Allow terser-webpack-plugin to work with Node 18+ and webpack 4 default hashes without openssl-legacy-provider

[chadlwilson]

Modification Proposal

Recently webpack 4.47.0 released a fix to allow it to work with Node 18+ without use of the openssl-legacy-provider which is required due to use of some legacy crypto stuff.

Unfortunately terser-webpack-plugin as depended on by webpack 4 currently seems to also rely on the same crypto logic. I believe terser's usage of the functions is similar to webpack 4's.

Would you be open to a similar PR to webpack/webpack#17628 and releasing a version which removes dependency on this, for folks for whom the webpack 5 upgrade takes quite a while? The motivation is pretty well articulated in webpack/webpack#17628 (comment) given heavy use of Webpack 4 and Node 16 EOL.

Please excuse my ignorance if I have missed a way to change the hashFunction in a way that works around this without downsides.

Expected Behavior / Situation

terser-webpack-plugin 4.x works with Node 18/20 without use of NODE_OPTIONS=--openssl-legacy-provider

Actual Behavior / Situation

Currently with Node 18 and terser-webpack-plugin as transitive dependency from webpack 4.47.0, WITHOUT the above flag you will get errors like

ERROR in vendor-and-helpers.chunk-57990a41e25b3ea9c477.js from Terser
Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:69:19)
    at Object.createHash (node:crypto:133:10)
    at /go/pipelines/installers/server/src/main/webapp/WEB-INF/rails/node_modules/terser-webpack-plugin/dist/index.js:217:37
    at Array.forEach (<anonymous>)
    at TerserPlugin.optimizeFn (/go/pipelines/installers/server/src/main/webapp/WEB-INF/rails/node_modules/terser-webpack-plugin/dist/index.js:160:259)
    at AsyncSeriesHook.eval [as callAsync] (eval at create (/go/pipelines/installers/server/src/main/webapp/WEB-INF/rails/node_modules/tapable/lib/HookCodeFactory.js:33:10), <anonymous>:7:1)
    at AsyncSeriesHook.lazyCompileHook (/go/pipelines/installers/server/src/main/webapp/WEB-INF/rails/node_modules/tapable/lib/Hook.js:154:20)
    at /go/pipelines/installers/server/src/main/webapp/WEB-INF/rails/node_modules/webpack/lib/Compilation.js:1409:36
    at eval (eval at create (/go/pipelines/installers/server/src/main/webapp/WEB-INF/rails/node_modules/tapable/lib/HookCodeFactory.js:33:10), <anonymous>:14:1)

Please paste the results of npx webpack-cli info here, and mention other relevant information

System:
    OS: macOS 13.5.2
    CPU: (10) arm64 Apple M1 Pro
    Memory: 78.02 MB / 16.00 GB
  Binaries:
    Node: 18.17.1 - ~/.local/share/rtx/installs/node/18.17.1/bin/node
    Yarn: 3.6.3 - /opt/homebrew/bin/yarn
    npm: 9.6.7 - ~/.local/share/rtx/installs/node/18.17.1/bin/npm
  Browsers:
    Chrome: 115.0.5790.114
    Safari: 16.6
  Packages:
    babel-loader: ^8.3.0 => 8.3.0
    cache-loader: ^4.1.0 => 4.1.0
    clean-webpack-plugin: ^4.0.0 => 4.0.0
    css-loader: ^5.2.7 => 5.2.7
    eslint-webpack-plugin: ^2.7.0 => 2.7.0
    file-loader: ^6.2.0 => 6.2.0
    fork-ts-checker-webpack-plugin: ^6.5.3 => 6.5.3
    html-webpack-plugin: ^4.5.2 => 4.5.2
    karma-sourcemap-loader: ^0.4.0 => 0.4.0
    optimize-css-assets-webpack-plugin: ^6.0.1 => 6.0.1
    sass-loader: ^10.4.1 => 10.4.1
    speed-measure-webpack-plugin: ^1.5.0 => 1.5.0
    stats-webpack-plugin: ^0.7.0 => 0.7.0
    style-loader: ^2.0.0 => 2.0.0
    stylelint-webpack-plugin: ^2.5.0 => 2.5.0
    thread-loader: ^3.0.4 => 3.0.4
    ts-loader: ^8.4.0 => 8.4.0
    unused-webpack-plugin: ^2.4.0 => 2.4.0
    url-loader: ^4.1.1 => 4.1.1
    webpack: ^4.47.0 => 4.47.0
    webpack-build-notifier: ^2.3.0 => 2.3.0
    webpack-cli: ^4.10.0 => 4.10.0

[chadlwilson]

Actually, I may have gotten confused here, as I seem to have a dependency on terser-webpack-plugin@^1.4.3 (1.4.5) via webpack 4.47.0 itself rather than my own dependency. Perhaps it's possible to address this in a different way, with some kind of forced resolution dependency.

$ yarn why terser-webpack-plugin
├─ webpack@npm:4.47.0
│  └─ terser-webpack-plugin@npm:1.4.5 (via npm:^1.4.3)
│
├─ webpack@npm:5.88.2
│  └─ terser-webpack-plugin@npm:5.3.9 (via npm:^5.3.7)
│
├─ webpack@npm:4.47.0 [491e3]
│  └─ terser-webpack-plugin@npm:1.4.5 [6db9f] (via npm:^1.4.3 [6db9f])
│
└─ webpack@npm:5.88.2 [54142]
   └─ terser-webpack-plugin@npm:5.3.9 [e5b77] (via npm:^5.3.7 [e5b77])

On the face of it, I seem to have been able to workaround this with a Yarn Berry/4.x forced resolution dependency so the change might need to be in webpack 4 itself (if anywhere) but will see if it causes any other ill side effects by force upgrading terser-webpack-plugin in such a way.

  "resolutions": {
    "webpack@npm:4.47.0/terser-webpack-plugin": "^4.2.3"
  },

[chadlwilson]

Going to close this for now, as it seems on the face of it, that this works fine with terser-webpack-plugin 4.x and the issue is terser-weback-plugin 1.x which is very old.

[chadlwilson]

And there's even a PR to fix this at webpack/webpack#17659 - missed it somehow. Oops.