lighthouse 11.1.0-dev.20231001 → 11.1.0-dev.20231003

package/cli/test/smokehouse/__snapshots__/report-assert-test.js.snap

@@ -20,6 +20,10 @@ exports[`getAssertionReport works (multiple failing) 1`] = `
         \\"numericValue\\": 0.13570762803819444,
         \\"numericUnit\\": \\"unitless\\",
         \\"displayValue\\": \\"0.136\\",
+        \\"scoringOptions\\": {
+          \\"p10\\": 0.1,
+          \\"median\\": 0.25
+        },
         \\"details\\": {
           \\"type\\": \\"debugdata\\",
           \\"items\\": [
@@ -46,6 +50,10 @@ exports[`getAssertionReport works (trivial failing) 1`] = `
         \\"numericValue\\": 0.13570762803819444,
         \\"numericUnit\\": \\"unitless\\",
         \\"displayValue\\": \\"0.136\\",
+        \\"scoringOptions\\": {
+          \\"p10\\": 0.1,
+          \\"median\\": 0.25
+        },
         \\"details\\": {
           \\"type\\": \\"debugdata\\",
           \\"items\\": [

package/core/audits/audit.js

@@ -6,7 +6,6 @@
 
 import * as LH from '../../types/lh.js';
 import {isUnderTest} from '../lib/lh-env.js';
-import * as statistics from '../lib/statistics.js';
 import {Util} from '../../shared/util.js';
 
 const DEFAULT_PASS = 'defaultPass';
@@ -105,14 +104,7 @@ class Audit {
    * @return {number}
    */
   static computeLogNormalScore(controlPoints, value) {
-    let percentile = statistics.getLogNormalScore(controlPoints, value);
-    // Add a boost to scores of 90+, linearly ramping from 0 at 0.9 to half a
-    // point (0.005) at 1. Expands scores in (0.9, 1] to (0.9, 1.005], so more top
-    // scores will be a perfect 1 after the two-digit `Math.floor()` rounding below.
-    if (percentile > 0.9) { // getLogNormalScore ensures `percentile` can't exceed 1.
-      percentile += 0.05 * (percentile - 0.9);
-    }
-    return Math.floor(percentile * 100) / 100;
+    return Util.computeLogNormalScore(controlPoints, value);
   }
 
   /**
@@ -411,8 +403,11 @@ class Audit {
       errorMessage: product.errorMessage,
       errorStack: product.errorStack,
       warnings: product.warnings,
+      scoringOptions: product.scoringOptions,
+      metricSavings: product.metricSavings,
 
       details: product.details,
+      guidanceLevel: audit.meta.guidanceLevel,
     };
   }
 

package/core/audits/byte-efficiency/uses-long-cache-ttl.js

@@ -9,7 +9,7 @@ import parseCacheControl from 'parse-cache-control';
 import {Audit} from '../audit.js';
 import {NetworkRequest} from '../../lib/network-request.js';
 import UrlUtils from '../../lib/url-utils.js';
-import {linearInterpolation} from '../../lib/statistics.js';
+import {linearInterpolation} from '../../../shared/statistics.js';
 import * as i18n from '../../lib/i18n/i18n.js';
 import {NetworkRecords} from '../../computed/network-records.js';
 

package/core/audits/csp-xss.js

@@ -21,7 +21,7 @@ const UIStrings = {
   /** Summary text for the results of a Lighthouse audit that evaluates the security of a page's CSP. This is displayed if no CSP is being enforced. "CSP" stands for "Content Security Policy". "CSP" does not need to be translated. */
   noCsp: 'No CSP found in enforcement mode',
   /** Message shown when one or more CSPs are defined in a <meta> tag. Shown in a table with a list of other CSP bypasses and warnings. "CSP" stands for "Content Security Policy". "CSP" and "HTTP" do not need to be translated. */
-  metaTagMessage: 'The page contains a CSP defined in a <meta> tag. ' +
+  metaTagMessage: 'The page contains a CSP defined in a `<meta>` tag. ' +
     'Consider moving the CSP to an HTTP header or ' +
     'defining another strict CSP in an HTTP header.',
   /** Label for a column in a data table; entries will be a directive of a CSP. "CSP" stands for "Content Security Policy". */

package/core/audits/installable-manifest.js

@@ -39,9 +39,9 @@ const UIStrings = {
   /** Error message explaining that the provided manifest URL is invalid. */
   'start-url-not-valid': `Manifest start URL is not valid`,
   /** Error message explaining that the provided manifest does not contain a name or short_name field. */
-  'manifest-missing-name-or-short-name': `Manifest does not contain a 'name' or 'short_name' field`,
+  'manifest-missing-name-or-short-name': 'Manifest does not contain a `name` or `short_name` field',
   /** Error message explaining that the manifest display property must be one of 'standalone', 'fullscreen', or 'minimal-ui'. */
-  'manifest-display-not-supported': `Manifest 'display' property must be one of 'standalone', 'fullscreen', or 'minimal-ui'`,
+  'manifest-display-not-supported': 'Manifest `display` property must be one of `standalone`, `fullscreen`, or `minimal-ui`',
   /** Error message explaining that the manifest could not be fetched, might be empty, or could not be parsed. */
   'manifest-empty': `Manifest could not be fetched, is empty, or could not be parsed`,
   /**

package/core/audits/metrics/cumulative-layout-shift.js

@@ -62,11 +62,14 @@ class CumulativeLayoutShift extends Audit {
       items: [rest],
     };
 
+    const scoringOptions = {p10: context.options.p10, median: context.options.median};
+
     return {
       score: Audit.computeLogNormalScore(
-        {p10: context.options.p10, median: context.options.median},
+        scoringOptions,
         cumulativeLayoutShift
       ),
+      scoringOptions,
       numericValue: cumulativeLayoutShift,
       numericUnit: 'unitless',
       displayValue: cumulativeLayoutShift.toLocaleString(context.settings.locale),

package/core/audits/metrics/first-contentful-paint.js

@@ -74,6 +74,7 @@ class FirstContentfulPaint extends Audit {
         options.scoring,
         metricResult.timing
       ),
+      scoringOptions: options.scoring,
       numericValue: metricResult.timing,
       numericUnit: 'millisecond',
       displayValue: str_(i18n.UIStrings.seconds, {timeInMs: metricResult.timing}),

package/core/audits/metrics/largest-contentful-paint.js

@@ -83,6 +83,7 @@ class LargestContentfulPaint extends Audit {
         options.scoring,
         metricResult.timing
       ),
+      scoringOptions: options.scoring,
       numericValue: metricResult.timing,
       numericUnit: 'millisecond',
       displayValue: str_(i18n.UIStrings.seconds, {timeInMs: metricResult.timing}),

package/core/audits/metrics/speed-index.js

@@ -77,6 +77,7 @@ class SpeedIndex extends Audit {
         options.scoring,
         metricResult.timing
       ),
+      scoringOptions: options.scoring,
       numericValue: metricResult.timing,
       numericUnit: 'millisecond',
       displayValue: str_(i18n.UIStrings.seconds, {timeInMs: metricResult.timing}),

package/core/audits/metrics/total-blocking-time.js

@@ -107,6 +107,7 @@ class TotalBlockingTime extends Audit {
         options.scoring,
         metricResult.timing
       ),
+      scoringOptions: options.scoring,
       numericValue: metricResult.timing,
       numericUnit: 'millisecond',
       displayValue: str_(i18n.UIStrings.ms, {timeInMs: metricResult.timing}),

package/core/lib/csp-evaluator.js

@@ -19,31 +19,31 @@ import {isIcuMessage} from '../../shared/localization/format.js';
 
 const UIStrings = {
   /** Message shown when a CSP does not have a base-uri directive. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "base-uri", "'none'", and "'self'" do not need to be translated. */
-  missingBaseUri: 'Missing base-uri allows injected <base> tags to set the base URL for all ' +
+  missingBaseUri: 'Missing `base-uri` allows injected `<base>` tags to set the base URL for all ' +
     'relative URLs (e.g. scripts) to an attacker controlled domain. ' +
-    'Consider setting base-uri to \'none\' or \'self\'.',
+    'Consider setting `base-uri` to `\'none\'` or `\'self\'`.',
   /** Message shown when a CSP does not have a script-src directive. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "script-src" does not need to be translated. */
-  missingScriptSrc: 'script-src directive is missing. ' +
+  missingScriptSrc: '`script-src` directive is missing. ' +
     'This can allow the execution of unsafe scripts.',
   /** Message shown when a CSP does not have a script-src directive. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "object-src" and "'none'" do not need to be translated. */
-  missingObjectSrc: 'Missing object-src allows the injection of plugins ' +
-    'that execute unsafe scripts. Consider setting object-src to \'none\' if you can.',
+  missingObjectSrc: 'Missing `object-src` allows the injection of plugins ' +
+    'that execute unsafe scripts. Consider setting `object-src` to `\'none\'` if you can.',
   /** Message shown when a CSP uses a domain allowlist to filter out malicious scripts. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "CSP", "'strict-dynamic'", "nonces", and "hashes" do not need to be translated. "allowlists" can be interpreted as "whitelist". */
   strictDynamic: 'Host allowlists can frequently be bypassed. Consider using ' +
-    'CSP nonces or hashes instead, along with \'strict-dynamic\' if necessary.',
+    'CSP nonces or hashes instead, along with `\'strict-dynamic\'` if necessary.',
   /** Message shown when a CSP allows inline scripts to be run in the page. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "CSP", "'unsafe-inline'", "nonces", and "hashes" do not need to be translated. */
-  unsafeInline: '\'unsafe-inline\' allows the execution of unsafe in-page scripts ' +
+  unsafeInline: '`\'unsafe-inline\'` allows the execution of unsafe in-page scripts ' +
     'and event handlers. Consider using CSP nonces or hashes to allow scripts individually.',
   /** Message shown when a CSP is not backwards compatible with browsers that do not support CSP nonces/hashes. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "'unsafe-inline'", "nonces", and "hashes" do not need to be translated. */
-  unsafeInlineFallback: 'Consider adding \'unsafe-inline\' (ignored by browsers supporting ' +
+  unsafeInlineFallback: 'Consider adding `\'unsafe-inline\'` (ignored by browsers supporting ' +
     'nonces/hashes) to be backward compatible with older browsers.',
   /** Message shown when a CSP is not backwards compatible with browsers that do not support the 'strict-dynamic' keyword. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "http:", "https:", and "'strict-dynamic'" do not need to be translated. */
   allowlistFallback: 'Consider adding https: and http: URL schemes (ignored by browsers ' +
-    'supporting \'strict-dynamic\') to be backward compatible with older browsers.',
+    'supporting `\'strict-dynamic\'`) to be backward compatible with older browsers.',
   /** Message shown when a CSP only provides a reporting destination through the report-to directive. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "report-to", "report-uri", and "Chromium" do not need to be translated. */
   reportToOnly: 'The reporting destination is only configured via the report-to directive. ' +
     'This directive is only supported in Chromium-based browsers so it is ' +
-    'recommended to also use a report-uri directive.',
+    'recommended to also use a `report-uri` directive.',
   /** Message shown when a CSP does not provide a reporting destination. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "CSP" does not need to be translated. */
   reportingDestinationMissing: 'No CSP configures a reporting destination. ' +
     'This makes it difficult to maintain the CSP over time and monitor for any breakages.',
@@ -65,13 +65,13 @@ const UIStrings = {
    */
   unknownKeyword: '{keyword} seems to be an invalid keyword.',
   /** Message shown when a CSP uses the deprecated reflected-xss directive. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "reflected-xss", "CSP2" and "X-XSS-Protection" do not need to be translated. */
-  deprecatedReflectedXSS: 'reflected-xss is deprecated since CSP2. ' +
+  deprecatedReflectedXSS: '`reflected-xss` is deprecated since CSP2. ' +
     'Please, use the X-XSS-Protection header instead.',
   /** Message shown when a CSP uses the deprecated referrer directive. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "referrer", "CSP2" and "Referrer-Policy" do not need to be translated. */
-  deprecatedReferrer: 'referrer is deprecated since CSP2. ' +
+  deprecatedReferrer: '`referrer` is deprecated since CSP2. ' +
     'Please, use the Referrer-Policy header instead.',
   /** Message shown when a CSP uses the deprecated disown-opener directive. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy". "disown-opener", "CSP3" and "Cross-Origin-Opener-Policy" do not need to be translated. */
-  deprecatedDisownOpener: 'disown-opener is deprecated since CSP3. ' +
+  deprecatedDisownOpener: '`disown-opener` is deprecated since CSP3. ' +
     'Please, use the Cross-Origin-Opener-Policy header instead.',
   /**
    * @description Message shown when a CSP wildcard allows unsafe scripts to be run in the page. Shown in a table with a list of other CSP vulnerabilities and suggestions. "CSP" stands for "Content Security Policy".