Skip to content

Conversation

@jacobcassidy
Copy link
Contributor

What?

Updates the lighthouse dependency in the e2e-test-utils-playwright package.

Why?

This fixes the issue with high-severity vulnerabilities introduced with an older version of the puppeteer-core dependency, as mentioned in #64597. Lighthouse uses puppeteer-core and needs to be updated to use the latest version to remove the old dependencies with vulnerabilities.

How?

  • Updates the e2e-test-utils-playwright's package.json lighthouse dependency to the latest version.
  • Removes the lighthouse+10.4.0.patch file the old version depended on.

Testing Instructions

Same as #64597:

  1. Run npm i --save-dev @wordpress/scripts
  2. Run npm audit and you'll see a warning for high-severity vulnerabilities.
  3. Add the following to your package.json file:
"overrides": {
    "puppeteer-core": "^23.1.0"
}
  1. Run npm i to update the packages.
  2. The vulnerabilities are now removed.

Other Notes

  1. I'm not sure this package can be updated with a simple change in this PR. Someone with more familiarity can chime in. Issue Scripts: Deprecated or remove Puppeteer as e2e test handler #60357 mentions puppeteer and its removal, so if that's in progress and includes the e2e-test-utils-playwright package, we can disregard this PR.

  2. The core package.json and package-lock.json may need to be updated to include lighthouse as a dev dependency as was the case for Scripts: Update puppeteer-core dependency #64597.

@github-actions
Copy link

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: jacobcassidy <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@jacobcassidy jacobcassidy marked this pull request as draft September 23, 2024 08:12
@jacobcassidy
Copy link
Contributor Author

Changed to draft until greater insight into if this can be done or if a complete e2e overhaul via #60357 is in the works.

@gziolo gziolo added [Type] Security Related to security concerns or efforts [Status] Stale Gives the original author opportunity to update before closing. Can be reopened as needed. labels Dec 9, 2024
@gziolo
Copy link
Member

gziolo commented Dec 9, 2024

I'm working on #67708, which contains the same changes regarding the lighthouse package. I hope we can resolve these issues before the next npm publishing planned for Wednesday this week.

@jacobcassidy
Copy link
Contributor Author

@gziolo Sounds great. I'm closing this PR since it's already being covered.

@jacobcassidy jacobcassidy deleted the e2e-script-update branch April 3, 2025 00:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

[Status] Stale Gives the original author opportunity to update before closing. Can be reopened as needed. [Type] Security Related to security concerns or efforts

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants