Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Scripts: Update lighthouse dependency #65488

Open
wants to merge 3 commits into
base: trunk
Choose a base branch
from

Conversation

jacobcassidy
Copy link
Contributor

What?

Updates the lighthouse dependency in the e2e-test-utils-playwright package.

Why?

This fixes the issue with high-severity vulnerabilities introduced with an older version of the puppeteer-core dependency, as mentioned in #64597. Lighthouse uses puppeteer-core and needs to be updated to use the latest version to remove the old dependencies with vulnerabilities.

How?

  • Updates the e2e-test-utils-playwright's package.json lighthouse dependency to the latest version.
  • Removes the lighthouse+10.4.0.patch file the old version depended on.

Testing Instructions

Same as #64597:

  1. Run npm i --save-dev @wordpress/scripts
  2. Run npm audit and you'll see a warning for high-severity vulnerabilities.
  3. Add the following to your package.json file:
"overrides": {
    "puppeteer-core": "^23.1.0"
}
  1. Run npm i to update the packages.
  2. The vulnerabilities are now removed.

Other Notes

  1. I'm not sure this package can be updated with a simple change in this PR. Someone with more familiarity can chime in. Issue Scripts: Deprecated or remove Puppeteer as e2e test handler #60357 mentions puppeteer and its removal, so if that's in progress and includes the e2e-test-utils-playwright package, we can disregard this PR.

  2. The core package.json and package-lock.json may need to be updated to include lighthouse as a dev dependency as was the case for Scripts: Update puppeteer-core dependency #64597.

Copy link

Warning: Type of PR label mismatch

To merge this PR, it requires exactly 1 label indicating the type of PR. Other labels are optional and not being checked here.

  • Type-related labels to choose from: [Type] Automated Testing, [Type] Breaking Change, [Type] Bug, [Type] Build Tooling, [Type] Code Quality, [Type] Copy, [Type] Developer Documentation, [Type] Enhancement, [Type] Experimental, [Type] Feature, [Type] New API, [Type] Task, [Type] Technical Prototype, [Type] Performance, [Type] Project Management, [Type] Regression, [Type] Security, [Type] WP Core Ticket, Backport from WordPress Core.
  • Labels found: .

Read more about Type labels in Gutenberg. Don't worry if you don't have the required permissions to add labels; the PR reviewer should be able to help with the task.

Copy link

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: jacobcassidy <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant