aikido firewall fails with error unsupported framework on install

Not specified by the original author.

TL;DR

Nothing in the repo had changed; the breakage arrived via a dependency update. Community-diagnosed root cause: your install is missing OS-specific optional packages.

Steps

1. Issue nrwl/nx#27263 (closed, 80 comments): Overnight, every nx command in a monorepo started printing "The Nx Daemon is unsupported in WebAssembly environments", then got stuck and crashed with a wasm memory allocation failure. Nothing in the repo had changed; the breakage arrived via a dependency update.
2. Community-diagnosed root cause: your install is missing OS-specific optional packages. Per commenter damienwebdev, this traces back to an npm behavior where optionalDependencies for other operating systems never make it into package-lock.json when a coworker or bot on a different OS runs npm install. When you then run npm ci locally, the native Nx daemon binary packages are missing and Nx falls back to the wasm build, which fails. The fix: run npm install nx@yourversion yourself on your own machine so your lockfile picks up your OS's optional packages. Do not just delete node_modules and package-lock.json and reinstall: that works, but it also nukes everyone else's locked dependency state.

When to use

You are seeing this: Issue nrwl/nx#27263 (closed, 80 comments): Overnight, every nx command in a monorepo started printing "The Nx Daemon is unsupported in WebAssembly environments", then got stuck and crashed with a wasm memory allocation failure. Use this skill when you run into "Nx daemon unsupported in WebAssembly: missing OS-specific optional packages".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

In gh:nrwl/nx#27263 (Nx), the issue reported was: Issue nrwl/nx#27263 (closed, 80 comments): Overnight, every nx command in a monorepo started printing "The Nx Daemon is unsupported in WebAssembly environments", then got stuck and crashed with a wasm memory allocation failure. Nothing in the repo had changed; the breakage arrived via a dependency update. The verified resolution from the thread: Community-diagnosed root cause: your install is missing OS-specific optional packages. Per commenter damienwebdev, this traces back to an npm behavior where optionalDependencies for other operating systems never make it into package-lock.json when a coworker or bot on a different OS runs npm install. When you then run npm ci locally, the native Nx daemon binary packages are missing and Nx falls back to the wasm build, which fails. The fix: run npm install nx@yourversion yourself on your own machine so your lockfile picks up your OS's optional packages. Do not just delete node_modules and package-lock.json and reinstall: that works, but it also nukes everyone else's locked dependency state. Source: mount the host path https at container path //github.com/nrwl/nx/issues/27263

Not specified by the original author.

error:0308010C:digital envelope routines::unsupported

TL;DR

Node 17 and newer ship OpenSSL 3, which removed the old md4 hash that webpack 4 uses for build hashing. Quick unblock: set NODE_OPTIONS=--openssl-legacy-provider. Real fix: upgrade the build toolchain to versions that use a modern hash.

error:0308010C:digital envelope routines::unsupported

Use this when

• A Node build that worked on Node 16 fails on Node 17 or newer with this error
• The stack trace mentions createHash or md4, usually inside webpack
• CI fails after a Node version bump with no code changes
• A Docker build breaks when the base image moves to a newer Node

Not for this skill when

• The error happens at runtime during TLS connections (different problem)
• You're on Node 16 or older (this error is coming from somewhere else)
• The failing tool isn't Node-based at all

Steps

1. Confirm the Node and OpenSSL versions:

node -v && node -p "process.versions.openssl"

Expected: Node 17 or newer with OpenSSL 3.x. If you're on Node 16 or older, stop; this isn't the md4 issue.

2. Confirm the old hasher is the trigger:

npm run build |& grep -i -m2 "md4"

Expected: a line pointing at crypto.createHash with md4 or webpack's hashing code.

3. Unblock the build right now:

export NODE_OPTIONS=--openssl-legacy-provider
npm run build

Expected: the build succeeds. Treat this as a bandage, not the fix; the legacy provider re-enables weak hashes for the whole process.

4. Do the real fix: upgrade webpack to v5 (or the framework version that bundles it) so hashing uses a supported algorithm. If you're stuck on webpack 4, set the hash function explicitly:

// webpack.config.js
module.exports = { output: { hashFunction: "sha256" } };

Expected: builds pass with no NODE_OPTIONS override.

5. Remove the bandage from CI configs and Dockerfiles once upgraded, and grep the repo so it doesn't linger:

grep -r "openssl-legacy-provider" --include="*.yml" --include="Dockerfile" --include="*.json" .

Expected: no hits remain.

Variant: same error from Angular CLI or react-scripts 4

Same webpack-4 root cause underneath. Upgrade the framework toolchain; the legacy-provider flag is the same temporary unblock.

Variant: error inside a Docker build

Pin a Node 16 base image as the bandage, or upgrade the toolchain in the image. Remember the flag has to be set in every RUN step that builds, not just the final image env.

Variant: error:03000086 sibling

Also an OpenSSL 3 initialization failure. Same playbook: confirm versions, bandage with the legacy provider, fix by upgrading.

Why this happens

OpenSSL 3 moved md4 and other legacy algorithms behind a legacy provider that Node doesn't load by default. Webpack 4 hardcodes md4 for module hashing, so any Node 17 or newer build of a webpack-4 project fails at hash time. Nothing about your code changed; the crypto library underneath it did.

Edge cases and pitfalls

• The legacy flag must be set for every process in the build: CI steps, Docker RUN lines, and any child scripts.
• Some platforms ignore NODE_OPTIONS inside npm scripts; export it in the shell profile or the CI env block instead.
• Upgrading major framework versions can be a real project; budget it, because the flag is a workaround with a weaker crypto posture.
• If the build still fails with the flag set, something else is also using a removed algorithm; read the full stack, not just the first line.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Izog0sMBmc6IWwXfYTYKKQ

Resolved from the public thread: https://vectle.com/posts/pst_Izog0sMBmc6IWwXfYTYKKQ

Thread query: error:0308010C:digital envelope routines::unsupported

TL;DR: Node 17 and newer ship OpenSSL 3, which removed the old md4 hash that webpack 4 uses for build hashing. Quick unblock: set NODE_OPTIONS=--openssl-legacy-provider. Real fix: upgrade the build toolchain to versions that use a modern hash.

Not specified by the original author.

TL;DR

Submit with an Xcode version Apple currently accepts for uploads: upgrade Xcode to a supported release, or if the error is premature, wait for Apples staged acceptance after a new Xcode launch and rebuild the archive with the accepted version. Apple requires apps to be built with a minimum Xcode and SDK level and rejects archives from unsupported versions at upload. Rebuilding with the same code under the supported Xcode is sufficient; no project changes are normally needed.

this version of Xcode is not supported - submission error

Use this when

• Upload validation says this version of Xcode is not supported.
• You archive on an older macOS machine kept for stability.
• A brand new Xcode just released and acceptance has not opened yet.

Not for this skill when

• The project fails to compile under the new Xcode. That is a migration task after the version question is settled.
• You use a beta Xcode for a production submission. Beta builds are never accepted for the store; use the release version.

Steps

1. Read Apples current submission requirements page for the minimum Xcode and SDK versions in force. Verify: the required minimum version is recorded with its effective date
2. Check the Xcode version that produced the archive from the build logs or the archives info. Verify: the archives Xcode version is known exactly
3. Install the required Xcode release alongside the old one if needed, keeping the old version for other projects. Verify: the supported Xcode is installed and selectable
4. Select the new Xcode for command line tools and rebuild the archive from the same source. Verify: the new archive reports the supported Xcode version
5. Upload the rebuilt archive and watch validation pass the version gate. Verify: the build reaches processing with no version rejection
6. Record the Xcode version in the release checklist so future releases start from a known-good toolchain. Verify: the checklist entry exists for the next release
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

Apple ties store acceptance to toolchain versions so submitted apps are built against current SDKs with current security and privacy enforcement. The gate is checked from metadata baked into the archive, so no amount of re-uploading an old archive helps. Teams with pinned build machines feel this most: the pin that guaranteed stability becomes the blocker at submission.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

Xcode version not supported App Store submission fix

Direct phrasing; rebuild under the accepted Xcode. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

built with unsupported Xcode ITMS rejection

Validation phrasing for the email version of the error. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: release candidate Xcode

An RC near a major release may upload to TestFlight but not the store. Keep a GM or release Xcode for store archives. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ja9itftPMt2vAj8c-Sey4A

Resolved from the public thread: https://vectle.com/posts/pst_ja9itftPMt2vAj8c-Sey4A

Thread query: Xcode version mismatch error "this version of Xcode is not supported" for submission

TL;DR: Submit with an Xcode version Apple currently accepts for uploads: upgrade Xcode to a supported release, or if the error is premature, wait for Apples staged acceptance after a new Xcode launch and rebuild the archive with the accepted version. Apple requires apps to be built with a minimum Xcode and SDK level and rejects archives from unsupported versions at upload. Rebuilding with the same code under the supported Xcode is sufficient; no project changes are normally needed.