lighthouse 12.3.0 → 12.4.0-dev.20250227

package/cli/test/smokehouse/core-tests.js

@@ -7,6 +7,8 @@
 import a11y from './test-definitions/a11y.js';
 import byteEfficiency from './test-definitions/byte-efficiency.js';
 import byteGzip from './test-definitions/byte-gzip.js';
+import clickjackingMissingHeaders from './test-definitions/clickjacking-missing-headers.js';
+import clickjackingMitigationPresent from './test-definitions/clickjacking-mitigation-headers-present.js';
 import crash from './test-definitions/crash.js';
 import cspAllowAll from './test-definitions/csp-allow-all.js';
 import cspBlockAll from './test-definitions/csp-block-all.js';
@@ -69,6 +71,8 @@ const smokeTests = [
   a11y,
   byteEfficiency,
   byteGzip,
+  clickjackingMissingHeaders,
+  clickjackingMitigationPresent,
   crash,
   cspAllowAll,
   cspBlockAll,

package/core/audits/audit.d.ts

@@ -66,6 +66,11 @@ export class Audit {
      * @param {LH.Audit.Details.Opportunity['items']|LH.Audit.Details.Table['items']} items
      */
     static assertHeadingKeysExist(headings: LH.Audit.Details.Table["headings"] | LH.Audit.Details.Opportunity["headings"], items: LH.Audit.Details.Opportunity["items"] | LH.Audit.Details.Table["items"]): void;
+    /**
+     * @param {LH.Audit.Details.Checklist['items']} items
+     * @return {LH.Audit.Details.Checklist}
+     */
+    static makeChecklistDetails(items: LH.Audit.Details.Checklist["items"]): LH.Audit.Details.Checklist;
     /**
      * @param {LH.Audit.Details.Table['headings']} headings
      * @param {LH.Audit.Details.Table['items']} results

package/core/audits/audit.js

@@ -140,6 +140,17 @@ class Audit {
     }
   }
 
+  /**
+   * @param {LH.Audit.Details.Checklist['items']} items
+   * @return {LH.Audit.Details.Checklist}
+   */
+  static makeChecklistDetails(items) {
+    return {
+      type: 'checklist',
+      items,
+    };
+  }
+
   /**
    * @param {LH.Audit.Details.Table['headings']} headings
    * @param {LH.Audit.Details.Table['items']} results
@@ -467,6 +478,7 @@ class Audit {
 
       details: product.details,
       guidanceLevel: audit.meta.guidanceLevel,
+      replacesAudits: audit.meta.replacesAudits,
     };
   }
 

package/core/audits/bootup-time.js

@@ -14,7 +14,6 @@ import {MainThreadTasks} from '../computed/main-thread-tasks.js';
 import {getExecutionTimingsByURL} from '../lib/tracehouse/task-summary.js';
 import {TBTImpactTasks} from '../computed/tbt-impact-tasks.js';
 import {Sentry} from '../lib/sentry.js';
-import {Util} from '../../shared/util.js';
 
 const UIStrings = {
   /** Title of a diagnostic audit that provides detail on the time spent executing javascript files during the load. This descriptive title is shown to users when the amount is acceptable and no user action is required. */
@@ -173,7 +172,6 @@ class BootupTime extends Audit {
 
     return {
       score,
-      scoreDisplayMode: score >= Util.PASS_THRESHOLD ? Audit.SCORING_MODES.INFORMATIVE : undefined,
       notApplicable: !results.length,
       numericValue: totalBootupTime,
       numericUnit: 'millisecond',

package/core/audits/byte-efficiency/duplicated-javascript.d.ts

@@ -26,11 +26,10 @@ declare class DuplicatedJavascript extends ByteEfficiencyAudit {
         resourceSize: number;
     }[]>>;
     /**
-     * This audit highlights JavaScript modules that appear to be duplicated across all resources,
-     * either within the same bundle or between different bundles. Each details item returned is
-     * a module with subItems for each resource that includes it. The wastedBytes for the details
-     * item is the number of bytes occupied by the sum of all but the largest copy of the module.
-     * wastedBytesByUrl attributes the cost of the bytes to a specific resource, for use by lantern.
+     * Each details item returned is a module with subItems for each resource that
+     * includes it. The wastedBytes for the details item is the number of bytes
+     * occupied by the sum of all but the largest copy of the module. wastedBytesByUrl
+     * attributes the cost of the bytes to a specific resource, for use by lantern.
      * @param {LH.Artifacts} artifacts
      * @param {Array<LH.Artifacts.NetworkRequest>} networkRecords
      * @param {LH.Audit.Context} context

package/core/audits/byte-efficiency/duplicated-javascript.js

@@ -4,6 +4,11 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+/**
+ * @fileoverview This audit highlights JavaScript modules that appear to be duplicated across
+ * all resources, either within the same bundle or between different bundles.
+ */
+
 /** @typedef {import('./byte-efficiency-audit.js').ByteEfficiencyProduct} ByteEfficiencyProduct */
 /** @typedef {LH.Audit.ByteEfficiencyItem & {source: string, subItems: {type: 'subitems', items: SubItem[]}}} Item */
 /** @typedef {{url: string, sourceTransferBytes?: number}} SubItem */
@@ -104,11 +109,10 @@ class DuplicatedJavascript extends ByteEfficiencyAudit {
   }
 
   /**
-   * This audit highlights JavaScript modules that appear to be duplicated across all resources,
-   * either within the same bundle or between different bundles. Each details item returned is
-   * a module with subItems for each resource that includes it. The wastedBytes for the details
-   * item is the number of bytes occupied by the sum of all but the largest copy of the module.
-   * wastedBytesByUrl attributes the cost of the bytes to a specific resource, for use by lantern.
+   * Each details item returned is a module with subItems for each resource that
+   * includes it. The wastedBytes for the details item is the number of bytes
+   * occupied by the sum of all but the largest copy of the module. wastedBytesByUrl
+   * attributes the cost of the bytes to a specific resource, for use by lantern.
    * @param {LH.Artifacts} artifacts
    * @param {Array<LH.Artifacts.NetworkRequest>} networkRecords
    * @param {LH.Audit.Context} context

package/core/audits/byte-efficiency/legacy-javascript.d.ts

@@ -50,11 +50,10 @@ declare class LegacyJavascript extends ByteEfficiencyAudit {
      *
      * @param {CodePatternMatcher} matcher
      * @param {LH.Artifacts['Scripts']} scripts
-     * @param {LH.Artifacts.NetworkRequest[]} networkRecords
      * @param {LH.Artifacts.Bundle[]} bundles
      * @return {Map<LH.Artifacts.Script, PatternMatchResult[]>}
      */
-    static detectAcrossScripts(matcher: CodePatternMatcher, scripts: LH.Artifacts["Scripts"], networkRecords: LH.Artifacts.NetworkRequest[], bundles: LH.Artifacts.Bundle[]): Map<LH.Artifacts.Script, PatternMatchResult[]>;
+    static detectAcrossScripts(matcher: CodePatternMatcher, scripts: LH.Artifacts["Scripts"], bundles: LH.Artifacts.Bundle[]): Map<LH.Artifacts.Script, PatternMatchResult[]>;
     /**
      * @param {PatternMatchResult[]} matches
      * @return {number}
@@ -71,6 +70,7 @@ declare class LegacyJavascript extends ByteEfficiencyAudit {
 export namespace UIStrings {
     let title: string;
     let description: string;
+    let detectedCoreJs2Warning: string;
 }
 import { ByteEfficiencyAudit } from './byte-efficiency-audit.js';
 /**

package/core/audits/byte-efficiency/legacy-javascript.js

@@ -39,7 +39,10 @@ const UIStrings = {
   // eslint-disable-next-line max-len
   // TODO: developer.chrome.com article. this codelab is good starting place: https://web.dev/articles/codelab-serve-modern-code
   /** Description of a Lighthouse audit that tells the user about old JavaScript that is no longer needed. This is displayed after a user expands the section to see more. No character length limits. The last sentence starting with 'Learn' becomes link text to additional documentation. */
-  description: 'Polyfills and transforms enable legacy browsers to use new JavaScript features. However, many aren\'t necessary for modern browsers. For your bundled JavaScript, adopt a modern script deployment strategy using module/nomodule feature detection to reduce the amount of code shipped to modern browsers, while retaining support for legacy browsers. [Learn how to use modern JavaScript](https://web.dev/articles/publish-modern-javascript)',
+  description: 'Polyfills and transforms enable legacy browsers to use new JavaScript features. However, many aren\'t necessary for modern browsers. For your bundled JavaScript, adopt a modern script deployment strategy using [module/nomodule feature detection](https://philipwalton.com/articles/deploying-es2015-code-in-production-today/) to reduce the amount of code shipped to modern browsers, while retaining support for legacy browsers. [Learn how to serve modern JavaScript](https://web.dev/articles/codelab-serve-modern-code)',
+  /** Warning text that an outdated version of the library "core-js" was found, and the developer should upgrade. */
+  // eslint-disable-next-line max-len
+  detectedCoreJs2Warning: 'Version 2 of core-js was detected on the page. You should upgrade to version 3 for many performance improvements.',
 };
 
 const str_ = i18n.createIcuMessageFn(import.meta.url, UIStrings);
@@ -231,7 +234,6 @@ class LegacyJavascript extends ByteEfficiencyAudit {
       ['Reflect.preventExtensions', 'es6.reflect.prevent-extensions'],
       ['Reflect.setPrototypeOf', 'es6.reflect.set-prototype-of'],
       ['String.prototype.codePointAt', 'es6.string.code-point-at'],
-      ['String.fromCodePoint', 'es6.string.from-code-point'],
       ['String.raw', 'es6.string.raw'],
       ['String.prototype.repeat', 'es6.string.repeat'],
       ['Object.entries', 'es7.object.entries'],
@@ -321,11 +323,10 @@ class LegacyJavascript extends ByteEfficiencyAudit {
    *
    * @param {CodePatternMatcher} matcher
    * @param {LH.Artifacts['Scripts']} scripts
-   * @param {LH.Artifacts.NetworkRequest[]} networkRecords
    * @param {LH.Artifacts.Bundle[]} bundles
    * @return {Map<LH.Artifacts.Script, PatternMatchResult[]>}
    */
-  static detectAcrossScripts(matcher, scripts, networkRecords, bundles) {
+  static detectAcrossScripts(matcher, scripts, bundles) {
     /** @type {Map<LH.Artifacts.Script, PatternMatchResult[]>} */
     const scriptToMatchResults = new Map();
     const polyfillData = this.getPolyfillData();
@@ -426,7 +427,7 @@ class LegacyJavascript extends ByteEfficiencyAudit {
     const compressionRatioByUrl = new Map();
 
     const scriptToMatchResults =
-      this.detectAcrossScripts(matcher, artifacts.Scripts, networkRecords, bundles);
+      this.detectAcrossScripts(matcher, artifacts.Scripts, bundles);
     for (const [script, matches] of scriptToMatchResults.entries()) {
       const compressionRatio = estimateCompressionRatioForContent(
         compressionRatioByUrl, script.url, artifacts, networkRecords);
@@ -456,6 +457,16 @@ class LegacyJavascript extends ByteEfficiencyAudit {
       items.push(item);
     }
 
+    const warnings = [];
+    for (const bundle of bundles) {
+      if (classifiedEntities.isFirstParty(bundle.script.url)) {
+        if (bundle.rawMap.sources.some(s => s.match(/node_modules\/core-js\/modules\/es[67]/))) {
+          warnings.push(str_(UIStrings.detectedCoreJs2Warning));
+          break;
+        }
+      }
+    }
+
     /** @type {Map<string, number>} */
     const wastedBytesByUrl = new Map();
     for (const item of items) {
@@ -478,6 +489,7 @@ class LegacyJavascript extends ByteEfficiencyAudit {
       items,
       headings,
       wastedBytesByUrl,
+      warnings,
     };
   }
 }

package/core/audits/byte-efficiency/polyfill-graph-data.json

@@ -1,54 +1,53 @@
 {
-  "moduleSizes": [11897, 498, 265, 277, 263, 453, 219, 216, 546, 339, 1608, 671, 1525, 420, 214, 504, 98, 524, 196, 268, 642, 204, 742, 618, 169, 394, 127, 433, 1473, 779, 239, 144, 182, 254, 77, 508, 124, 1388, 75, 133, 301, 362, 170, 1078, 182, 490, 195, 321, 316, 447, 551, 216, 284, 253, 17, 107, 295, 356, 345, 1939, 1596, 291, 139, 259, 1291, 179, 528, 174, 61, 326, 20, 444, 522, 104, 1945, 120, 1943, 680, 1409, 850, 630, 288, 38, 695, 569, 106, 587, 208, 370, 606, 766, 535, 616, 200, 170, 224, 422, 970, 978, 498, 284, 241, 210, 151, 194, 178, 814, 205, 189, 215, 111, 236, 147, 237, 191, 691, 212, 432, 499, 445, 176, 333, 129, 414, 617, 380, 251, 199, 524, 515, 681, 160, 259, 295, 283, 178, 472, 786, 520, 202, 575, 575, 349, 549, 458, 166, 173, 508, 1522, 743, 414, 431, 393, 899, 137, 270, 131, 472, 457, 205, 778, 801, 133, 3000],
+  "moduleSizes": [17302, 498, 282, 294, 281, 467, 236, 229, 546, 339, 1608, 723, 1545, 438, 214, 111, 537, 209, 281, 685, 217, 757, 631, 182, 407, 140, 366, 1478, 359, 792, 269, 158, 280, 137, 189, 543, 1436, 88, 146, 314, 375, 183, 1083, 195, 503, 269, 208, 334, 350, 460, 568, 229, 334, 266, 30, 120, 309, 370, 358, 1952, 1638, 304, 153, 274, 1288, 192, 543, 187, 74, 144, 137, 33, 457, 535, 117, 1961, 133, 1956, 693, 1426, 863, 637, 301, 51, 708, 583, 119, 600, 221, 370, 728, 1085, 552, 629, 217, 183, 546, 137, 983, 992, 503, 402, 254, 223, 164, 214, 191, 831, 218, 202, 232, 124, 249, 160, 251, 217, 717, 225, 432, 499, 445, 177, 346, 142, 414, 617, 380, 264, 212, 524, 529, 708, 173, 272, 308, 296, 191, 485, 799, 533, 215, 589, 589, 362, 562, 471, 179, 186, 521, 1536, 756, 427, 444, 406, 912, 150, 283, 144, 485, 470, 205, 814, 146, 3000],
   "dependencies": {
-    "Array.prototype.fill": [0, 5, 8, 11, 21, 23, 25, 26, 29, 36, 37, 54, 55, 57, 58, 60, 66, 73, 74, 75, 76, 77, 79, 81, 82, 86, 87, 88, 92, 94, 101, 102, 103, 104, 114, 116],
-    "Array.prototype.filter": [0, 11, 12, 13, 17, 18, 21, 22, 23, 25, 26, 29, 36, 37, 41, 46, 54, 57, 58, 60, 62, 64, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 108, 114, 117],
-    "Array.prototype.find": [0, 5, 11, 12, 17, 18, 21, 22, 23, 25, 26, 29, 36, 37, 41, 46, 54, 55, 57, 58, 60, 62, 64, 66, 73, 74, 75, 76, 77, 79, 81, 82, 86, 87, 88, 92, 94, 101, 102, 103, 104, 108, 114, 119],
-    "Array.prototype.findIndex": [0, 5, 11, 12, 17, 18, 21, 22, 23, 25, 26, 29, 36, 37, 41, 46, 54, 55, 57, 58, 60, 62, 64, 66, 73, 74, 75, 76, 77, 79, 81, 82, 86, 87, 88, 92, 94, 101, 102, 103, 104, 108, 114, 118],
-    "Array.prototype.forEach": [0, 9, 11, 12, 14, 17, 18, 21, 22, 23, 25, 26, 29, 36, 37, 41, 46, 54, 57, 58, 60, 62, 64, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 108, 114, 120],
-    "Array.from": [0, 10, 11, 19, 20, 21, 22, 23, 25, 26, 27, 29, 36, 37, 41, 46, 49, 50, 54, 57, 58, 60, 61, 64, 66, 72, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 108, 114, 121],
-    "Array.isArray": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 62, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 122],
-    "Array.prototype.map": [0, 11, 12, 13, 17, 18, 21, 22, 23, 25, 26, 29, 36, 37, 41, 46, 54, 57, 58, 60, 62, 64, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 108, 114, 123],
-    "Array.of": [0, 11, 21, 22, 23, 25, 26, 27, 29, 36, 37, 54, 57, 58, 60, 64, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 108, 114, 124],
-    "Array.prototype.some": [0, 11, 12, 14, 17, 18, 21, 22, 23, 25, 26, 29, 36, 37, 41, 46, 54, 57, 58, 60, 62, 64, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 108, 114, 125],
-    "Date.now": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 126],
-    "Date.prototype.toISOString": [0, 11, 21, 22, 23, 25, 26, 28, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 98, 99, 101, 102, 103, 104, 108, 109, 114, 127],
-    "Date.prototype.toJSON": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 128],
-    "Date.prototype.toString": [0, 25, 26, 29, 54, 58, 60, 74, 94, 114, 129],
-    "Function.prototype.name": [0, 130],
-    "Number.isInteger": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 67, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 131],
-    "Number.isSafeInteger": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 67, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 132],
-    "Object.defineProperties": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 77, 79, 81, 82, 86, 87, 88, 92, 94, 101, 102, 103, 104, 114, 133],
-    "Object.defineProperty": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 134],
-    "Object.freeze": [0, 7, 11, 15, 21, 23, 25, 26, 27, 29, 36, 37, 39, 54, 57, 58, 59, 60, 66, 73, 74, 75, 79, 80, 81, 82, 84, 86, 88, 92, 94, 101, 102, 103, 104, 114, 136],
-    "Object.getPrototypeOf": [0, 11, 21, 23, 24, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 83, 86, 88, 92, 94, 101, 102, 103, 104, 114, 138],
-    "Object.isExtensible": [0, 7, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 84, 86, 88, 92, 94, 101, 102, 103, 104, 114, 139],
-    "Object.isFrozen": [0, 7, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 140],
-    "Object.isSealed": [0, 7, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 141],
-    "Object.keys": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 87, 88, 92, 94, 101, 102, 103, 104, 114, 142],
-    "Object.preventExtensions": [0, 7, 11, 15, 21, 23, 25, 26, 27, 29, 36, 37, 39, 54, 57, 58, 59, 60, 66, 73, 74, 75, 79, 80, 81, 82, 84, 86, 88, 92, 94, 101, 102, 103, 104, 114, 143],
-    "Object.seal": [0, 7, 11, 15, 21, 23, 25, 26, 27, 29, 36, 37, 39, 54, 57, 58, 59, 60, 66, 73, 74, 75, 79, 80, 81, 82, 84, 86, 88, 92, 94, 101, 102, 103, 104, 114, 144],
-    "Object.setPrototypeOf": [0, 4, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 89, 92, 94, 101, 102, 103, 104, 114, 145],
-    "Reflect.apply": [0, 11, 21, 23, 25, 26, 29, 36, 37, 40, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 147],
-    "Reflect.construct": [0, 3, 11, 16, 21, 22, 23, 25, 26, 29, 36, 37, 40, 43, 54, 55, 57, 58, 60, 64, 66, 73, 74, 75, 76, 77, 79, 81, 82, 86, 87, 88, 92, 94, 101, 102, 103, 104, 108, 114, 148],
-    "Reflect.defineProperty": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 149],
-    "Reflect.deleteProperty": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 150],
-    "Reflect.get": [0, 11, 21, 23, 24, 25, 26, 29, 36, 37, 54, 57, 58, 60, 65, 66, 73, 74, 75, 79, 81, 82, 83, 86, 88, 92, 94, 101, 102, 103, 104, 114, 153],
-    "Reflect.getOwnPropertyDescriptor": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 151],
-    "Reflect.getPrototypeOf": [0, 11, 21, 23, 24, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 83, 86, 88, 92, 94, 101, 102, 103, 104, 114, 152],
-    "Reflect.has": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 154],
-    "Reflect.isExtensible": [0, 7, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 84, 86, 88, 92, 94, 101, 102, 103, 104, 114, 155],
-    "Reflect.ownKeys": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 156],
-    "Reflect.preventExtensions": [0, 11, 21, 23, 25, 26, 29, 36, 37, 39, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 157],
-    "Reflect.setPrototypeOf": [0, 4, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 89, 92, 94, 101, 102, 103, 104, 114, 158],
-    "String.prototype.codePointAt": [0, 11, 21, 22, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 97, 101, 102, 103, 104, 108, 109, 114, 159],
-    "String.fromCodePoint": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 160],
-    "String.raw": [0, 11, 21, 22, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 108, 109, 114, 161],
-    "String.prototype.repeat": [0, 11, 21, 22, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 99, 101, 102, 103, 104, 108, 109, 114, 162],
-    "Object.entries": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 87, 88, 90, 92, 94, 101, 102, 103, 104, 114, 135],
-    "Object.getOwnPropertyDescriptors": [0, 11, 21, 23, 25, 26, 27, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 88, 92, 94, 101, 102, 103, 104, 114, 137],
-    "Object.values": [0, 11, 21, 23, 25, 26, 29, 36, 37, 54, 57, 58, 60, 66, 73, 74, 75, 79, 81, 82, 86, 87, 88, 90, 92, 94, 101, 102, 103, 104, 114, 146],
+    "Array.prototype.fill": [0, 5, 8, 11, 20, 22, 29, 33, 36, 55, 57, 66, 74, 76, 77, 78, 80, 82, 83, 87, 88, 89, 93, 102, 103, 104, 105, 117],
+    "Array.prototype.filter": [0, 11, 12, 13, 16, 17, 20, 21, 22, 29, 33, 36, 40, 46, 57, 62, 64, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 109, 118],
+    "Array.prototype.find": [0, 5, 11, 12, 16, 17, 20, 21, 22, 29, 33, 36, 40, 46, 55, 57, 62, 64, 66, 74, 76, 77, 78, 80, 82, 83, 87, 88, 89, 93, 102, 103, 104, 105, 109, 120],
+    "Array.prototype.findIndex": [0, 5, 11, 12, 16, 17, 20, 21, 22, 29, 33, 36, 40, 46, 55, 57, 62, 64, 66, 74, 76, 77, 78, 80, 82, 83, 87, 88, 89, 93, 102, 103, 104, 105, 109, 119],
+    "Array.prototype.forEach": [0, 9, 11, 12, 14, 16, 17, 20, 21, 22, 29, 33, 36, 40, 46, 57, 62, 64, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 109, 121],
+    "Array.from": [0, 10, 11, 18, 19, 20, 21, 22, 26, 29, 33, 36, 40, 46, 49, 50, 57, 61, 64, 66, 73, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 109, 122],
+    "Array.isArray": [0, 11, 20, 22, 29, 33, 36, 57, 62, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 123],
+    "Array.prototype.map": [0, 11, 12, 13, 16, 17, 20, 21, 22, 29, 33, 36, 40, 46, 57, 62, 64, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 109, 124],
+    "Array.of": [0, 11, 20, 21, 22, 26, 29, 33, 36, 57, 64, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 109, 125],
+    "Array.prototype.some": [0, 11, 12, 14, 16, 17, 20, 21, 22, 29, 33, 36, 40, 46, 57, 62, 64, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 109, 126],
+    "Date.now": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 127],
+    "Date.prototype.toISOString": [0, 11, 20, 21, 22, 27, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 99, 100, 102, 103, 104, 105, 109, 110, 128],
+    "Date.prototype.toJSON": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 129],
+    "Date.prototype.toString": [0, 29, 130],
+    "Function.prototype.name": [0, 28, 131],
+    "Number.isInteger": [0, 11, 20, 22, 29, 33, 36, 57, 66, 67, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 132],
+    "Number.isSafeInteger": [0, 11, 20, 22, 29, 33, 36, 57, 66, 67, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 133],
+    "Object.defineProperties": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 78, 80, 82, 83, 87, 88, 89, 93, 102, 103, 104, 105, 134],
+    "Object.defineProperty": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 135],
+    "Object.freeze": [0, 7, 11, 15, 20, 22, 29, 33, 36, 38, 57, 59, 66, 74, 76, 80, 81, 82, 83, 85, 87, 89, 93, 102, 103, 104, 105, 137],
+    "Object.getPrototypeOf": [0, 11, 20, 22, 23, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 84, 87, 89, 93, 102, 103, 104, 105, 139],
+    "Object.isExtensible": [0, 7, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 85, 87, 89, 93, 102, 103, 104, 105, 140],
+    "Object.isFrozen": [0, 7, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 141],
+    "Object.isSealed": [0, 7, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 142],
+    "Object.keys": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 88, 89, 93, 102, 103, 104, 105, 143],
+    "Object.preventExtensions": [0, 7, 11, 15, 20, 22, 29, 33, 36, 38, 57, 59, 66, 74, 76, 80, 81, 82, 83, 85, 87, 89, 93, 102, 103, 104, 105, 144],
+    "Object.seal": [0, 7, 11, 15, 20, 22, 29, 33, 36, 38, 57, 59, 66, 74, 76, 80, 81, 82, 83, 85, 87, 89, 93, 102, 103, 104, 105, 145],
+    "Object.setPrototypeOf": [0, 4, 11, 20, 22, 29, 33, 36, 45, 57, 66, 70, 74, 76, 80, 82, 83, 87, 89, 90, 93, 102, 103, 104, 105, 146],
+    "Reflect.apply": [0, 11, 20, 22, 29, 33, 36, 39, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 148],
+    "Reflect.construct": [0, 3, 11, 15, 20, 21, 22, 29, 33, 36, 39, 42, 55, 57, 64, 66, 74, 76, 77, 78, 80, 82, 83, 87, 88, 89, 93, 102, 103, 104, 105, 109, 149],
+    "Reflect.defineProperty": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 150],
+    "Reflect.deleteProperty": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 151],
+    "Reflect.get": [0, 11, 20, 22, 23, 29, 33, 36, 57, 65, 66, 74, 76, 80, 82, 83, 84, 87, 89, 93, 102, 103, 104, 105, 154],
+    "Reflect.getOwnPropertyDescriptor": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 152],
+    "Reflect.getPrototypeOf": [0, 11, 20, 22, 23, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 84, 87, 89, 93, 102, 103, 104, 105, 153],
+    "Reflect.has": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 155],
+    "Reflect.isExtensible": [0, 7, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 85, 87, 89, 93, 102, 103, 104, 105, 156],
+    "Reflect.ownKeys": [0, 11, 20, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 157],
+    "Reflect.preventExtensions": [0, 11, 20, 22, 29, 33, 36, 38, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 158],
+    "Reflect.setPrototypeOf": [0, 4, 11, 20, 22, 29, 33, 36, 45, 57, 66, 70, 74, 76, 80, 82, 83, 87, 89, 90, 93, 102, 103, 104, 105, 159],
+    "String.prototype.codePointAt": [0, 11, 20, 21, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 98, 102, 103, 104, 105, 109, 110, 160],
+    "String.raw": [0, 11, 20, 21, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 109, 110, 161],
+    "String.prototype.repeat": [0, 11, 20, 21, 22, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 100, 102, 103, 104, 105, 109, 110, 162],
+    "Object.entries": [0, 11, 20, 22, 23, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 84, 87, 88, 89, 91, 93, 102, 103, 104, 105, 136],
+    "Object.getOwnPropertyDescriptors": [0, 11, 20, 22, 26, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 87, 89, 93, 102, 103, 104, 105, 138],
+    "Object.values": [0, 11, 20, 22, 23, 29, 33, 36, 57, 66, 74, 76, 80, 82, 83, 84, 87, 88, 89, 91, 93, 102, 103, 104, 105, 147],
     "focus-visible": [163]
   },
-  "maxSize": 87683
+  "maxSize": 94935
 }

package/core/audits/byte-efficiency/total-byte-weight.js

@@ -8,7 +8,6 @@ import {Audit} from '../audit.js';
 import * as i18n from '../../lib/i18n/i18n.js';
 import {NetworkRequest} from '../../lib/network-request.js';
 import {NetworkRecords} from '../../computed/network-records.js';
-import {Util} from '../../../shared/util.js';
 
 const UIStrings = {
   /** Title of a diagnostic audit that provides detail on large network resources required during page load. 'Payloads' is roughly equivalent to 'resources'. This descriptive title is shown to users when the amount is acceptable and no user action is required. */
@@ -99,7 +98,6 @@ class TotalByteWeight extends Audit {
 
     return {
       score,
-      scoreDisplayMode: score >= Util.PASS_THRESHOLD ? Audit.SCORING_MODES.INFORMATIVE : undefined,
       numericValue: totalBytes,
       numericUnit: 'byte',
       displayValue: str_(UIStrings.displayValue, {totalBytes}),

package/core/audits/clickjacking-mitigation.d.ts

@@ -0,0 +1,42 @@
+export default ClickjackingMitigation;
+declare class ClickjackingMitigation extends Audit {
+    /**
+     * @param {LH.Artifacts} artifacts
+     * @param {LH.Audit.Context} context
+     * @return {Promise<{cspHeaders: string[], xfoHeaders: string[]}>}
+     */
+    static getRawCspsAndXfo(artifacts: LH.Artifacts, context: LH.Audit.Context): Promise<{
+        cspHeaders: string[];
+        xfoHeaders: string[];
+    }>;
+    /**
+     * @param {string | undefined} directive
+     * @param {LH.IcuMessage | string} findingDescription
+     * @param {LH.IcuMessage=} severity
+     * @return {LH.Audit.Details.TableItem}
+     */
+    static findingToTableItem(directive: string | undefined, findingDescription: LH.IcuMessage | string, severity?: LH.IcuMessage | undefined): LH.Audit.Details.TableItem;
+    /**
+     * @param {string[]} cspHeaders
+     * @param {string[]} xfoHeaders
+     * @return {{score: number, results: LH.Audit.Details.TableItem[]}}
+     */
+    static constructResults(cspHeaders: string[], xfoHeaders: string[]): {
+        score: number;
+        results: LH.Audit.Details.TableItem[];
+    };
+    /**
+     * @param {LH.Artifacts} artifacts
+     * @param {LH.Audit.Context} context
+     * @return {Promise<LH.Audit.Product>}
+     */
+    static audit(artifacts: LH.Artifacts, context: LH.Audit.Context): Promise<LH.Audit.Product>;
+}
+export namespace UIStrings {
+    let title: string;
+    let description: string;
+    let noClickjackingMitigation: string;
+    let columnSeverity: string;
+}
+import { Audit } from './audit.js';
+//# sourceMappingURL=clickjacking-mitigation.d.ts.map

package/core/audits/clickjacking-mitigation.js

@@ -0,0 +1,139 @@
+/**
+ * @license
+ * Copyright 2024 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {Audit} from './audit.js';
+import {MainResource} from '../computed/main-resource.js';
+import * as i18n from '../lib/i18n/i18n.js';
+
+const UIStrings = {
+  /** Title of a Lighthouse audit that evaluates whether the set CSP or XFO header is mitigating clickjacking attacks. "XFO" stands for "X-Frame-Options" and should not be translated. "CSP" stands for "Content-Security-Policy" and should not be translated. "clickjacking" should not be translated. */
+  title: 'Mitigate clickjacking with XFO or CSP',
+  /** Description of a Lighthouse audit that evaluates whether the set CSP or XFO header is mitigating clickjacking attacks. This is displayed after a user expands the section to see more. "clickjacking" should not be translated. No character length limits. The last sentence starting with 'Learn' becomes link text to additional documentation. "XFO" stands for "X-Frame-Options" and should not be translated. "CSP" stands for "Content-Security-Policy" and should not be translated. */
+  description: 'The `X-Frame-Options` (XFO) header or the `frame-ancestors` directive in the `Content-Security-Policy` (CSP) header control where a page can be embedded. These can mitigate clickjacking attacks by blocking some or all sites from embedding the page. [Learn more about mitigating clickjacking](https://developer.chrome.com/docs/lighthouse/best-practices/clickjacking-mitigation).',
+  /** Summary text for the results of a Lighthouse audit that evaluates whether the page is mitigating clickjacking attacks with a frame control policy. This text is displayed if the page does not control how it can be embedded on other pages. */
+  noClickjackingMitigation: 'No frame control policy found',
+  /** Label for a column in a data table; entries will be the severity of an issue with the page's frame control policy. */
+  columnSeverity: 'Severity',
+};
+
+const str_ = i18n.createIcuMessageFn(import.meta.url, UIStrings);
+
+class ClickjackingMitigation extends Audit {
+  /**
+   * @return {LH.Audit.Meta}
+   */
+  static get meta() {
+    return {
+      id: 'clickjacking-mitigation',
+      scoreDisplayMode: Audit.SCORING_MODES.INFORMATIVE,
+      title: str_(UIStrings.title),
+      description: str_(UIStrings.description),
+      requiredArtifacts: ['devtoolsLogs', 'URL'],
+      supportedModes: ['navigation'],
+    };
+  }
+
+  /**
+   * @param {LH.Artifacts} artifacts
+   * @param {LH.Audit.Context} context
+   * @return {Promise<{cspHeaders: string[], xfoHeaders: string[]}>}
+   */
+  static async getRawCspsAndXfo(artifacts, context) {
+    const devtoolsLog = artifacts.devtoolsLogs[Audit.DEFAULT_PASS];
+    const mainResource =
+        await MainResource.request({devtoolsLog, URL: artifacts.URL}, context);
+
+    const cspHeaders = mainResource.responseHeaders
+        .filter(h => {
+          return h.name.toLowerCase() === 'content-security-policy';
+        })
+        .flatMap(h => h.value.split(','))
+        .filter(rawCsp => rawCsp.replace(/\s/g, ''));
+    let xfoHeaders = mainResource.responseHeaders
+                         .filter(h => {
+                           return h.name.toLowerCase() === 'x-frame-options';
+                         })
+                         .flatMap(h => h.value);
+
+    // Sanitize the XFO header value.
+    xfoHeaders = xfoHeaders.map(v => v.toLowerCase().replace(/\s/g, ''));
+
+    return {cspHeaders, xfoHeaders};
+  }
+
+  /**
+   * @param {string | undefined} directive
+   * @param {LH.IcuMessage | string} findingDescription
+   * @param {LH.IcuMessage=} severity
+   * @return {LH.Audit.Details.TableItem}
+   */
+  static findingToTableItem(directive, findingDescription, severity) {
+    return {
+      description: findingDescription,
+      severity,
+    };
+  }
+
+  /**
+   * @param {string[]} cspHeaders
+   * @param {string[]} xfoHeaders
+   * @return {{score: number, results: LH.Audit.Details.TableItem[]}}
+   */
+  static constructResults(cspHeaders, xfoHeaders) {
+    const allowedDirectives = ['deny', 'sameorigin'];
+
+    // Check for frame-ancestors in CSP.
+    for (const cspHeader of cspHeaders) {
+      if (cspHeader.includes('frame-ancestors')) {
+        // Pass the audit if frame-ancestors is present.
+        return {score: 1, results: []};
+      }
+    }
+
+    for (const actualDirective of xfoHeaders) {
+      if (allowedDirectives.includes(actualDirective)) {
+        // DENY or SAMEORIGIN are present.
+        return {score: 1, results: []};
+      }
+    }
+
+    return {
+      score: 0,
+      results: [{
+        severity: str_(i18n.UIStrings.itemSeverityHigh),
+        description: str_(UIStrings.noClickjackingMitigation),
+      }],
+    };
+  }
+
+  /**
+   * @param {LH.Artifacts} artifacts
+   * @param {LH.Audit.Context} context
+   * @return {Promise<LH.Audit.Product>}
+   */
+  static async audit(artifacts, context) {
+    const {cspHeaders, xfoHeaders} = await this.getRawCspsAndXfo(artifacts, context);
+    const {score, results} = this.constructResults(cspHeaders, xfoHeaders);
+
+    /** @type {LH.Audit.Details.Table['headings']} */
+    const headings = [
+      /* eslint-disable max-len */
+      {key: 'description', valueType: 'text', subItemsHeading: {key: 'description'}, label: str_(i18n.UIStrings.columnDescription)},
+      {key: 'severity', valueType: 'text', subItemsHeading: {key: 'severity'}, label: str_(UIStrings.columnSeverity)},
+      /* eslint-enable max-len */
+    ];
+    const details = Audit.makeTableDetails(headings, results);
+
+    return {
+      score,
+      notApplicable: !results.length,
+      details,
+    };
+  }
+}
+
+export default ClickjackingMitigation;
+export {UIStrings};

package/core/audits/dobetterweb/dom-size.js

@@ -14,7 +14,6 @@
 import {Audit} from '../audit.js';
 import * as i18n from '../../lib/i18n/i18n.js';
 import {TBTImpactTasks} from '../../computed/tbt-impact-tasks.js';
-import {Util} from '../../../shared/util.js';
 
 const UIStrings = {
   /** Title of a diagnostic audit that provides detail on the size of the web page's DOM. The size of a DOM is characterized by the total number of DOM elements and greatest DOM depth. This descriptive title is shown to users when the amount is acceptable and no user action is required. */
@@ -168,7 +167,6 @@ class DOMSize extends Audit {
 
     return {
       score,
-      scoreDisplayMode: score >= Util.PASS_THRESHOLD ? Audit.SCORING_MODES.INFORMATIVE : undefined,
       numericValue: stats.totalBodyElements,
       numericUnit: 'element',
       displayValue: str_(UIStrings.displayValue, {itemCount: stats.totalBodyElements}),

package/core/audits/insights/README.md

@@ -0,0 +1,3 @@
+# Insight audits
+
+When adding new insight audits, you can start off by just running `yarn generate-insight-audits`

package/core/audits/insights/cls-culprits-insight.d.ts

@@ -0,0 +1,25 @@
+export default CLSCulpritsInsight;
+export type SubItem = {
+    extra?: LH.Audit.Details.NodeValue | LH.Audit.Details.UrlValue;
+    cause: LH.IcuMessage;
+};
+declare class CLSCulpritsInsight extends Audit {
+    /**
+     * @param {import('@paulirish/trace_engine/models/trace/insights/CLSCulprits.js').CLSCulpritsInsightModel} insight
+     * @param {import('../../lib/trace-engine.js').SaneSyntheticLayoutShift} event
+     * @param {LH.Artifacts.TraceElement[]} TraceElements
+     * @return {LH.Audit.Details.TableSubItems|undefined}
+     */
+    static getCulpritSubItems(insight: import("@paulirish/trace_engine/models/trace/insights/CLSCulprits.js").CLSCulpritsInsightModel, event: import("../../lib/trace-engine.js").SaneSyntheticLayoutShift, TraceElements: LH.Artifacts.TraceElement[]): LH.Audit.Details.TableSubItems | undefined;
+    /**
+     * @param {LH.Artifacts} artifacts
+     * @param {LH.Audit.Context} context
+     * @return {Promise<LH.Audit.Product>}
+     */
+    static audit(artifacts: LH.Artifacts, context: LH.Audit.Context): Promise<LH.Audit.Product>;
+}
+export namespace UIStrings {
+    let columnScore: string;
+}
+import { Audit } from '../audit.js';
+//# sourceMappingURL=cls-culprits-insight.d.ts.map