Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Scripts: Update lighthouse dependency #65488

Closed
wants to merge 6 commits into from

Conversation

jacobcassidy
Copy link
Contributor

What?

Updates the lighthouse dependency in the e2e-test-utils-playwright package.

Why?

This fixes the issue with high-severity vulnerabilities introduced with an older version of the puppeteer-core dependency, as mentioned in #64597. Lighthouse uses puppeteer-core and needs to be updated to use the latest version to remove the old dependencies with vulnerabilities.

How?

  • Updates the e2e-test-utils-playwright's package.json lighthouse dependency to the latest version.
  • Removes the lighthouse+10.4.0.patch file the old version depended on.

Testing Instructions

Same as #64597:

  1. Run npm i --save-dev @wordpress/scripts
  2. Run npm audit and you'll see a warning for high-severity vulnerabilities.
  3. Add the following to your package.json file:
"overrides": {
    "puppeteer-core": "^23.1.0"
}
  1. Run npm i to update the packages.
  2. The vulnerabilities are now removed.

Other Notes

  1. I'm not sure this package can be updated with a simple change in this PR. Someone with more familiarity can chime in. Issue Scripts: Deprecated or remove Puppeteer as e2e test handler #60357 mentions puppeteer and its removal, so if that's in progress and includes the e2e-test-utils-playwright package, we can disregard this PR.

  2. The core package.json and package-lock.json may need to be updated to include lighthouse as a dev dependency as was the case for Scripts: Update puppeteer-core dependency #64597.

Copy link

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: jacobcassidy <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@jacobcassidy jacobcassidy marked this pull request as draft September 23, 2024 08:12
@jacobcassidy
Copy link
Contributor Author

Changed to draft until greater insight into if this can be done or if a complete e2e overhaul via #60357 is in the works.

@gziolo gziolo added [Type] Security Related to security concerns or efforts [Status] Stale Gives the original author opportunity to update before closing. Can be reopened as needed. labels Dec 9, 2024
@gziolo
Copy link
Member

gziolo commented Dec 9, 2024

I'm working on #67708, which contains the same changes regarding the lighthouse package. I hope we can resolve these issues before the next npm publishing planned for Wednesday this week.

@jacobcassidy
Copy link
Contributor Author

@gziolo Sounds great. I'm closing this PR since it's already being covered.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
[Status] Stale Gives the original author opportunity to update before closing. Can be reopened as needed. [Type] Security Related to security concerns or efforts
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants