Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Acceptance Criteria
Notes on SSL usage
Starting with NodeJS 17, a security fix with breaking changes was implemented and dropped support to older versions of OpenSSL ( official announcement ). So, every dependency used has to be compatible with OpenSSL 3.0 from now on.
By inserting the
--openssl-legacy-provider
flag on ourstart
andbuild
scripts we can avoid this temporarily. Adding this flag does not decrease our security, but only keeps it in the same level as it was on the last version.A future PR will deal exclusively with upgrading this security point and removing this flag. The most relevant dependency impacting this upgrade is the
react-scripts
, as described on #441 .Notes on lockfile
NodeJS 20 could handle an upgrade of the lockfile version to
v3
. However, this forces an update of all the patches and minor versions of all the indirect dependencies. Until the React Router is updated tov6
, this approach is not feasible, as it breaks thenpm install
.A dedicated PR will be opened later to upgrade the lockfile.
Notes on building
Both the development environment and the built binaries work correctly, as recorded by #493 .
Security Checklist