[vesameskanen]

Summary

• Bumps Dockerfile.base from node:18-bullseye (EOL since April 2025) to node:22-bookworm.
• Swaps the removed python transitional package for python-is-python3 (bookworm dropped it).
• Wraps the libpostal clone/build/install in a 5x retry loop. Root cause of the historic "GitHub rate limit" build failures: libpostal_data fetches ~2GB of language model data as GitHub Release assets via 12 parallel curl workers, which intermittently trips GitHub's abuse/rate limiting.
• Bumps pelias-logger to ^2.0.0 to match the version already used by all HSL importer forks (pelias-schema, openstreetmap, pelias-vrk, pelias-nlsfi-places-importer, pelias-gtfs, bikes-pelias). Its only breaking change is requiring Node >=22, which we now have.
• Pins node-postal to 1.3.0 via yarn resolutions. The version transitively resolved through pelias-text-analyzer (1.1.2) used a V8 API (Object::CreationContext) that was removed in the V8 build bundled with Node 22, breaking the native addon compile. 1.3.0 supports both old and new Node/V8 versions.
• Refreshed yarn.lock-resolved patch/minor versions for express, morgan, lodash, pelias-labels, pelias-sorting, pelias-mock-logger (no package.json range changes needed; yarn.lock isn't tracked in this repo).

Testing

• Built hsldevcom/libpostal:test from the updated Dockerfile.base locally and confirmed a successful build (after ruling out an unrelated local Zscaler-proxy TLS interception issue).
• Built pelias-api on top of the new base and confirmed it boots without native-addon errors.
• Pulled hsldevcom/pelias-data-container:latest (today's build, real Elasticsearch 7.16.2 with the full production dataset) and ran the API against it with 12 real searches across autocomplete/search/reverse (Helsinki, Espoo, Tampere, Turku, Oulu, Vaasa) — all returned HTTP 200 with correct top results.
• Confirmed the pre-existing test/unit failure (autocomplete_token_matching_permutations.js, missing module from the pelias-query fork) and the jshint lint errors in controller/search.js, middleware/confidenceScoreDT.js, middleware/translate.js both already exist on master and are unrelated to this change.
• Pushed the rebuilt base image to hsldevcom/libpostal:latest on Docker Hub (manual push, using local Docker Hub login — CI still doesn't automate this step).

Not in scope for this PR

• Major version bumps for other outdated deps (pelias-config, pelias-model, pelias-parser, joi, express 5, etc.) — riskier, would need separate testing.
• Automating the base image build/push in CI (like pelias-data-container does) — the base image build/push is still a manual local step; happy to follow up with a separate PR for that if wanted.
• Note: node_modules/precommit-hook's own install lifecycle script unconditionally rewrites package.json (injecting a "pre-commit" array and reformatting the file) on every yarn install/npm install. Watch for this when re-running installs locally on this branch — diff package.json before committing.