Use Node.js 26 and pnpm 12 with Aurora 1.0.0-alpha.20

.github/workflows/release.yml

@@ -94,7 +94,7 @@ jobs:
       - name: make lint
         run: make lint
 
-  # aurora-builder and aurora-prod-config: both build FROM node:24 and depend on
+  # aurora-builder and aurora-prod-config: both build FROM node:26 and depend on
   # nothing else in this repository, so they go first and in parallel.
   build-base:
     needs:

.hadolint.yaml

@@ -4,7 +4,7 @@
 # finding and should be fixed in the Dockerfile rather than added to this list.
 ignored:
   # Pin versions in apt-get install. These images track Debian bookworm through
-  # the node:24-bookworm-slim base, whose package set moves with the base image;
+  # the node:26-bookworm-slim base, whose package set moves with the base image;
   # pinning apt versions here would break the build on the next base bump
   # without making anything more reproducible.
   - DL3008

pnpm/Dockerfile

@@ -27,4 +27,10 @@ LABEL maintainer="Plone Community <dev@plone.org>" \
 COPY --from=builder /app/ /app/
 
 # Install the pnpm version declared by the Cookieplone-generated package.json.
-RUN corepack install
+# pnpm >= 12 ships as a native binary that corepack only downloads the first
+# time pnpm runs, so run it once here instead of on every container start.
+RUN <<EOT
+    set -e
+    corepack install
+    pnpm --version
+EOT

pnpm/Dockerfile.builder

@@ -1,12 +1,14 @@
 # syntax=docker/dockerfile:1
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 
 ARG AURORA_VERSION
 # Pinned to a cookieplone-templates commit rather than to `main` so a given
 # commit here always scaffolds the same project -- bump it deliberately.
 # It must include the `sub/aurora_project` template (plone/cookieplone-templates#490);
-# switch back to a release tag once one includes it.
-ARG COOKIEPLONE_REPOSITORY_TAG=53f065a1df4cb6e6b9757a9375298ac4abd41fec
+# Node.js 26 needs plone/cookieplone-templates#485, whose pre-prompt check
+# otherwise rejects it, and pnpm 12 comes from plone/cookieplone-templates#495.
+# Switch back to a release tag once one includes all three.
+ARG COOKIEPLONE_REPOSITORY_TAG=b12538cd442a86d1869caf641aea4c36f6902481
 # 2.0.2 handles template names with `/` (plone/cookieplone#216); 2.0.0 exits
 # with an error after generating `sub/aurora_project`.
 ARG COOKIEPLONE_VERSION=2.0.2

pnpm/Dockerfile.prod

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 
 LABEL maintainer="Plone Community <dev@plone.org>" \
       org.label-schema.name="aurora-prod-config" \

version.txt

@@ -1 +1 @@
-1.0.0-alpha.19
+1.0.0-alpha.20