lighthouse 13.5.0 → 13.6.0-dev.20261028

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "lighthouse",
   "type": "module",
-  "version": "13.5.0",
+  "version": "13.6.0-dev.20261028",
   "description": "Automated auditing, performance metrics, and best practices for the web.",
   "main": "./core/index.js",
   "bin": {
@@ -37,8 +37,9 @@
     "reset-link": "(yarn unlink || true) && yarn link && yarn link lighthouse",
     "clean": "rm -r dist proto/scripts/*.json proto/scripts/*_pb2.* proto/scripts/*_pb.* proto/scripts/__pycache__ proto/scripts/*.pyc *.report.html *.report.dom.html *.report.json *.devtoolslog.json *.trace.json shared/localization/locales/*.ctc.json || true",
     "clean-types": "git clean -xfq '*.d.ts' '*.d.cts' -e 'node_modules/' -e 'dist/' -e '.tmp/' -e '**/types/'",
-    "lint": "[ \"$CI\" = true ] && eslint --quiet -f codeframe . || eslint .",
-    "smoke": "node -r source-map-support/register cli/test/smokehouse/frontends/smokehouse-bin.js",
+    "lint": "[ \"$CI\" = true ] && eslint --quiet . || eslint .",
+    "zizmor": "uvx zizmor@1.25.2 --gh-token=\"$(gh auth token)\" .github/workflows",
+    "smoke": "node --enable-source-maps cli/test/smokehouse/frontends/smokehouse-bin.js",
     "debug": "node --inspect-brk ./cli/index.js",
     "start": "yarn build-report --standalone && node ./cli/index.js",
     "mocha": "node core/test/scripts/run-mocha-tests.js",
@@ -53,14 +54,13 @@
     "test-proto": "yarn compile-proto && yarn build-proto-roundtrip",
     "unit-core": "yarn mocha core",
     "unit-cli": "yarn mocha --testMatch cli/**/*-test.js",
-    "unit-lantern-trace": "INTERNAL_LANTERN_USE_TRACE=1 yarn mocha core/test/computed/metrics core/test/audits",
+    "unit-lantern-trace": "INTERNAL_LANTERN_USE_TRACE=1 yarn mocha core/test/computed/metrics core/test/computed/page-dependency-graph-test.js core/test/computed/tbt-impact-tasks-test.js core/test/audits",
     "unit-report": "yarn mocha --testMatch report/**/*-test.js",
     "unit-treemap": "yarn mocha --testMatch treemap/**/*-test.js",
     "unit-viewer": "yarn mocha --testMatch viewer/**/*-test.js",
     "unit-flow": "bash flow-report/test/run-flow-report-tests.sh",
     "unit": "yarn unit-flow && yarn mocha && yarn unit-lantern-trace",
     "unit:ci": "NODE_OPTIONS=--max-old-space-size=8192 npm run unit",
-    "unit-lantern-trace:ci": "NODE_OPTIONS=--max-old-space-size=8192 npm run unit-lantern-trace",
     "core-unit": "yarn unit-core",
     "cli-unit": "yarn unit-cli",
     "viewer-unit": "yarn unit-viewer",
@@ -71,9 +71,8 @@
     "deploy-treemap": "yarn build-treemap --deploy",
     "deploy-viewer": "yarn build-viewer --deploy",
     "vercel-build": "yarn build-sample-reports && yarn build-viewer && yarn build-treemap",
-    "dogfood-lhci": "./core/scripts/dogfood-lhci.sh",
     "timing-trace": "node core/scripts/generate-timing-trace.js",
-    "changelog": "conventional-changelog --config ./build/changelog-generator/index.cjs --infile changelog.md --same-file",
+    "changelog": "conventional-changelog --config ./build/changelog-generator/index.js --infile changelog.md",
     "type-check": "tsc --build ./tsconfig-all.json",
     "i18n:checks": "./core/scripts/i18n/assert-strings-collected.sh",
     "i18n:collect-strings": "node core/scripts/i18n/collect-strings.js",
@@ -101,119 +100,85 @@
     "generate-insight-audits": "node core/scripts/generate-insight-audits.js"
   },
   "devDependencies": {
-    "@build-tracker/cli": "^1.0.0-beta.15",
-    "@esbuild-kit/esm-loader": "^2.6.5",
-    "@esbuild-plugins/node-modules-polyfill": "^0.1.4",
-    "@eslint/compat": "^1.3.0",
-    "@eslint/eslintrc": "^3.3.1",
     "@eslint/js": "^9.28.0",
     "@formatjs/icu-messageformat-parser": "^2.6.2",
-    "@jest/fake-timers": "^29.7.0",
-    "@testing-library/preact": "^3.1.1",
-    "@testing-library/preact-hooks": "^1.1.0",
-    "@types/archiver": "^2.1.2",
-    "@types/chrome": "^0.1.42",
-    "@types/configstore": "^6.0.2",
-    "@types/cpy": "^5.1.0",
-    "@types/debug": "^4.1.7",
-    "@types/eslint": "^9.6.1",
-    "@types/estree": "^0.0.50",
-    "@types/gh-pages": "^2.0.0",
-    "@types/google.analytics": "0.0.39",
+    "@jest/fake-timers": "^30.5.2",
+    "@testing-library/preact": "^3.2.4",
+    "@types/archiver": "^8.0.0",
+    "@types/chrome": "^0.3.5",
+    "@types/debug": "^4.1.13",
+    "@types/estree": "^1.0.9",
+    "@types/gh-pages": "^6.1.0",
+    "@types/google.analytics": "0.0.46",
     "@types/gtag.js": "0.0.20",
-    "@types/jpeg-js": "^0.3.7",
-    "@types/jsdom": "^16.2.13",
-    "@types/lodash-es": "^4.17.12",
-    "@types/mocha": "^9.0.0",
+    "@types/jsdom": "^28.0.3",
+    "@types/mocha": "^10.0.10",
     "@types/node": "*",
-    "@types/pako": "^1.0.1",
-    "@types/pg": "^8.20.0",
-    "@types/resize-observer-browser": "^0.1.1",
-    "@types/resolve": "^1.20.2",
-    "@types/semver": "^5.5.0",
-    "@types/ws": "^7.0.0",
-    "@types/yargs": "^17.0.8",
-    "@types/yargs-parser": "^20.2.1",
-    "@typescript-eslint/eslint-plugin": "^8.60.1",
-    "@typescript-eslint/parser": "^8.60.1",
-    "acorn": "^8.5.0",
-    "angular": "^1.7.4",
-    "archiver": "^7.0.1",
-    "builtin-modules": "^3.3.0",
-    "chalk": "^2.4.1",
-    "chrome-devtools-frontend": "1.0.1684555",
-    "colors": "^1.4.0",
-    "concurrently": "^9.2.1",
-    "conventional-changelog-cli": "^2.1.1",
-    "core-js-compat": "^3.44.0",
-    "cpy": "^8.1.2",
-    "csv-validator": "^0.0.3",
-    "esbuild": "0.28.0",
+    "@types/yargs": "^17.0.35",
+    "@types/yargs-parser": "^21.0.3",
+    "acorn": "^8.19.0",
+    "ajv": "^8.20.0",
+    "archiver": "^8.0.0",
+    "chrome-devtools-frontend": "1.0.1726686",
+    "concurrently": "^10.0.6",
+    "conventional-changelog": "^8.1.3",
+    "core-js-compat": "^3.51.0",
+    "esbuild": "0.28.2",
     "eslint": "^9.28.0",
-    "eslint-config-google": "^0.14.0",
-    "eslint-formatter-codeframe": "^7.32.1",
-    "eslint-plugin-import": "^2.25.3",
-    "eslint-plugin-local-rules": "1.1.0",
-    "expect": "^28.1.0",
-    "firebase": "^12.14.0",
-    "gh-pages": "^2.0.1",
-    "glob": "^7.1.3",
-    "globals": "^15.14.0",
-    "idb-keyval": "2.2.0",
-    "jest-mock": "^29.7.0",
-    "jest-snapshot": "^29.7.0",
-    "jsdom": "^12.2.0",
+    "eslint-plugin-import": "^2.32.0",
+    "expect": "^30.5.2",
+    "firebase": "^12.19.0",
+    "gh-pages": "^6.3.0",
+    "globals": "^17.13.0",
+    "idb-keyval": "^6.3.0",
+    "jest-mock": "^30.5.2",
+    "jest-snapshot": "^30.5.2",
+    "jsdom": "^29.1.1",
     "lighthouse-plugin-soft-navigation": "^1.1.0",
-    "magic-string": "^0.25.7",
-    "mime-types": "^2.1.30",
-    "mocha": "^10.0.0",
-    "pako": "^2.1.0",
-    "preact": "^10.7.2",
+    "magic-string": "^1.4.3",
+    "mime-types": "^3.0.2",
+    "mocha": "^12.0.3",
+    "pako": "^3.0.2",
+    "preact": "^10.29.8",
     "pretty-json-stringify": "^0.0.2",
-    "puppeteer": "^25.9.0",
-    "resolve": "^1.22.10",
-    "rollup-plugin-polyfill-node": "^0.12.0",
-    "source-map-support": "^0.5.21",
-    "terser": "^5.48.0",
-    "testdouble": "^3.20.2",
-    "typed-query-selector": "^2.12.0",
+    "puppeteer": "^25.16.0",
+    "terser": "^5.51.2",
+    "testdouble": "^4.0.0",
+    "tsx": "^4.23.15",
+    "typed-query-selector": "^2.12.3",
     "typescript": "6.0.3",
-    "wait-for-expect": "^3.0.2",
+    "typescript-eslint": "^8.60.1",
+    "wait-for-expect": "^4.0.0",
+    "web-features": "^3.44.0",
     "webtreemap-cdt": "^3.2.1"
   },
   "dependencies": {
-    "@paulirish/trace_engine": "0.0.65",
-    "@sentry/node": "^10.0.0",
-    "ajv": "^8.20.0",
+    "@paulirish/trace_engine": "0.0.67",
+    "@sentry/node": "^11.8.0",
     "ajv-formats": "^3.0.1",
-    "axe-core": "^4.13.0",
-    "chrome-launcher": "^1.2.1",
-    "configstore": "^7.0.0",
+    "axe-core": "4.14.0",
+    "chrome-launcher": "^1.2.2",
+    "configstore": "^8.0.0",
     "csp_evaluator": "1.1.8",
-    "devtools-protocol": "0.0.1687809",
+    "devtools-protocol": "0.0.1727723",
     "enquirer": "^2.3.6",
     "http-link-header": "^1.1.1",
     "intl-messageformat": "^10.5.3",
-    "jpeg-js": "^0.4.4",
     "js-library-detector": "^6.7.0",
     "lighthouse-logger": "^2.0.2",
     "lighthouse-stack-packs": "1.12.3",
-    "lodash-es": "^4.17.21",
-    "lookup-closest-locale": "6.2.0",
-    "open": "^8.4.0",
-    "puppeteer-core": "^25.9.0",
+    "open": "^11.0.4",
+    "puppeteer-core": "^25.16.0",
     "robots-parser": "^3.0.1",
     "speedline-core": "^1.4.3",
     "third-party-web": "^0.30.0",
-    "tldts-icann": "^7.4.13",
-    "web-features": "^3.39.0",
-    "ws": "^7.0.0",
-    "yargs": "^17.3.1",
-    "yargs-parser": "^21.0.0"
+    "tldts-icann": "^7.4.19",
+    "yargs": "^18.2.0",
+    "yargs-parser": "^22.0.0"
   },
   "resolutions": {
-    "puppeteer/**/devtools-protocol": "0.0.1687809",
-    "puppeteer-core/**/devtools-protocol": "0.0.1687809"
+    "puppeteer/**/devtools-protocol": "0.0.1727723",
+    "puppeteer-core/**/devtools-protocol": "0.0.1727723"
   },
   "repository": {
     "type": "git",
@@ -229,6 +194,5 @@
   "bugs": {
     "url": "https://github.com/GoogleChrome/lighthouse/issues"
   },
-  "homepage": "https://github.com/GoogleChrome/lighthouse#readme",
-  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
+  "homepage": "https://github.com/GoogleChrome/lighthouse#readme"
 }

package/readme.md

@@ -106,10 +106,14 @@ Configuration:
   --only-categories              Only run the specified categories. Available categories: accessibility, best-practices, performance, seo  [array]
   --skip-audits                  Run everything except these audits  [array]
   --disable-full-page-screenshot Disables collection of the full page screenshot, which can be quite large  [boolean]
+  --ignore-status-code           Disables failing on all error status codes, and instead issues a warning.  [boolean]
+  --url-file                     The path to a file containing newline-delimited URLs to audit.  [string]
+  --fail-fast                    Stop auditing remaining URLs immediately if a run fails.  [boolean]
 
 Output:
   --output       Reporter for the results, supports multiple values. choices: "json", "html", "csv"  [array] [default: ["html"]]
-  --output-path  The file path to output the results. Use 'stdout' to write to stdout.
+  --output-path  The file or directory path to output the results. Use 'stdout' to write to stdout.
+                   Directories in the path must already exist. If a directory is specified, the file name will be based on the test URL and date.
                    If using JSON output, default is stdout.
                    If using HTML or CSV output, default is a file in the working directory with a name based on the test URL and date.
                    If using multiple outputs, --output-path is appended with the standard extension for each output type. "reports/my-run" -> "reports/my-run.report.html", "reports/my-run.report.json", etc.
@@ -177,6 +181,12 @@ lighthouse --output-path=~/mydir/foo.out --save-assets
 
 lighthouse --output-path=./report.json --output json
 # saves `./report.json`
+
+lighthouse https://example.com https://example.org
+# audits multiple URLs sequentially and saves `./<HOST>_<DATE>.report.html` for each
+
+lighthouse --url-file=./urls.txt --output-path=./reports
+# audits all URLs in `./urls.txt` and saves reports into the existing `./reports` directory
 ```
 
 ##### Lifecycle Examples
@@ -394,32 +404,17 @@ This section details services that have integrated Lighthouse data. If you're wo
 Other awesome open source projects that use Lighthouse.
 
 * **[auto-lighthouse](https://github.com/TGiles/auto-lighthouse)** - a CLI for crawling a domain and generating mobile and desktop reports for each page.
-* **[Exthouse](https://github.com/treosh/exthouse)** - Analyze the impact of a browser extension on web performance.
-* **[Gimbal](https://labs.moduscreate.com/gimbal-web-performance-audit-budgeting)** - An [open source (MIT licensed)](https://github.com/ModusCreateOrg/gimbal) tool used to measure, analyze, and budget aspects of a web application. Gimbal also integrates reports with GitHub pull requests.
-* **[Gradle Lighthouse Plugin](https://github.com/Cognifide/gradle-lighthouse-plugin)** - An open source Gradle plugin that runs Lighthouse tests on multiple URLs and asserts category score thresholds (useful in continuous integration).
 * **[lighthouse-badges](https://github.com/emazzotta/lighthouse-badges)** - Generate gh-badges (shields.io) based on Lighthouse performance.
-* **[lighthouse-batch](https://github.com/mikestead/lighthouse-batch)** - Run Lighthouse over a number of sites and generate a summary of their metrics/scores.
-* **[lighthouse-batch-parallel](https://github.com/Carr1005/lighthouse-batch-parallel)** - Run multiple Lighthouse runs in parallel to accelerate the data collecting process, get the result stream (csv, json, js object) in your own process (warning: performance results may be volatile).
 * **[lighthouse-check-action](https://github.com/foo-software/lighthouse-check-action)** - A GitHub Action to run Lighthouse in a workflow, featuring Slack notifications and report upload to S3.
 * **[lighthouse-check-orb](https://circleci.com/orbs/registry/orb/foo-software/lighthouse-check)** - A CircleCI Orb to run Lighthouse in a workflow, featuring Slack notifications and report upload to S3.
-* **[andreasonny83/lighthouse-ci](https://github.com/andreasonny83/lighthouse-ci)** - Run Lighthouse and assert scores satisfy your custom thresholds.
 * **[GoogleChrome/lighthouse-ci](https://github.com/GoogleChrome/lighthouse-ci)** - (**official**) Automate running Lighthouse for every commit, viewing the changes, and preventing regressions.
 * **[lighthouse-ci-action](https://github.com/treosh/lighthouse-ci-action)** - A GitHub Action that makes it easy to run Lighthouse in CI and keep your pages small using performance budgets.
-* **[lighthouse-gh-reporter](https://github.com/carlesnunez/lighthouse-gh-reporter)** - Run Lighthouse in CI and report back in a comment on your pull requests
-* **[lighthouse-jest-example](https://github.com/justinribeiro/lighthouse-jest-example)** - Gather performance metrics via Lighthouse and assert results with Jest; uses Puppeteer to start Chrome with network emulation settings defined by WebPageTest.
-* **[lighthouse-lambda](https://github.com/Otterseer/lighthouse-lambda)** - Run Lighthouse on AWS Lambda with prebuilt stable desktop Headless Chrome.
 * **[lighthouse-matchers](https://github.com/ackama/lighthouse-matchers)** - Provides RSpec matchers for executing and evaluating Google Chrome Lighthouse audit scores.
-* **[lighthouse-mocha-example](https://github.com/rishichawda/lighthouse-mocha-example)** - Run Lighthouse performance tests with Mocha and chrome-launcher.
-* **[lighthouse-monitor](https://github.com/verivox/lighthouse-monitor)** - Run Lighthouse against all your URLs. Send metrics to any backend you want, save all reports with automatic data retention, and compare any two results in a web UI.
 * **[lighthouse-persist](https://github.com/foo-software/lighthouse-persist)** - Run Lighthouse and upload HTML reports to an AWS S3 bucket.
 * **[lighthouse-viewer](https://github.com/dvelasquez/lighthouse-viewer/tree/main/packages/lighthouse-viewer)** - Render the Lighthouse JSON into a report, using the Lighthouse Report Renderer repackaged as UMD and ESM. Also available with React, Svelte and Vue wrappers.
-* **[lighthouse4u](https://github.com/godaddy/lighthouse4u)** - LH4U provides Google Lighthouse as a service, surfaced by both a friendly UI+API, and backed by Elastic Search for easy querying and visualization.
-* **[react-lighthouse-viewer](https://www.npmjs.com/package/react-lighthouse-viewer)** - Render a Lighthouse JSON report in a React Component.
+* **[react-lighthouse-viewer](https://github.com/blencorp/react-lighthouse-viewer)** - Render a Lighthouse JSON report in a React Component.
 * **[site-audit-seo](https://github.com/viasite/site-audit-seo)** - CLI tool for SEO site audit, crawl site, lighthouse each page. Output to console and tables in csv, xlsx, json, web or Google Drive.
-* **[webpack-lighthouse-plugin](https://github.com/addyosmani/webpack-lighthouse-plugin)** - Run Lighthouse from a Webpack build.
-* **[cypress-audit](https://github.com/mfrachet/cypress-audit)** - Run Lighthouse and Pa11y audits directly in your E2E test suites.
-* **[laravel-lighthouse](https://github.com/adityadees/laravel-lighthouse)** - Google Lighthouse wrapper for laravel framework to run Google Lighthouse CLI with custom option and can automatically save result in your server directory.
-* **[Neodymium](https://github.com/Xceptance/neodymium/wiki/Accessibility)** - The Neodymium test automation framework integrates Lighthouse for accessibility and Web Vitals verification, allowing programmatic validation and assertion of all audit values.
+* **[Neodymium](https://docs.xceptance.com/neodymium/features/accessibility/)** - The Neodymium test automation framework integrates Lighthouse for accessibility and Web Vitals verification, allowing programmatic validation and assertion of all audit values.
 
 ## FAQ
 

package/report/generator/file-namer.d.ts

@@ -1,5 +1,5 @@
 /**
- * Generate a filenamePrefix of hostname_YYYY-MM-DD_HH-MM-SS.
+ * Generate a filenamePrefix of hostname-pathname_YYYY-MM-DD_HH-MM-SS.
  * @param {{finalDisplayedUrl: string, fetchTime: string}} lhr
  * @return {string}
  */

package/report/generator/file-namer.js

@@ -28,19 +28,20 @@ function getFilenamePrefix(name, fetchTime) {
   dateParts.unshift(dateParts.pop());
   const dateStr = dateParts.join('-');
 
-  const filenamePrefix = `${name}_${dateStr}_${timeStr}`;
+  const filenamePrefix = `${name.slice(0, 200)}_${dateStr}_${timeStr}`;
   // replace characters that are unfriendly to filenames
   return filenamePrefix.replace(/[/?<>\\:*|"]/g, '-');
 }
 
 /**
- * Generate a filenamePrefix of hostname_YYYY-MM-DD_HH-MM-SS.
+ * Generate a filenamePrefix of hostname-pathname_YYYY-MM-DD_HH-MM-SS.
  * @param {{finalDisplayedUrl: string, fetchTime: string}} lhr
  * @return {string}
  */
 function getLhrFilenamePrefix(lhr) {
-  const hostname = new URL(lhr.finalDisplayedUrl).hostname;
-  return getFilenamePrefix(hostname, lhr.fetchTime);
+  const {hostname, pathname} = new URL(lhr.finalDisplayedUrl);
+  const name = hostname + pathname.replace(/\/$/, '');
+  return getFilenamePrefix(name, lhr.fetchTime);
 }
 
 /**

package/report/generator/flow-report-assets.js

@@ -7,9 +7,7 @@
 
 import fs from 'fs';
 
-import {getModuleDirectory} from '../../shared/esm-utils.js';
-
-const moduleDir = getModuleDirectory(import.meta);
+const moduleDir = import.meta.dirname;
 
 /* eslint-disable max-len */
 const FLOW_REPORT_TEMPLATE = fs.readFileSync(`${moduleDir}/../../flow-report/assets/standalone-flow-template.html`, 'utf8');

package/report/generator/report-assets.js

@@ -8,9 +8,8 @@
 import fs from 'fs';
 
 import {flowReportAssets} from './flow-report-assets.js';
-import {getModuleDirectory} from '../../shared/esm-utils.js';
 
-const moduleDir = getModuleDirectory(import.meta);
+const moduleDir = import.meta.dirname;
 
 const REPORT_TEMPLATE = fs.readFileSync(moduleDir + '/../assets/standalone-template.html',
     'utf8');

package/report/renderer/category-renderer.js

@@ -71,7 +71,7 @@ export class CategoryRenderer {
     if (audit.stackPacks) {
       audit.stackPacks.forEach(pack => {
         const packElmImg = this.dom.createElement('img', 'lh-audit__stackpack__img');
-        packElmImg.src = pack.iconDataURL;
+        this.dom.safelySetImageSrc(packElmImg, pack.iconDataURL);
         packElmImg.alt = pack.title;
 
         const snippets = this.dom.convertMarkdownLinkSnippets(pack.description, {
@@ -141,7 +141,7 @@ export class CategoryRenderer {
 
     const imgEl = this.dom.createElement('img', 'lh-final-ss-image');
     const finalScreenshotDataUri = audit.details.data;
-    imgEl.src = finalScreenshotDataUri;
+    this.dom.safelySetImageSrc(imgEl, finalScreenshotDataUri);
     imgEl.alt = audit.title;
 
     const firstCatHeaderEl = this.dom.find('.lh-category .lh-category-header', categoriesEl);

package/report/renderer/details-renderer.js

@@ -202,7 +202,7 @@ export class DetailsRenderer {
   _renderThumbnail(details) {
     const element = this._dom.createElement('img', 'lh-thumbnail');
     const strValue = details;
-    element.src = strValue;
+    this._dom.safelySetImageSrc(element, strValue);
     element.title = strValue;
     element.alt = '';
     return element;
@@ -429,6 +429,7 @@ export class DetailsRenderer {
       this._dom.safelySetHref(entityLinkEl, matchedEntity.homepage);
       if (entityLinkEl.href) {
         entityLinkEl.target = '_blank';
+        entityLinkEl.rel = 'noopener';
         entityLinkEl.title = Globals.strings.openInANewTabTooltip;
         entityLinkEl.classList.add('lh-report-icon--external');
         firstTdEl.append(' ', entityLinkEl);
@@ -735,7 +736,7 @@ export class DetailsRenderer {
     for (const thumbnail of details.items) {
       const frameEl = this._dom.createChildOf(filmstripEl, 'div', 'lh-filmstrip__frame');
       const imgEl = this._dom.createChildOf(frameEl, 'img', 'lh-filmstrip__thumbnail');
-      imgEl.src = thumbnail.data;
+      this._dom.safelySetImageSrc(imgEl, thumbnail.data);
       imgEl.alt = `Screenshot`;
     }
     return filmstripEl;

package/report/renderer/dom.d.ts

@@ -68,15 +68,21 @@ export class DOM {
      * Set link href, but safely, preventing `javascript:` protocol, etc.
      * @see https://github.com/google/safevalues/
      * @param {HTMLAnchorElement} elem
-     * @param {string} url
+     * @param {string|undefined} url
      */
-    safelySetHref(elem: HTMLAnchorElement, url: string): void;
+    safelySetHref(elem: HTMLAnchorElement, url: string | undefined): void;
     /**
      * Only create blob URLs for JSON & HTML
      * @param {HTMLAnchorElement} elem
      * @param {Blob} blob
      */
     safelySetBlobHref(elem: HTMLAnchorElement, blob: Blob): void;
+    /**
+     * Set img src, but safely, only allowing `https:`, `http:`, and `data:image/`.
+     * @param {HTMLImageElement} elem
+     * @param {string} url
+     */
+    safelySetImageSrc(elem: HTMLImageElement, url: string): void;
     /**
      * @param {string} markdownText
      * @return {Element}

package/report/renderer/dom.js

@@ -169,7 +169,7 @@ export class DOM {
    * Set link href, but safely, preventing `javascript:` protocol, etc.
    * @see https://github.com/google/safevalues/
    * @param {HTMLAnchorElement} elem
-   * @param {string} url
+   * @param {string|undefined} url
    */
   safelySetHref(elem, url) {
     // Defaults to '' to fix proto roundtrip issue. See https://github.com/GoogleChrome/lighthouse/issues/12868
@@ -189,6 +189,8 @@ export class DOM {
 
     if (parsed && allowedProtocols.includes(parsed.protocol)) {
       elem.href = parsed.href;
+    } else {
+      elem.removeAttribute('href');
     }
   }
 
@@ -205,6 +207,32 @@ export class DOM {
     elem.href = href;
   }
 
+  /**
+   * Set img src, but safely, only allowing `https:`, `http:`, and `data:image/`.
+   * @param {HTMLImageElement} elem
+   * @param {string} url
+   */
+  safelySetImageSrc(elem, url) {
+    url = url || '';
+
+    if (url.startsWith('data:image/')) {
+      elem.src = url;
+      return;
+    }
+
+    const allowedProtocols = ['https:', 'http:'];
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch (_) {}
+
+    if (parsed && allowedProtocols.includes(parsed.protocol)) {
+      elem.src = parsed.href;
+    } else {
+      elem.removeAttribute('src');
+    }
+  }
+
   /**
    * @param {string} markdownText
    * @return {Element}

package/report/renderer/element-screenshot-renderer.js

@@ -134,6 +134,9 @@ export class ElementScreenshotRenderer {
    * @param {LH.Result.FullPageScreenshot['screenshot']} screenshot
    */
   static installFullPageScreenshot(el, screenshot) {
+    if (!screenshot.data.startsWith('data:image/') || /['"()\\\r\n]/.test(screenshot.data)) {
+      return;
+    }
     el.style.setProperty('--element-screenshot-url', `url('${screenshot.data}')`);
   }
 

package/report/renderer/performance-category-renderer.js

@@ -183,6 +183,7 @@ export class PerformanceCategoryRenderer extends CategoryRenderer {
         // Add link to score calculator.
         const calculatorLink = this.dom.createChildOf(estValuesEl, 'a', 'lh-calclink');
         calculatorLink.target = '_blank';
+        calculatorLink.rel = 'noopener';
         calculatorLink.textContent = strings.calculatorLink;
         this.dom.safelySetHref(calculatorLink, this._getScoringCalculatorHref(category.auditRefs));
       }
@@ -226,7 +227,8 @@ export class PerformanceCategoryRenderer extends CategoryRenderer {
    * @return {Element|null}
    */
   renderFilterableSection(category, groups, groupNames, metricAudits) {
-    if (groupNames.some(groupName => !groups[groupName])) return null;
+    groupNames = groupNames.filter(groupName => Boolean(groups[groupName]));
+    if (!groupNames.length) return null;
 
     const element = this.dom.createElement('div');
 

package/report/renderer/report-renderer.js

@@ -119,6 +119,7 @@ export class ReportRenderer {
     const channel = report.configSettings.channel;
     const benchmarkIndex = report.environment.benchmarkIndex.toFixed(0);
     const axeVersion = report.environment.credits?.['axe-core'];
+    const ardVersion = report.environment.credits?.['ard'];
 
     const devicesTooltipTextLines = [
       `${Globals.strings.runtimeSettingsBenchmark}: ${benchmarkIndex}`,
@@ -131,6 +132,9 @@ export class ReportRenderer {
     if (axeVersion) {
       devicesTooltipTextLines.push(`${Globals.strings.runtimeSettingsAxeVersion}: ${axeVersion}`);
     }
+    if (ardVersion) {
+      devicesTooltipTextLines.push(`${Globals.strings.runtimeSettingsArdVersion}: ${ardVersion}`);
+    }
 
     let stopwatchLabel = Globals.strings.runtimeAnalysisWindow;
     if (report.gatherMode === 'timespan') {

package/report/renderer/report-utils.d.ts

@@ -116,6 +116,7 @@ export namespace UIStrings {
     let runtimeSettingsUANetwork: string;
     let runtimeSettingsBenchmark: string;
     let runtimeSettingsAxeVersion: string;
+    let runtimeSettingsArdVersion: string;
     let runtimeSettingsScreenEmulation: string;
     let footerIssue: string;
     let runtimeNoEmulation: string;

package/report/renderer/report-utils.js

@@ -441,6 +441,8 @@ const UIStrings = {
   runtimeSettingsBenchmark: 'Unthrottled CPU/Memory Power',
   /** Label for a row in a table that shows the version of the Axe library used. Example row values: 2.1.0, 3.2.3 */
   runtimeSettingsAxeVersion: 'Axe version',
+  /** Label for a row in a table that shows the version of the Agentic Resource Discovery (ARD) specification used. "ARD" should not be translated. Example row values: 0.91 (f073b1e), 1.0 (a1b2c3d) */
+  runtimeSettingsArdVersion: 'ARD version',
   /** Label for a row in a table that shows the screen resolution and DPR that was emulated for the Lighthouse run. Example values: '800x600, DPR: 3' */
   runtimeSettingsScreenEmulation: 'Screen emulation',
 

package/report/renderer/text-encoding.js

@@ -36,7 +36,7 @@ async function toBase64(string, options) {
     } else {
       /** @type {typeof import('pako')=} */
       const pako = window.pako;
-      bytes = /** @type {any} */ (pako.gzip(string));
+      bytes = pako.gzip(string);
     }
   }
 
@@ -62,7 +62,7 @@ function fromBase64(encoded, options) {
   if (options.gzip) {
     /** @type {typeof import('pako')=} */
     const pako = window.pako;
-    return pako.ungzip(bytes, {to: 'string'});
+    return pako.ungzip(bytes, {toText: true});
   } else {
     return new TextDecoder().decode(bytes);
   }

package/report/types/augment-dom.d.ts

@@ -11,3 +11,7 @@
 
 // Import to augment querySelector/querySelectorAll with stricter type checking.
 import '../../types/internal/query-selector';
+
+declare global {
+  var pako: typeof import('pako');
+}

package/shared/esm-utils.d.ts

@@ -3,12 +3,4 @@
  * @param {string} packageName
  */
 export function resolveModulePath(packageName: string): string;
-/**
- * @param {ImportMeta} importMeta
- */
-export function getModulePath(importMeta: ImportMeta): string;
-/**
- * @param {ImportMeta} importMeta
- */
-export function getModuleDirectory(importMeta: ImportMeta): string;
 //# sourceMappingURL=esm-utils.d.ts.map

package/shared/esm-utils.js

@@ -5,8 +5,6 @@
  */
 
 import {createRequire} from 'module';
-import url from 'url';
-import path from 'path';
 
 /**
  * Commonjs equivalent of `require.resolve`.
@@ -17,22 +15,6 @@ function resolveModulePath(packageName) {
   return require.resolve(packageName);
 }
 
-/**
- * @param {ImportMeta} importMeta
- */
-function getModulePath(importMeta) {
-  return url.fileURLToPath(importMeta.url);
-}
-
-/**
- * @param {ImportMeta} importMeta
- */
-function getModuleDirectory(importMeta) {
-  return path.dirname(getModulePath(importMeta));
-}
-
 export {
   resolveModulePath,
-  getModulePath,
-  getModuleDirectory,
 };