Repository navigation
Bump pinned Node 12 (EOL) to a current LTS in pom.xml and CI #15
Description
Contexte
The frontend is built with Node v12.3.1 / Yarn v1.16.0 pinned in web-ui/pom.xml and node-version: '12' in CI. Node 12 has been EOL since April 2022: no security fixes, and the frontend-maven-plugin downloads a binary nobody patches anymore.
Description
Move the pinned Node to a current LTS (20.x) and Yarn 1.22.x, aligning web-ui/pom.xml and .github/workflows/ci.yml. Config only. react-scripts 3.0.1 must still build; if it does not (OpenSSL 3 ERR_OSSL_EVP_UNSUPPORTED is the known trap with webpack 4), stop and report: the react-scripts upgrade is out of scope.
Fichiers concernes
web-ui/pom.xml:24-25—node.version,yarn.version.github/workflows/ci.yml:82—node-version
Plan d'implementation
- Locally:
nvm use 20 && cd web-ui/javascript && yarn install && yarn build && yarn testto check react-scripts 3.0.1 under Node 20 (tryNODE_OPTIONS=--openssl-legacy-provideronly as a diagnostic, not as the fix). - If green: bump the two pom properties and the CI
node-version; also try Node 18 if 20 fails. - Full
mvn packageto make sure the frontend-maven-plugin download + build passes. - Check
git diff --exit-codeafter the build (a regeneratedyarn.lockmust be committed deliberately, not left behind).
Criteres d'acceptation
-
web-ui/pom.xmlandci.ymlpoint to the same current LTS - Maven build +
yarn testgreen on Ubuntu and Windows CI - If react-scripts 3 cannot build on any current LTS, the issue is updated with the finding and left open instead of being forced
Complexite
S (M if react-scripts fights back)
Activity
lgnap commentedon Sep 11, 2026
Prise en charge par Claude Code (instance
tuxedo:40112:d397e957, branchechore/issue-15-node-lts).lgnap commentedon Sep 11, 2026
Finding: blocked by react-scripts 3.0.1, as the ticket anticipated — no PR
Measured on this machine (
yarn build,CI=true, same lockfile):error:0308010C:digital envelope routines::unsupportedCause: webpack 4 (what react-scripts 3 ships) hashes modules with MD4 through Node's
crypto, and OpenSSL 3 — Node ≥ 17 — refuses it. Nothing in this repo can fix that; only webpack ≥ 5.61 (react-scripts 5) can.Options, none of which is "just bump the number":
NODE_OPTIONS=--openssl-legacy-providerinweb-ui/pom.xml(frontend-maven-pluginenvironmentVariables) and inci.yml. Works today, but it re-enables legacy OpenSSL algorithms for the build, ties the build to a flag Node may drop, and papers over the real problem.Recommendation: do not take 3. Take 2 only if someone wants the small win now; otherwise leave this open and let the real fix be the react-scripts 3 → 5 upgrade, which is the item in #3 this ticket said was out of scope. That upgrade also removes the
marked/lib/marked.umd.jsimport wart from antoinevalentinHA#58. It is its own ticket, size M, and the one that actually closes this.Leaving open, unassigned.
lgnap commentedon Sep 11, 2026
Blocked by #18 (react-scripts 3 → 5), which is the actual fix. This ticket closes with that PR.