lighthouse 13.5.0-dev.20261023 → 13.6.0-dev.20261027

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "lighthouse",
   "type": "module",
-  "version": "13.5.0-dev.20261023",
+  "version": "13.6.0-dev.20261027",
   "description": "Automated auditing, performance metrics, and best practices for the web.",
   "main": "./core/index.js",
   "bin": {
@@ -119,7 +119,7 @@
     "acorn": "^8.19.0",
     "ajv": "^8.20.0",
     "archiver": "^8.0.0",
-    "chrome-devtools-frontend": "1.0.1705227",
+    "chrome-devtools-frontend": "1.0.1726686",
     "concurrently": "^10.0.6",
     "conventional-changelog": "^8.1.3",
     "core-js-compat": "^3.51.0",
@@ -141,7 +141,7 @@
     "pako": "^3.0.2",
     "preact": "^10.29.8",
     "pretty-json-stringify": "^0.0.2",
-    "puppeteer": "^25.15.0",
+    "puppeteer": "^25.16.0",
     "terser": "^5.51.2",
     "testdouble": "^4.0.0",
     "tsx": "^4.23.15",
@@ -149,18 +149,18 @@
     "typescript": "6.0.3",
     "typescript-eslint": "^8.60.1",
     "wait-for-expect": "^4.0.0",
-    "web-features": "^3.43.0",
+    "web-features": "^3.44.0",
     "webtreemap-cdt": "^3.2.1"
   },
   "dependencies": {
     "@paulirish/trace_engine": "0.0.67",
     "@sentry/node": "^11.8.0",
     "ajv-formats": "^3.0.1",
-    "axe-core": "4.13.0",
+    "axe-core": "4.14.0",
     "chrome-launcher": "^1.2.2",
     "configstore": "^8.0.0",
     "csp_evaluator": "1.1.8",
-    "devtools-protocol": "0.0.1721602",
+    "devtools-protocol": "0.0.1727723",
     "enquirer": "^2.3.6",
     "http-link-header": "^1.1.1",
     "intl-messageformat": "^10.5.3",
@@ -168,7 +168,7 @@
     "lighthouse-logger": "^2.0.2",
     "lighthouse-stack-packs": "1.12.3",
     "open": "^11.0.4",
-    "puppeteer-core": "^25.15.0",
+    "puppeteer-core": "^25.16.0",
     "robots-parser": "^3.0.1",
     "speedline-core": "^1.4.3",
     "third-party-web": "^0.30.0",
@@ -177,8 +177,8 @@
     "yargs-parser": "^22.0.0"
   },
   "resolutions": {
-    "puppeteer/**/devtools-protocol": "0.0.1721602",
-    "puppeteer-core/**/devtools-protocol": "0.0.1721602"
+    "puppeteer/**/devtools-protocol": "0.0.1727723",
+    "puppeteer-core/**/devtools-protocol": "0.0.1727723"
   },
   "repository": {
     "type": "git",

package/report/renderer/category-renderer.js

@@ -71,7 +71,7 @@ export class CategoryRenderer {
     if (audit.stackPacks) {
       audit.stackPacks.forEach(pack => {
         const packElmImg = this.dom.createElement('img', 'lh-audit__stackpack__img');
-        packElmImg.src = pack.iconDataURL;
+        this.dom.safelySetImageSrc(packElmImg, pack.iconDataURL);
         packElmImg.alt = pack.title;
 
         const snippets = this.dom.convertMarkdownLinkSnippets(pack.description, {
@@ -141,7 +141,7 @@ export class CategoryRenderer {
 
     const imgEl = this.dom.createElement('img', 'lh-final-ss-image');
     const finalScreenshotDataUri = audit.details.data;
-    imgEl.src = finalScreenshotDataUri;
+    this.dom.safelySetImageSrc(imgEl, finalScreenshotDataUri);
     imgEl.alt = audit.title;
 
     const firstCatHeaderEl = this.dom.find('.lh-category .lh-category-header', categoriesEl);

package/report/renderer/details-renderer.js

@@ -202,7 +202,7 @@ export class DetailsRenderer {
   _renderThumbnail(details) {
     const element = this._dom.createElement('img', 'lh-thumbnail');
     const strValue = details;
-    element.src = strValue;
+    this._dom.safelySetImageSrc(element, strValue);
     element.title = strValue;
     element.alt = '';
     return element;
@@ -429,6 +429,7 @@ export class DetailsRenderer {
       this._dom.safelySetHref(entityLinkEl, matchedEntity.homepage);
       if (entityLinkEl.href) {
         entityLinkEl.target = '_blank';
+        entityLinkEl.rel = 'noopener';
         entityLinkEl.title = Globals.strings.openInANewTabTooltip;
         entityLinkEl.classList.add('lh-report-icon--external');
         firstTdEl.append(' ', entityLinkEl);
@@ -735,7 +736,7 @@ export class DetailsRenderer {
     for (const thumbnail of details.items) {
       const frameEl = this._dom.createChildOf(filmstripEl, 'div', 'lh-filmstrip__frame');
       const imgEl = this._dom.createChildOf(frameEl, 'img', 'lh-filmstrip__thumbnail');
-      imgEl.src = thumbnail.data;
+      this._dom.safelySetImageSrc(imgEl, thumbnail.data);
       imgEl.alt = `Screenshot`;
     }
     return filmstripEl;

package/report/renderer/dom.d.ts

@@ -68,15 +68,21 @@ export class DOM {
      * Set link href, but safely, preventing `javascript:` protocol, etc.
      * @see https://github.com/google/safevalues/
      * @param {HTMLAnchorElement} elem
-     * @param {string} url
+     * @param {string|undefined} url
      */
-    safelySetHref(elem: HTMLAnchorElement, url: string): void;
+    safelySetHref(elem: HTMLAnchorElement, url: string | undefined): void;
     /**
      * Only create blob URLs for JSON & HTML
      * @param {HTMLAnchorElement} elem
      * @param {Blob} blob
      */
     safelySetBlobHref(elem: HTMLAnchorElement, blob: Blob): void;
+    /**
+     * Set img src, but safely, only allowing `https:`, `http:`, and `data:image/`.
+     * @param {HTMLImageElement} elem
+     * @param {string} url
+     */
+    safelySetImageSrc(elem: HTMLImageElement, url: string): void;
     /**
      * @param {string} markdownText
      * @return {Element}

package/report/renderer/dom.js

@@ -169,7 +169,7 @@ export class DOM {
    * Set link href, but safely, preventing `javascript:` protocol, etc.
    * @see https://github.com/google/safevalues/
    * @param {HTMLAnchorElement} elem
-   * @param {string} url
+   * @param {string|undefined} url
    */
   safelySetHref(elem, url) {
     // Defaults to '' to fix proto roundtrip issue. See https://github.com/GoogleChrome/lighthouse/issues/12868
@@ -189,6 +189,8 @@ export class DOM {
 
     if (parsed && allowedProtocols.includes(parsed.protocol)) {
       elem.href = parsed.href;
+    } else {
+      elem.removeAttribute('href');
     }
   }
 
@@ -205,6 +207,32 @@ export class DOM {
     elem.href = href;
   }
 
+  /**
+   * Set img src, but safely, only allowing `https:`, `http:`, and `data:image/`.
+   * @param {HTMLImageElement} elem
+   * @param {string} url
+   */
+  safelySetImageSrc(elem, url) {
+    url = url || '';
+
+    if (url.startsWith('data:image/')) {
+      elem.src = url;
+      return;
+    }
+
+    const allowedProtocols = ['https:', 'http:'];
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch (_) {}
+
+    if (parsed && allowedProtocols.includes(parsed.protocol)) {
+      elem.src = parsed.href;
+    } else {
+      elem.removeAttribute('src');
+    }
+  }
+
   /**
    * @param {string} markdownText
    * @return {Element}

package/report/renderer/element-screenshot-renderer.js

@@ -134,6 +134,9 @@ export class ElementScreenshotRenderer {
    * @param {LH.Result.FullPageScreenshot['screenshot']} screenshot
    */
   static installFullPageScreenshot(el, screenshot) {
+    if (!screenshot.data.startsWith('data:image/') || /['"()\\\r\n]/.test(screenshot.data)) {
+      return;
+    }
     el.style.setProperty('--element-screenshot-url', `url('${screenshot.data}')`);
   }
 

package/report/renderer/performance-category-renderer.js

@@ -183,6 +183,7 @@ export class PerformanceCategoryRenderer extends CategoryRenderer {
         // Add link to score calculator.
         const calculatorLink = this.dom.createChildOf(estValuesEl, 'a', 'lh-calclink');
         calculatorLink.target = '_blank';
+        calculatorLink.rel = 'noopener';
         calculatorLink.textContent = strings.calculatorLink;
         this.dom.safelySetHref(calculatorLink, this._getScoringCalculatorHref(category.auditRefs));
       }

package/report/renderer/report-renderer.js

@@ -119,6 +119,7 @@ export class ReportRenderer {
     const channel = report.configSettings.channel;
     const benchmarkIndex = report.environment.benchmarkIndex.toFixed(0);
     const axeVersion = report.environment.credits?.['axe-core'];
+    const ardVersion = report.environment.credits?.['ard'];
 
     const devicesTooltipTextLines = [
       `${Globals.strings.runtimeSettingsBenchmark}: ${benchmarkIndex}`,
@@ -131,6 +132,9 @@ export class ReportRenderer {
     if (axeVersion) {
       devicesTooltipTextLines.push(`${Globals.strings.runtimeSettingsAxeVersion}: ${axeVersion}`);
     }
+    if (ardVersion) {
+      devicesTooltipTextLines.push(`${Globals.strings.runtimeSettingsArdVersion}: ${ardVersion}`);
+    }
 
     let stopwatchLabel = Globals.strings.runtimeAnalysisWindow;
     if (report.gatherMode === 'timespan') {

package/report/renderer/report-utils.d.ts

@@ -116,6 +116,7 @@ export namespace UIStrings {
     let runtimeSettingsUANetwork: string;
     let runtimeSettingsBenchmark: string;
     let runtimeSettingsAxeVersion: string;
+    let runtimeSettingsArdVersion: string;
     let runtimeSettingsScreenEmulation: string;
     let footerIssue: string;
     let runtimeNoEmulation: string;

package/report/renderer/report-utils.js

@@ -441,6 +441,8 @@ const UIStrings = {
   runtimeSettingsBenchmark: 'Unthrottled CPU/Memory Power',
   /** Label for a row in a table that shows the version of the Axe library used. Example row values: 2.1.0, 3.2.3 */
   runtimeSettingsAxeVersion: 'Axe version',
+  /** Label for a row in a table that shows the version of the Agentic Resource Discovery (ARD) specification used. "ARD" should not be translated. Example row values: 0.91 (f073b1e), 1.0 (a1b2c3d) */
+  runtimeSettingsArdVersion: 'ARD version',
   /** Label for a row in a table that shows the screen resolution and DPR that was emulated for the Lighthouse run. Example values: '800x600, DPR: 3' */
   runtimeSettingsScreenEmulation: 'Screen emulation',