Update dependency lighthouse to v13 by renovate[bot] · Pull Request #69 · advanced-astro/warpspeed-

renovate · 2025-10-10T03:09:47Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
lighthouse	`9.6.8` → `13.4.1`

Release Notes

GoogleChrome/lighthouse (lighthouse)

`v13.4.1`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 152, and to PageSpeed Insights within 2 weeks.

Core

baseline: Dynamic Baseline High calculation and feature summary improvements (#17107, #17112, #17132)
webmcp: Refined WebMCP gatherers to check document.modelContext and removed snapshot mode (#17128, #17129)
docs: Added documentation links for agentic audits (#17108)
network: Detailed error messages when fetching robots.txt or llms.txt fails (#17083)

Clients

viewer: Enabled Agentic Browsing category via PSI API (#17090)
extension: Version bump (#17094)

Deps

Upgraded dependencies, including @sentry/node to v10 (#17079, #17093, #17135)

Tests & Build

build: Minified Lightrider bundle (#17117)
tests: Added bundle size check and updated Puppeteer API tests (#17088, #17096)
devtools: Synced e2e tests from devtools-frontend (#17121)

Infrastructure & Workflow

ci: Configured npm Trusted Publishing via OIDC and consolidated release workflows (#16944, #17097, #17098, #17099, #17100)
docs: Added verification skill and documentation updates (#17091, #17109, #17137)

`v13.4.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 151, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Thomas Steiner @tomayac
KS Nithin @Nithin0620
Emanuele @emazack
Kirtikumar Anandrao Ramchandani @KirtiRamchandani
Rin @RinZ27
Michael Hablich @natorion

Core

canonical: improve validation for invalid URLs (#16765)
llms-txt: allow leading whitespace for header check (#17057)
geolocation-on-start: mention geolocation element (#16835)
add public Lighthouse types entrypoint (#17028)
match scripts to network requests using frameId (#16774)
config: import LH types (#17048)
driver: add ExecutionContext.evaluateOnObject (#17050)
driver: check if usage data exists before using (#17033)

Report

fix performance gauge label, improve load animation (#17045)
decouple link creation from link details rendering (#17049)
viewer: persist dark mode when when changing langauge (#17063)

Deps

upgrade deps (#17070)
upgrade typescript to 6.0.3 (#17060)
upgrade terser to 5.48.0 (#17059)
upgrade esbuild to 0.28.0 (#17058)
upgrade trace_engine to 0.0.65 (#17046)
upgrade puppeteer to 25.0.2 (#17019)

Clients

viewer: prevent toast showing on load (#17069)
viewer: clear github auth token on 401 error (#17064)
viewer: disable agentic-browsing in PSI api call (#17041)

I18n

import (#17071)

Docs

add agentic web issue template (#17020)

Tests

exclude origin-isolation-coop-present smoke test (#17072)
remove accidental .only (#17042)
remove unused c8 (#16845)
llms-txt: add coverage for network failure and heading edge cases (#17040)
viewer: update psi key (#17037)

Misc

migrate typescript moduleResolution to bundler (#17061)
build: generate subset of web-features data (#17047)
ci: add Node 26 to unit matrix (#17062)
ci: bump actions/upload-artifact from 4 to 7 (#16938)

`v13.3.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 151, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Thomas Steiner @tomayac
KS Nithin @Nithin0620
Emanuele @emazack
Kirtikumar Anandrao Ramchandani @KirtiRamchandani
Rin @RinZ27
Michael Hablich @natorion

Core

canonical: improve validation for invalid URLs (#16765)
llms-txt: allow leading whitespace for header check (#17057)
geolocation-on-start: mention geolocation element (#16835)
add public Lighthouse types entrypoint (#17028)
match scripts to network requests using frameId (#16774)
config: import LH types (#17048)
driver: add ExecutionContext.evaluateOnObject (#17050)
driver: check if usage data exists before using (#17033)

Report

fix performance gauge label, improve load animation (#17045)
decouple link creation from link details rendering (#17049)
viewer: persist dark mode when when changing langauge (#17063)

Deps

upgrade deps (#17070)
upgrade typescript to 6.0.3 (#17060)
upgrade terser to 5.48.0 (#17059)
upgrade esbuild to 0.28.0 (#17058)
upgrade trace_engine to 0.0.65 (#17046)
upgrade puppeteer to 25.0.2 (#17019)

Clients

viewer: prevent toast showing on load (#17069)
viewer: clear github auth token on 401 error (#17064)
viewer: disable agentic-browsing in PSI api call (#17041)

I18n

import (#17071)

Docs

add agentic web issue template (#17020)

Tests

exclude origin-isolation-coop-present smoke test (#17072)
remove accidental .only (#17042)
remove unused c8 (#16845)
llms-txt: add coverage for network failure and heading edge cases (#17040)
viewer: update psi key (#17037)

Misc

migrate typescript moduleResolution to bundler (#17061)
build: generate subset of web-features data (#17047)
ci: add Node 26 to unit matrix (#17062)
ci: bump actions/upload-artifact from 4 to 7 (#16938)

`v13.2.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 150, and to PageSpeed Insights within 2 weeks.

Notable Changes

New agentic browsing category added to default config (#17002)

Core

agentic-web: add links to category and audit descriptions (#16997)
llms-txt: adjust titles and descriptions and add smoketests (#17005)

Deps

upgrade dependencies (#17006)

Tests

smoke: widen byte efficiency wastedBytes range for ToT (#16996)
webmcp: add webmcp smoketests (#16999)

Misc

bundle: update build-bundle-mcp (#16995)

`v13.1.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 150, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

ducky-duke @ducky-duke
Simon Zünd @szuend

New Audits

webmcp-form-coverage: add audit for missing webmcp tool annotations (#16964)
webmcp-registered-tools: add audit to list registered webmcp tools (#16959)
webmcp-schema-validity: add audit to check WebMCP schema issues (#16973)

Core

implement UKM Invalidate fallback for LCP (#16956)
agentic: add new agentic browsing category (#16953)
agentic_category: add disclaimer to category description (#16990)
config: aggregate agent accessabilty audits (#16982)
config: update llms.txt to refine validation logic (#16986)
config: implement llms.txt check for AI agents (#16970)
config: move specific accessibility audits to default config (#16966)
config: enable and add new axe audits for agentic category (#16965)
config: add accessibility audits to agentic-browsing-config (#16963)
source-maps: guard against out-of-bounds sourceIndex (#16969)
webmcp: adjust how webmcp audits handle lack of WebMCP support (#16987)

Report

create agentic-browsing sample report (#16988)

Deps

upgrade deps (#16992)
upgrade web-features to 3.24.0 (#16977)
upgrade trace_engine to 0.0.64 (#16955)

Docs

release: fix heading style (#16989)
release: update release docs and scripts (#16954)

Misc

prepare devtools build for TS6 upgrade (#16968)
build: include license.md in bundle (#16981)
build: update devtools for agents bundle and tests (#16980)
build: include agentic browsing in cd4a bundle (#16975)

`v13.0.3`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 148, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Iaroslav Shvets @iaroslavshvets

New Audits

baseline: implement baseline compatibility audit (#16904)

Core

baseline: add baseline icons to baseline audit lighthouse report (#16927)
baseline: add web-feature version to audit description (#16937)
baseline: add baseline compatibility audit to default config (#16910)
network: revert strict wrapping of network requests (#16949)
trace: add WebDX feature usage trace category (#16899)

Deps

upgrade deps (#16943)
dependabot: less noisy PRs (#16919)

Clients

build: include missing 3P notices in MCP bundle (#16917)

Docs

fix jsdoc link (#16896)

Tests

lantern trace data must now be downloaded manually (#16789)
fix CI failures and modernize documentation links (#16939)
refresh sample artifacts (#16916)
fix smoke tests relying on mozilla.org (#16901)
fix CI. execContext count, i18n ICU breakage, loud jsdom parse output (#16898)
devtools: sync e2e tests from devtools-frontend (#16908)
smoke: smoke tests for the mcp bundle (#16883)
smokehouse: fix baseline config to use onlyAudits (#16931)

Misc

fix TS7 compatibility issue (declare module syntax) (#16926)
build: shim puppeteer-core in the mcp bundle (#16895)
build: remove soft nav from mcp bundle (#16888)
build: fix mcp bundle shims (#16882)
build: generate third party notices file (#16887)

`v13.0.2`

Compare Source

Fix npm package publish of 13.0.2. Refer to https://github.com/GoogleChrome/lighthouse/releases/tag/v13.0.2.

We expect this release to ship in the DevTools of Chrome 146, and to PageSpeed Insights within 2 weeks.

`v13.0.1`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 146, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Alex Rudenko @OrKoN
Lusa Zhan @lusayaa
Atakan Demircioğlu @atakde
Mimori @Mimori256
Denis @filchakov
_ @Lulucmy

Core

hreflang: update valid-langs.js (#16829)
robots-txt: add Content-Signal directive (#16767)

Report

fix focus in devtools, and in 3-dot menu (#16802)
tooltip: fix tooltip positioning in devtools (#16844)

Docs

readme: add FERU to services list (#16791)
readme: add LightKeeper to the list of Web Perf services (#16830)

Tests

align expected a11y contrast failure with reality (#16824)
skip 'issueAdded types' (#16804)
devtools: sync e2e (#16803)
smoke: deflake devtools smoke tests (#16875)

Misc

build: build-bundle to share esbuild-plugins (#16876)
build: create a bundle for devtools-mcp (#16858)
ci: disable nightly publish schedule (#16825)
strings: fix i18n README typo (#16792)

`v13.0.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 143, and to PageSpeed Insights within a week.

Core

fix incorrect dpr used for responsive images advice (#16771)

`v12.8.2`

Compare Source

Full Changelog

Release article

We expect this release to ship in the DevTools of Chrome 143, and to PageSpeed Insights within a week.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Benjamin R Gibson @brgibson
Leonardo Poletto @leopoletto

Notable Changes

performance: remove audits replaced by performance insights (#16729)
remove preload-fonts, uses-rel-preload audits (#16716)
remove font-size audit (#16701)
remove offscreen-images audit (#16748)
remove no-document-write audit (#16750)
remove uses-passive-event-listeners audit (#16751)
remove third-party-facades audit (#16710)
scoring: adjust a11y weights and document approach (#16624)

Core

remove ResponseCompression artifact (#16755)
remove OptimizedImages artifact (#16754)
remove DOMStats artifact (#16753)
remove CacheContents artifact (#16752)
remove empty first-meaningful-paint audit (#16749)
remove some unused computed artifacts (#16735)
defer to trace engine for lcp-breakdown, ttfb (#16733)
error on unknown category in onlyCategories (#16720)
drop compat traces / devtoolsLogs artifacts (#16708)
import json as modules (#16700)
anchor-elements: don't consider ancestorListeners (#16731)
dom-size-insight: add numericValue (#16741)
emulation: always match host browser's version milestone (#16677)
font-display-insight: disable entity sum for est. savings (#16746)
image-delivery-insight: add node item for image (#16714)
inspector-issues: remove empty arrays (#16736)
legacy-javascript: update caniuse data (#16699)
network-request: remove receiveHeadersStart M115 compat (#16738)
server-response-time: defer to Document Latency insight (#16715)
trace-elements: remove unused event types (#16734)
trace-elements: handle shadow roots (#16718)

CLI

improve description for form-factor flag (#16682)

Report

add adornment to audit description when not scored (#13014)

Deps

upgrade deps (#16760)
remove parse-cache-control (#16747)
upgrade trace_engine to 0.0.61 (#16745)
upgrade @esbuild-kit/esm-loader to 2.6.5 (#16730)
upgrade deps (#16724)
upgrade trace_engine to 0.0.60 (#16723)
remove es-main (#16697)
bump chrome-launcher to 1.2.1 (#16696)
upgrade testdouble, fix mock tests in Node 21+ (#16664)
lighthouse-stack-packs: upgrade to 1.12.3 (#16727)

I18n

import (#16759)

Tests

update some comments (#16744)
re-enable smoke test for lcp-breakdown-insight score (#16743)
re-enable dom-size-insight node smoke test (#16742)
enable smoke test for lcp lazy load in shadow tree (#16739)
re-enable csp block smoke test, make less restrictive (#16728)
re-enable startTimespan api test (#16703)
devtools: sync e2e (#16694)
server-response-time: enable lightrider test (#16737)
viewer: re-enable test (#16740)

Misc

replace dead link for insecure origins deprecation (#16711)
upgrade typescript target to es2023 (#16316)
fix core/scripts/legacy-javascript/examine-latest-run.js (#16706)
update min supported node version to 22.19 (#16668)
fix typos in a11y i18n doc comments (#16665)
build: update devtools 3p readme, document debug build (#16695)
proto: add ConfigSettings fields (#15616)
structured-data: remove dead link (#16709)

`v12.8.1`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 141, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

uthem150 @uthem150
Nirav Gondaliya @niravzxv

Core

errors-in-console: truncate large errors (#16619)
insights: passing score (not n/a) for empty results (#16639)
non-composited-animations: separate custom CSS properties (#16627)

Report

viewer: only disable save-gist button on successful save (#16618)

Deps

upgrade deps (#16660)
upgrade trace_engine to 0.0.59 (#16659)
remove semver (#16655)
upgrade tldts-icann (#16657)
upgrade esbuild to 0.25.9 (#16652)
upgrade / drop many dev deps (#16651)
upgrade trace_engine to 0.0.58 (#16649)

I18n

import (#16662)

Tests

disable startTimespan api test (#16653)
disable trusted-types-directive-present smoke test (#16620)
smokehouse: log specific error message when missing tests path (#16648)

Misc

use structuredClone instead of lodash cloneDeep (#16656)

`v12.8.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 140, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Boluwatife Omosowon @bolu-tife
Jonas Thelemann @dargmuesli

Core

network-requests: add initiators to debugData (#16605)

I18n

import (#16616)

Tests

disable csp-block-all smoke test (#16598)

Misc

revert json modules to fully support Node 20 (#16613)
ci: clear devtools build cache (#16615)
logger: bump to 2.0.2 (#16604)
logger: update debug dep to v4 (#16601)
treemap: fix sizes not showing for source map nodes (#16593)

`v12.7.1`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 140, and to PageSpeed Insights within 1 week.

New Audits

mitigate dom-based xss with trusted types (#16493)

Core

tracehouse: fix OOM when computing attributable URLs (#16585)
trusted-types-xss: add link to lighthouse docs (#16590)

Deps

upgrade trace_engine to 0.0.57 (#16589)

Tests

disable issues-mixed-content smoke test (#16586)
add test for trace-engine-result (#16574)
update expectations (#16580)
devtools: avoid failure on Unknown VE Context (#16581)

`v12.7.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 140, and to PageSpeed Insights within a week.

Core

trace-engine-result: initialize SyntheticEventsManager (#16572)

`v12.6.1`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 140, and to PageSpeed Insights within a week.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

demostanis @demostanis
OronW @OronW

Notable Changes

The Performance category in the Lighthouse report now shows performance insight audits by default - read more here.

Core

always include headers even for empty tables (#16534)
expose error stack, artifact on runtimeError (#16524)
cache-insight: fix wrong value being used for transfer size (#16562)
config: throw an error if a filter is an empty array (#15118)
crawlable-anchors: allow placeholder anchor elements (#16292)
gather: add host DPR base artifact (#16559)
gather: deprecate executionContext.evaluateAsync (#16518)
insights: show estimated ms savings (#16563)
inspector-issues: rename to elementAccessibilityIssue (#16561)
link-text: use lang to check for only localized terms (#16526)
network-dependency-tree-insight: add preconnect advice (#16557)
plugins: support scoped npm packages (#16550)
render-blocking-resources: change column label to Duration (#16519)
timing-summary: suppress expected errors (#16520)
trace-elements: remove sentry debugging for invalid impactedNodes (#16523)

Report

show insight performance audits by default (#16552)
fix 3p filter checkbox for insight audits (#16564)
hide highlighter during print (#16544)
remove custom focus outline styles (#16531)
increase max width of 3-dot menu (#16530)
hide treemap, view trace buttons when printing (#16529)

Deps

upgrade trace_engine to 0.0.56 (#16565)
upgrade deps (#16555)
upgrade configstore to 7.0.0 (#16148)
upgrade jest packages to 29.7.0 (#16147)
sentry: upgrade to v9 (#16541)

Docs

recipes: give explicit commands for first building Lighthouse (#16527)

Tests

parallelize lantern database tests (#16545)

Misc

chore: use "Note" indentation in readme (#16533)
chore: reformat to reduce spurious newlines (#16038)
chore: rename traceEngineData to parsedTrace (#16270)
ci: fix logic for nightly publish cron (#16556)
ci: prevent nightly publish if no changes in last day (#16547)
deps: upgrade to eslint 9 (#16327)

`v12.6.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 139, and to PageSpeed Insights within a couple days.

New contributors

Thanks to our new contributor 👽🐷🐰🐯🐻!

Ian Kerins @isker

Core

emulation: bump chrome UA to m136 (#16489)
insights: add a bunch of debugData (#16472)
inspector-issues: remove trusted types csp issue filter (#16514)
inspector-issues: add userReidentificationIssue to artifact (#16497)

Report

remove innerHTML usage from insights announce icon (#16469)

Deps

upgrade deps (#16515)
upgrade trace_engine to 0.0.53 (#16496)
bump chrome-launcher to 1.2.0 (#16479)

Clients

lr: disable modern-http-insight (#16471)

Tests

fix some lantern test failures (#16498)
use newer trace in metrics test (#16492)

Misc

import i18n messages as JSON modules (#16500)
scripts: add bytes-in-trace script (#16477)
treemap: hide unused-bytes view mode when missing data (#16478)
treemap: highlight many nodes on hover in duplicate modules table (#16470)

`v12.5.1`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 137, and to PageSpeed Insights within a few days.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Jack Franklin @jackfranklin
Rob Kodey @rkodey
Clément Barbaza @cba85

Notable Changes

The Performance category in the Lighthouse report now has an option to toggle "insights" - read more here.

Core

disable invalidationTracking trace event to prevent crash (#16451)
migrate audits from devtoolsLogs/traces to DevtoolsLog/Trace (#16448)
modify scoreDisplayMode for insight audits to match Perf panel (#16432)
use with import attributes for legacy-javascript, bump to node 18.20 (#16415)
image-size-responsive: use real mimeType to exclude svg (#16443)
insights: drop slow-css-selector-insight for now (#16457)
insights: implement duplicated-javascript-insight (#16456)
insights: add prominent toggle banner to report (#16461)
insights: implement network-dependency-tree insight (#16407)
optimized-images: ignore internal encoding errors (#16444)
preload-fonts: add Stylesheets to required artifacts (#16421)
stacks: correctly identify angular (#16439)
third-party-cookies: update description (#16464)
tracehouse: fixup parent tasks when fudging endTime (#16420)

Report

add analytics hook for insights state (#16466)
adjust insights notice banner, localize strings (#16463)
add insights group description (#16455)
associate insight audits with stack packs (#16440)
tweak style of insight tables; use system font (#16434)
support node inside list detail, use in insight audits (#16433)
display insights when using toggle, even if hidden (#16431)

Deps

upgrade trace_engine to 0.0.52 (#16465)
upgrade trace_engine to 0.0.51 (#16447)
upgrade deps (#16438)
upgrade typescript to 5.8.2 (#16414)

Docs

fix "standalone-template.html" broken link in report README (#16429)

Tests

disable oopif-scripts smoke for devtools runner (#16446)

Misc

prepare core/lib/legacy-javascript to be published to npm (#16416)
treemap: represent sizes using transfer size (#16460)
treemap: parse options properly from hash params (#16459)
treemap: update coerceOptions to grab initialView (#16458)
treemap: move table to right, remove Tabulator (#16428)
treemap: set initial view mode from options (#16427)
treemap: vary colors within bundle, update fonts (#16403)

`v12.5.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 136, and to PageSpeed Insights within 2 weeks.

Core

trace-engine-result: exclude failed source maps (#16412)

`v12.4.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 136, and to PageSpeed Insights within 2 weeks.

Notable Changes

legacy-javascript has been updated to target Baseline instead of esmodules for determining what code is considered "legacy" (#16366).

Core

enable enhanced traces, pass source maps to trace engine (#16396)
pass lantern settings to trace engine and add logging (#16377)
adapt trace engine i18n functions to LH i18n model (#16365)
computed-artifacts: disallow undefined properties (#16397)
duplicated-javascript: increase threshold from 1 to 10 KiB (#16368)
image-delivery-insight: use strings without savings (#16364)
insights: implement use-cache-insight (#16401)
insights: upgrade and implement forced reflow (#16395)
insights: move to hidden group by default (#16391)
insights: implement font display insight (#16369)
legacy-javascript: rework/revert some unminified bundle detection (#16394)
legacy-javascript: support rollup bu

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

bolt-new-by-stackblitz · 2025-10-10T03:09:50Z

Run & review this pull request in StackBlitz Codeflow.

socket-security · 2026-01-08T20:58:57Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@sentry/node-core` is 60.0% likely obfuscated Confidence: 0.60 Location: Package overview From: pnpm-lock.yaml → `npm/lighthouse@13.4.1` → `npm/@sentry/node-core@10.68.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sentry/node-core@10.68.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `csp_evaluator` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/lighthouse@13.4.1` → `npm/csp_evaluator@1.1.8` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/csp_evaluator@1.1.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

socket-security · 2026-06-11T22:02:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	lighthouse@13.4.1

View full report

renovate Bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from c969666 to 9fe3a27 Compare October 22, 2025 20:01

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 9fe3a27 to 954aae7 Compare November 10, 2025 23:00

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 954aae7 to 2485af6 Compare November 18, 2025 23:32

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 2485af6 to 060c24b Compare December 3, 2025 16:50

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 060c24b to c93c142 Compare December 31, 2025 18:27

renovate Bot force-pushed the renovate/lighthouse-13.x branch from c93c142 to c22176e Compare January 8, 2026 20:58

renovate Bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from 09299e1 to ce16eab Compare January 23, 2026 21:10

renovate Bot force-pushed the renovate/lighthouse-13.x branch from ce16eab to 5e948d6 Compare February 2, 2026 16:02

renovate Bot force-pushed the renovate/lighthouse-13.x branch 3 times, most recently from 26dfc47 to 8ee0498 Compare February 12, 2026 12:44

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 8ee0498 to 1d85d96 Compare February 17, 2026 18:12

renovate Bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from 56fb1ed to cd4dd66 Compare March 5, 2026 21:21

renovate Bot force-pushed the renovate/lighthouse-13.x branch from cd4dd66 to 52fa5d2 Compare March 13, 2026 12:57

renovate Bot force-pushed the renovate/lighthouse-13.x branch 3 times, most recently from 8970a8d to 551a308 Compare April 1, 2026 15:51

renovate Bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from 05ddfd9 to 86612ac Compare April 8, 2026 15:55

renovate Bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from 4f8a81f to 8cffd88 Compare May 1, 2026 19:45

renovate Bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from 1dab038 to 732d8c7 Compare May 12, 2026 14:14

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 732d8c7 to 799fbf2 Compare May 18, 2026 13:39

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 799fbf2 to 4eb6fc5 Compare May 28, 2026 22:15

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 4eb6fc5 to 3656df5 Compare June 2, 2026 00:02

renovate Bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from 03591cc to ee70637 Compare June 11, 2026 22:02

renovate Bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from f23ce4d to f861f1e Compare July 16, 2026 18:55

renovate Bot force-pushed the renovate/lighthouse-13.x branch from f861f1e to 46da999 Compare July 20, 2026 23:49

Update dependency lighthouse to v13

115aa26

renovate Bot force-pushed the renovate/lighthouse-13.x branch from 46da999 to 115aa26 Compare July 24, 2026 22:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency lighthouse to v13#69

Update dependency lighthouse to v13#69
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/lighthouse-13.x

renovate Bot commented Oct 10, 2025 •

edited

Loading

Uh oh!

bolt-new-by-stackblitz Bot commented Oct 10, 2025

Uh oh!

socket-security Bot commented Jan 8, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Core

Clients

Deps

Tests & Build

Infrastructure & Workflow

New contributors

Core

Report

Deps

Clients

I18n

Docs

Tests

Misc

New contributors

Core

Report

Deps

Clients

I18n

Docs

Tests

Misc

Notable Changes

Core

Deps

Tests

Misc

New contributors

New Audits

Core

Report

Deps

Docs

Misc

New contributors

New Audits

Core

Deps

Clients

Docs

Tests

Misc

New contributors

Core

Report

Docs

Tests

Misc

Core

New contributors

Notable Changes

Core

CLI

Report

Deps

I18n

Tests

Misc

New contributors

Core

Report

Deps

I18n

Tests

Misc

New contributors

Core

I18n

Tests

Misc

New Audits

Core

Deps

Tests

renovate Bot commented Oct 10, 2025 •

edited

Loading

socket-security Bot commented Jan 8, 2026 •

edited

Loading

socket-security Bot commented Jun 11, 2026 •

edited

Loading