Vaadin dependencies not compatible with Node 24

[knoobie]

Describe the bug

When creating an SBOM with cyclonedx-npm under NodeJS 24 (NodeJS 22 works fine) the build crashes with

 "code": "ELSPROBLEMS",
    "summary": "invalid: dompurify@3.2.7

Expected-behavior

Vaadin can be build with NodeJS 22 and NodeJS 24.

Reproduction

• Download a simple project from start.vaadin.com
• enable frontendHotdeploy=true in the pom.xml to ensure package(-lock).json is present
• start the application once to ensure node_modules it populated
• execute npm ls --json --long --all --omit=dev to mimic cyclonedx-npm

Result: npm debug log

163 verbose stack Error: invalid: dompurify@3.2.7 /Users/knoobie/dev/bugs/app/node_modules/dompurify
163 verbose stack invalid: ol@6.13.0 /Users/knoobie/dev/bugs/app/node_modules/ol
163 verbose stack invalid: rbush@3.0.1 /Users/knoobie/dev/bugs/app/node_modules/rbush
163 verbose stack invalid: @lit/react@1.0.8 /Users/knoobie/dev/bugs/app/node_modules/@lit/react
163 verbose stack invalid: @types/react-dom@18.3.7 /Users/knoobie/dev/bugs/app/node_modules/@types/react-dom
163 verbose stack invalid: @types/react@18.3.24 /Users/knoobie/dev/bugs/app/node_modules/@types/react
163 verbose stack invalid: loose-envify@1.4.0 /Users/knoobie/dev/bugs/app/node_modules/loose-envify
163 verbose stack     at LS.exec (/opt/homebrew/lib/node_modules/npm/lib/commands/ls.js:206:9)
163 verbose stack     at async Npm.exec (/opt/homebrew/lib/node_modules/npm/lib/npm.js:208:9)
163 verbose stack     at async module.exports (/opt/homebrew/lib/node_modules/npm/lib/cli/entry.js:67:5)
164 error code ELSPROBLEMS
165 error invalid: dompurify@3.2.7 /Users/knoobie/dev/bugs/app/node_modules/dompurify
165 error invalid: ol@6.13.0 /Users/knoobie/dev/bugs/app/node_modules/ol
165 error invalid: rbush@3.0.1 /Users/knoobie/dev/bugs/app/node_modules/rbush
165 error invalid: @lit/react@1.0.8 /Users/knoobie/dev/bugs/app/node_modules/@lit/react
165 error invalid: @types/react-dom@18.3.7 /Users/knoobie/dev/bugs/app/node_modules/@types/react-dom
165 error invalid: @types/react@18.3.24 /Users/knoobie/dev/bugs/app/node_modules/@types/react
165 error invalid: loose-envify@1.4.0 /Users/knoobie/dev/bugs/app/node_modules/loose-envify
166 verbose cwd /Users/knoobie/dev/bugs/app
167 verbose os Darwin 25.0.0
168 verbose node v24.9.0
169 verbose npm  v11.6.0
170 verbose exit 1
171 verbose code 1

System Info

MacOS 26 or Jenkins.. both running NodeJS 24

[ZheSun88]

Thanks for the issue ticket.
I am verifying and can confrim this happens in Vaadin 24 and 25 when running with Node 24 and Npm >= 11.2.0.
we will investigate.

[ZheSun88]

after some investigation, we found this bug is quite related to the failure mentioned here.
the fix has been maded on npm side, which is waiting for the npm 11.6.3 release.

[Artur-]

Created npm/cli#8688

[Artur-]

The problem reproduces with the not-yet-released 11.6.3 also