Skip to main content
Version: 2.x

LTS version

This page details information about the LTS version of Front-Commerce.

Front-Commerce 2.x LTS​

Front-Commerce 2.x has entered Long Term Support (LTS) mode in 2025. This means that since version 2.35.0, only dependencies updates, critical security fixes and bug fixes will be released for this branch by default.

We still maintain the documentation and provide support for this version for a period of 2 years after the LTS date (9th January 2027). We will continue to update dependencies to ensure compatibility with the latest supported versions as long as it is technically possible. However, we will not introduce new major features, and you must be aware that technical limitations may prevent us to update some dependencies or be compatible with the latest Node.js versions.

This version is recommended for all 2.x projects. Front-Commerce 3.x was released in September 2023 and is now the recommended version for new projects. With the 2.x LTS version, we want to ensure that you have enough time to plan and migrate your projects to the latest major version.

Key takeaways
  • Front-Commerce 3.x was released on the 28th September 2023.
  • Front-Commerce 2.x LTS will be maintained until 9th January 2027.
  • We recommend updating your projects to the latest 2.x version and start planning your migration to 3.x if you haven't already.
  • New projects should start with 3.x.

This page details the compatibility and security information for the LTS version, so that you can make an informed decision about your project's update plan. We will keep this page up-to-date with the latest information.

Compatible Node.js versions​

Front-Commerce 2.x is compatible with these Node.js versions:

Dependencies security​

In the LTS version of Front-Commerce, we have practiced a deep security audit of dependencies by using multiple CVE databases.

We went through multiple dependencies update and intensive testing to ensure that the LTS version of Front-Commerce is secure.

Some dependencies are still pinned to specific versions to ensure compatibility with existing code. This page list security issues that couldn't be addressed along with more details on the reason and impacts.

Update your project​

To benefit from these security fixes, please complete these steps

Runtime​

warning

These dependencies are used in production and development environments.

It affects the /graphql endpoint only when using the Upload Scalar type (which is disabled by default in Front-Commerce).

Front-Commerce V2 will stick with Apollo Express Server since it's the core of the HTTP transaction layer for GraphQL queries and mutations.

Front-Commerce V3 has been updated to don't use Apollo anymore, all GraphQL queries are executed server side.

dicer​

dicer is deprecated and isn't maintained anymore. However, it is still used for the Apollo Express Server (responsible for GraphQL queries) and cannot be updated.

Related security advisory:

lodash.pick​

lodash.pick is deprecated and isn't maintained anymore. lodash main package should be used instead. However, one of our GraphQL Fragment tool is using lodash.pick and cannot be updated.

Related security advisory:

Development​

info

These dependencies are only used in development environment and are not used in production. Related security advisories are only applicable to development builds (using NODE_ENV=development).

Front-Commerce V2 will stick with Webpack V4, updating Webpack to latest version isn't possible because it would break compatibility with the current code.

Front-Commerce V3 adressed this issue by switching to Vite bundling system instead of Webpack.

webpack-dev-middleware​

webpack-dev-middleware is still maintained, however the fix for this security issue is available for Webpack 5 and upward, in Front-Commerce V2 we are using Webpack V3 and update this bundling system cannot be done.

Related security advisory:

Developper Experience​

info

These dependencies are only used for Storybook, related security advisories are only applicable when running Storybook (only locally).

Front-Commerce V2 will stick with Storybook V5 due to uncompatibility of current stories with versions upward.

Front-Commerce V3 has been updated to use latest Storybook version.

html-minifier​

html-minifier is deprecated and isn't maintained anymore. It is used for Storybook addon and cannot be updated since we won't be able to use Readme in Storybook if we do.

Related security advisory:

ip​

ip is deprecated and isn't maintained anymore. It is used for the Storyshoot testing system and cannot be updated.

Related security advisory:

marked​

marked is still maintained and can be used. However, Storybook Readme addon is using a legacy version of marked and cannot be updated.

Related security advisories: