chore(deps): update pnpm to v11.26.0 [security]

.devcontainer/devcontainer.json

@@ -29,6 +29,6 @@
     }
   },
   "appPort": [3001],
-  "postCreateCommand": "npm i -g corepack@latest && corepack enable pnpm && pnpm config set store-dir /home/vscode/pnpm/store && corepack use pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b && pnpm install",
+  "postCreateCommand": "npm i -g corepack@latest && corepack enable pnpm && pnpm config set store-dir /home/vscode/pnpm/store && corepack use pnpm@11.26.0+sha512.fc0e2bf890b9f983611f1ab68c0637bce914390653699f83c1a78b005ed25f2c81e77920c8fd8eee2ecf0b58b28cdcb00a84d97f69bcf7c56b2f344710238664 && pnpm install",
   "remoteUser": "vscode"
 }

.github/workflows/test-code.yml

@@ -12,11 +12,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: PNPM update to v11.9.0
-        run: npm i -g corepack@latest && corepack enable pnpm && corepack use pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Setup PNPM and install dependencies
+        uses: pnpm/setup@v2
 
       - name: Test
         run: pnpm test

Dockerfile

@@ -1,5 +1,5 @@
 ARG NODE_VERSION=22.23.2-alpine3.23@sha256:46825fbbd4e996a78b7a2cdc08d75e38a5a505bdab95dcda55605359bf124bc6
-ARG PNPM_VERSION=11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b
+ARG PNPM_VERSION=11.26.0+sha512.fc0e2bf890b9f983611f1ab68c0637bce914390653699f83c1a78b005ed25f2c81e77920c8fd8eee2ecf0b58b28cdcb00a84d97f69bcf7c56b2f344710238664
 
 FROM node:$NODE_VERSION AS build
 ARG PNPM_VERSION

package.json

@@ -49,10 +49,7 @@
     "vite": "^8.0.16",
     "vitest": "^4.0.0",
     "vitest-mock-express": "^2.2.0",
-    "vitest-mock-extended": "^4.0.0",
-    "esbuild": "^0.28.1",
-    "form-data": "^4.0.6"
+    "vitest-mock-extended": "^4.0.0"
   },
-  "//": "esbuild and form-data are not direct dependencies of forms-api; however, we had to add them to enforce the use of versions that are not flagged as vulnerable by our security scanning system (we should be able to remove them in the future)",
-  "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b"
+  "packageManager": "pnpm@11.26.0+sha512.fc0e2bf890b9f983611f1ab68c0637bce914390653699f83c1a78b005ed25f2c81e77920c8fd8eee2ecf0b58b28cdcb00a84d97f69bcf7c56b2f344710238664"
 }