fix: install pnpm deps in hoisted mode + declare @babel/types (#24288) (CP: 25.1)

Cherry-pick of d9290f8 from main.

Adjusted for 25.1's dep-graph: @babel/types is pinned to 7.28.5 to
match @babel/preset-react's version on this branch (main pins to
7.29.0 to match @babel/core which is not declared on 25.1).
@babel/core and @babel/plugin-transform-react-jsx-development from the
main commit are not added — they are not declared as direct deps on
25.1 and the React function location plugin only imports @babel/types.

The .npmrc and FrontendTools changes that switch pnpm to hoisted mode
apply unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ZheSun88

flow-build-tools/src/main/java/com/vaadin/flow/server/frontend/FrontendTools.java

@@ -364,7 +364,13 @@ public List<String> getPnpmExecutable() {
         List<String> pnpmCommand = getSuitablePnpm();
         assert !pnpmCommand.isEmpty();
         pnpmCommand = new ArrayList<>(pnpmCommand);
-        pnpmCommand.add("--shamefully-hoist=true");
+        // Force hoisted (flat npm-style) layout. CLI takes precedence over
+        // .npmrc, so this is unambiguous even if the project lacks the
+        // generated .npmrc. Replaces the previous --shamefully-hoist=true,
+        // which only controls the partial-hoist heuristic on top of the
+        // default isolated layout and did not consistently expose every
+        // transitive at the project root.
+        pnpmCommand.add("--config.node-linker=hoisted");
         return pnpmCommand;
     }
 

flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/FrontendToolsTest.java

@@ -379,8 +379,9 @@ void knownFaultyNpmVersionThrowsException() {
     @Test
     void getPnpmExecutable_executableIsAvailable() {
         List<String> executable = tools.getPnpmExecutable();
-        // command line should contain --shamefully-hoist=true option
-        assertTrue(executable.contains("--shamefully-hoist=true"));
+        // command line should force hoisted node-linker so transitive
+        // deps are always installed at the project root
+        assertTrue(executable.contains("--config.node-linker=hoisted"));
         assertTrue(executable.stream().anyMatch(cmd -> cmd.contains("pnpm")));
     }
 

flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/NodeUpdaterTest.java

@@ -169,6 +169,7 @@ void getDefaultDevDependencies_includesAllDependencies_whenUsingVite() {
         expectedDependencies.add("transform-ast");
         expectedDependencies.add("strip-css-comments");
         expectedDependencies.add("@babel/preset-react");
+        expectedDependencies.add("@babel/types");
         expectedDependencies.add("@types/react");
         expectedDependencies.add("@types/react-dom");
         expectedDependencies.add("@preact/signals-react-transform");

flow-build-tools/src/test/java/com/vaadin/flow/server/frontend/TaskRunPnpmInstallTest.java

@@ -227,6 +227,7 @@ void runPnpmInstall_npmRcFileNotFound_newNpmRcFileIsGenerated()
         String content = FileUtils.readFileToString(npmRcFile,
                 StandardCharsets.UTF_8);
         assertTrue(content.contains("shamefully-hoist"));
+        assertTrue(content.contains("node-linker=hoisted"));
     }
 
     @Test

flow-server/src/main/resources/com/vaadin/flow/server/frontend/dependencies/vite/package.json

@@ -15,6 +15,7 @@
     "@rollup/plugin-replace": "6.0.3",
     "@rollup/pluginutils": "5.3.0",
     "@babel/preset-react": "7.28.5",
+    "@babel/types": "7.28.5",
     "rollup-plugin-visualizer": "7.0.1",
     "rollup-plugin-brotli": "3.1.0",
     "vite-plugin-checker": "0.12.0",

flow-server/src/main/resources/npmrc

@@ -3,5 +3,11 @@
 #
 # This file sets the default parameters for manual `pnpm install`.
 #
+# node-linker=hoisted produces a flat node_modules layout (like npm),
+# so every transitive dependency lives at the project root. Flow's
+# frontend tooling and bundled Vite plugins (e.g. the React function
+# location plugin) import transitive deps that pnpm's symlink-based
+# layout did not consistently hoist, even with shamefully-hoist=true.
+node-linker=hoisted
 shamefully-hoist=true
 strict-peer-dependencies=false