fix(security): upgrade pnpm and AWS SDK to fix vulnerabilities

- Upgrade pnpm from 9.15.9 to 10.28.0 to address CVEs in bundled
  dependencies (brace-expansion, glob, tar)
- Upgrade AWS SDK from 3.879.0 to 3.971.0 to fix fast-xml-parser
  vulnerabilities
- Update Dockerfile corepack prepare commands to match new pnpm version

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/web/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine3.22 AS base
+FROM node:24-alpine3.23 AS base
 
 #
 ## step 1: Prune monorepo
@@ -20,7 +20,7 @@ FROM base AS installer
 # Enable corepack and prepare pnpm
 RUN npm install --ignore-scripts -g corepack@latest 
 RUN corepack enable
-RUN corepack prepare pnpm@9.15.9 --activate
+RUN corepack prepare pnpm@10.28.0 --activate
 
 # Install necessary build tools and compilers
 RUN apk update && apk add --no-cache cmake g++ gcc jq make openssl-dev python3
@@ -146,7 +146,7 @@ USER nextjs
 
 # Prepare pnpm as the nextjs user to ensure it's available at runtime
 # Prepare volumes for uploads and SAML connections
-RUN corepack prepare pnpm@9.15.9 --activate && \
+RUN corepack prepare pnpm@10.28.0 --activate && \
     mkdir -p /home/nextjs/apps/web/uploads/ && \
     mkdir -p /home/nextjs/apps/web/saml-connection
 

apps/web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@formbricks/web",
   "version": "0.0.0",
-  "packageManager": "pnpm@9.15.9",
+  "packageManager": "pnpm@10.28.0",
   "private": true,
   "scripts": {
     "clean": "rimraf .turbo node_modules .next coverage",
@@ -19,9 +19,9 @@
     "i18n:generate": "npx lingo.dev@latest run && npx lingo.dev@latest lockfile --force"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "3.879.0",
-    "@aws-sdk/s3-presigned-post": "3.879.0",
-    "@aws-sdk/s3-request-presigner": "3.879.0",
+    "@aws-sdk/client-s3": "3.971.0",
+    "@aws-sdk/s3-presigned-post": "3.971.0",
+    "@aws-sdk/s3-request-presigner": "3.971.0",
     "@boxyhq/saml-jackson": "1.52.2",
     "@dnd-kit/core": "6.3.1",
     "@dnd-kit/modifiers": "9.0.0",

package.json

@@ -75,7 +75,7 @@
   "engines": {
     "node": ">=16.0.0"
   },
-  "packageManager": "pnpm@9.15.9",
+  "packageManager": "pnpm@10.28.0",
   "nextBundleAnalysis": {
     "budget": 358400,
     "budgetPercentIncreaseRed": 20,

packages/storage/package.json

@@ -37,9 +37,9 @@
   "author": "Formbricks <hola@formbricks.com>",
   "dependencies": {
     "@formbricks/logger": "workspace:*",
-    "@aws-sdk/client-s3": "3.879.0",
-    "@aws-sdk/s3-presigned-post": "3.879.0",
-    "@aws-sdk/s3-request-presigner": "3.879.0"
+    "@aws-sdk/client-s3": "3.971.0",
+    "@aws-sdk/s3-presigned-post": "3.971.0",
+    "@aws-sdk/s3-request-presigner": "3.971.0"
   },
   "devDependencies": {
     "@formbricks/config-typescript": "workspace:*",