Docker: pnpm version ARG is out of stage scope; plugin builds fail with pnpm 12

Describe the bug Building the v3.3.3 production image with any non-empty ETHERPAD_PLUGINS value fails in the subsequent pnpm run plugins i step, before the requested plugin is installed. The failure is in the plugin installer's migration precheck: pnpm ls --long --json --depth=0 --no-production → error: unexpected argument '--no-production' found

(pnpm 12.3.4 has removed that flag; its hint is --no-prod).

A secondary bug was noticed during remediation: when passing a version pin for pnpm via build-args, the pinned version is not respected (ie, docker build always uses the latest pnpm version, not the one passed in build-args).

To Reproduce

docker buildx build --no-cache --progress=plain \
  --target production \
  --build-arg BUILDKIT_CONTEXT_KEEP_GIT_DIR=1 \
  --build-arg 'ETHERPAD_PLUGINS=ep_comments_page' \
  -t etherpad-plugin-repro \
  'https://github.com/ether/etherpad.git#v3.3.3'

This fails in the plugin installation step after bin/installDeps.sh completes. Output:

[INFO] plugins - pnpm --version: 12.3.4
[ERROR] runCmd|pnpm - error: unexpected argument '--no-production' found
[ERROR] runCmd|pnpm -   tip: a similar argument exists: '--no-prod'
Error: Command exited with code 2: pnpm ls --long --json --depth=0 --no-production
    at migratePluginsFromNodeModules (src/static/js/pluginfw/installer.ts:61)

Further investigation shows that the requested pnpm version pin is ignored:

docker buildx build --no-cache --progress=plain \
  --target build \
  --build-arg BUILDKIT_CONTEXT_KEEP_GIT_DIR=1 \
  --build-arg PnpmVersion=11.0.6 \
  -t etherpad-pnpm-repro \
  'https://github.com/ether/etherpad.git#v3.3.3'

This will succeed, but when you follow up with: docker run --rm etherpad-pnpm-repro pnpm --version, it will print 12.3.4 (latest) instead of the expected 11.0.6.

Expected behavior Plugin build: a successful build

pnpm version pinned build: pnpm version spec respected during build.

Server (please complete the following information):

• Etherpad version: 3.3.3
• OS: Docker on Ubuntu 24.04.4 LTS
• Node.js version (node --version): 24.21.0 (in image)
• pnpm version (in image): 12.3.4
• npm version (npm --version): N/A
• Is the server free of plugins: N/A — this reproduces while building an image through Etherpad’s documented plugin build argument.
• Are you using any abstraction IE docker? Yes, Docker

Additional context

• pnpm 12.0.0 became npm latest on 2026-08-26; v3.3.3 shipped 2026-07-29 with pnpm 11 as latest, so builds worked until then.
• The Dockerfile's ARG PnpmVersion=11.0.6 is declared before the first FROM and not redeclared in the adminbuild/build stages, so npm install -g pnpm@${PnpmVersion} expands to pnpm@ and installs latest
• This is why the pin doesn't hold and why --build-arg PnpmVersion=… has no effect. develop has the same code.
• Suggested fix: --no-production → --no-prod in installer.ts; add ARG PnpmVersion after both node:24-alpine FROMs.
• Workaround: vendor the v3.3.3 Dockerfile and redeclare ARG PnpmVersion inside both build stages.