Skip to content

[Snyk] Fix for 11 vulnerabilities #555

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 11 vulnerabilities #555

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions scripts/bench/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,14 @@
"chalk": "^2.1.0",
"chrome-launcher": "^0.10.5",
"cli-table": "^0.3.1",
"http-server": "^0.10.0",
"http-server": "^0.11.2",
"http2": "^3.3.6",
"lighthouse": "^3.2.1",
"lighthouse": "^8.1.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This major version upgrade of lighthouse from ^3.2.1 to ^8.1.0 introduces significant breaking changes that will cause the benchmark scripts to fail.

Here are some of the issues I've identified by looking at the usage in scripts/bench/benchmark.js:

  • API changes: The programmatic API has changed. For example, require('lighthouse') now returns a function lighthouse instead of a class Lighthouse.
  • Removed metrics: The first-meaningful-paint metric, which is used in scripts/bench/benchmark.js, has been removed in newer versions of Lighthouse. This will cause a runtime error.
  • Configuration path: The path to the performance config, lighthouse/lighthouse-core/config/perf-config, has likely changed.

To resolve this, the benchmark scripts (e.g., scripts/bench/benchmark.js) need to be updated to be compatible with the Lighthouse v8 API. Without these changes, the benchmarks will be broken.

"mime": "^1.3.6",
"minimist": "^1.2.3",
"ncp": "^2.0.0",
"nodegit": "^0.18.3",
"rimraf": "^2.6.1",
"nodegit": "^0.24.3",
"rimraf": "^4.3.1",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This major version upgrade of rimraf from ^2.6.1 to ^4.3.1 introduces breaking changes.

  1. ESM Module: rimraf v4 and later are ESM-only packages. The benchmark scripts use CommonJS (require), which cannot import ESM modules directly. This will cause the script scripts/bench/build.js to fail with an ERR_REQUIRE_ESM error.
  2. API Change: rimraf v3 changed its API to be promise-based, removing support for callbacks. The cleanDir function in scripts/build.js uses the old callback-style API, which will not work with rimraf v3+.

I suggest downgrading to rimraf@^3.0.2. This version is still CommonJS compatible, which resolves the first issue. The code in scripts/build.js will still need to be updated to use promises (async/await) instead of callbacks to fix the second issue.

    "rimraf": "^3.0.2",

"stats-analysis": "^2.0.0"
}
}
Loading