noticed during remediation: when passing a version pin for pnpm via build-args, the pinned version is not respected (ie, docker build always uses the latest pnpm version, not the one passed in build-args).

To Reproduce

docker buildx build --no-cache --progress=plain \
  --target production \
  --build-arg BUILDKIT_CONTEXT_KEEP_GIT_DIR=1 \
  --build-arg 'ETHERPAD_PLUGINS=ep_comments_page' \
  -t etherpad-plugin-repro \
  'https://github.com/ether/etherpad.git#v3.3.3'

This fails in the plugin installation step after bin/installDeps.sh completes. Output:

[INFO] plugins - pnpm --version: 12.3.4
[ERROR] runCmd|pnpm - error: unexpected argument '--no-production' found
[ERROR] runCmd|pnpm -   tip: a similar argument exists: '--no-prod'
Error: Command exited with code 2: pnpm ls --long --json --depth=0 --no-production
    at migratePluginsFromNodeModules (src/static/js/pluginfw/installer.ts:61)

Further investigation shows that the requested pnpm version pin is ignored:

docker buildx build --no-cache --progress=plain \
  --target build \
  --build-arg BUILDKIT_CONTEXT_KEEP_GIT_DIR=1 \
  --build-arg PnpmVersion=11.0.6 \
  -t etherpad-pnpm-repro \
  'https://github.com/ether/etherpad.git#v3.3.3'

This will succeed, but when you follow up with: docker run --rm etherpad-pnpm-repro pnpm --version, it will print 12.3.4 (latest) instead of the expected 11.0.6.

Expected behavior
Plugin build: a successful build

pnpm version pinned build: pnpm version spec respected during build.

Server (please complete the following information):

• Etherpad version: 3.3.3
• OS: Docker on Ubuntu 24.04.4 LTS
• Node.js version (node --version): 24.21.0 (in image)
• pnpm version (in image): 12.3.4
• npm version (npm --version): N/A
• Is the server free of plugins: N/A — this reproduces while building an image through Etherpad’s documented plugin build argument.
• Are you using any abstraction IE docker? Yes, Docker

Additional context

• pnpm 12.0.0 became npm latest on 2026-08-26; v3.3.3 shipped 2026-07-29 with pnpm 11 as latest, so builds worked until then.
• The Dockerfile's ARG PnpmVersion=11.0.6 is declared before the first FROM and not redeclared in the adminbuild/build stages, so npm install -g pnpm@${PnpmVersion} expands to pnpm@ and installs latest
• This is why the pin doesn't hold and why --build-arg PnpmVersion=… has no effect. develop has the same code.
• Suggested fix: --no-production → --no-prod in installer.ts; add ARG PnpmVersion after both node:24-alpine FROMs.
• Workaround: vendor the v3.3.3 Dockerfile and redeclare ARG PnpmVersion inside both build stages.