-
Notifications
You must be signed in to change notification settings - Fork 4.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Scripts: Update lighthouse
dependency
#65488
base: trunk
Are you sure you want to change the base?
Conversation
Warning: Type of PR label mismatch To merge this PR, it requires exactly 1 label indicating the type of PR. Other labels are optional and not being checked here.
Read more about Type labels in Gutenberg. Don't worry if you don't have the required permissions to add labels; the PR reviewer should be able to help with the task. |
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.
To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Changed to draft until greater insight into if this can be done or if a complete e2e overhaul via #60357 is in the works. |
What?
Updates the
lighthouse
dependency in thee2e-test-utils-playwright
package.Why?
This fixes the issue with high-severity vulnerabilities introduced with an older version of the
puppeteer-core
dependency, as mentioned in #64597. Lighthouse uses puppeteer-core and needs to be updated to use the latest version to remove the old dependencies with vulnerabilities.How?
package.json
lighthouse dependency to the latest version.lighthouse+10.4.0.patch
file the old version depended on.Testing Instructions
Same as #64597:
npm i --save-dev @wordpress/scripts
npm audit
and you'll see a warning for high-severity vulnerabilities.npm i
to update the packages.Other Notes
I'm not sure this package can be updated with a simple change in this PR. Someone with more familiarity can chime in. Issue Scripts: Deprecated or remove Puppeteer as e2e test handler #60357 mentions puppeteer and its removal, so if that's in progress and includes the
e2e-test-utils-playwright
package, we can disregard this PR.The core package.json and package-lock.json may need to be updated to include lighthouse as a dev dependency as was the case for Scripts: Update
puppeteer-core
dependency #64597.