Hi :) After ES6's EOL, if another vulnerability if found in Log4J for example, Koha instances using ES won't be able to patch it. Here is the omnibus ticket: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25439 There are *at least* a 1/3 of them that look quite easy. Cheers, -- Victor Grousset/tuxayo