Update dependency lighthouse to v13 #69

Some performance audits are marked as informative under passing conditions rather than being hidden in the passed audits section. This release reduces the number of audits which have this behavior. (#16315)

New Audits

ensure clickjacking mitigation through XFO or CSP (#16290)

Core

implement more insight audits, handle localization (#16326)
set relevant metric based on insight category (#16325)
add hidden audits for each insight (#16312)
cls-culprits-insight: implement (#16357)
inspector-issues: support SRI message signature issues (#16345)
inspector-issues: add select element a11y issue to types (#16298)
legacy-javascript: upgrade babel and core-js (#16331)
root-causes: grab from trace insights rather than use protocol (#16352)
trace-engine: re-enable invalidations handler (#16293)

Report

use container queries for responsive design in DevTools (#16342)
render LH-only diagnostics alongside insights (#16332)
add button to toggle experimental insights (#16329)
add checklist detail type (#16324)

Deps

upgrade critical dependencies (#16358)
upgrade csp_evaluator to 1.1.5 (#16347)
update to latest chrome-devtools-frontend (#16333)
upgrade puppeteer to 24.2.1 (#16341)
upgrade third-party-web to 0.26.5 (#16340)
upgrade puppeteer to 24.1.1 (#16302)
upgrade trace_engine to 0.0.40 (#16311)

I18n

import (#16360)

Docs

readme: add Sonā to the list of Web Perf services (#16282)

Tests

address upstream changes (#16335)
refresh sample artifacts (#16322)
dbw: revert unload handler expectations (#16353)
devtools: fix error in smoke tests with DT throttling (#16301)

Misc

remove issue assigner (#16317)
ci: workaround new ubuntu 23 security issue for chromium (#16296)
readme: add link to Neodymium (#16349)
release: add script for updating critical dependencies (#16359)
types: add missing type for explanation in NodeValue (#16314)

`v12.2.3`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 133, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Sebastian Neuner @sebastian9er

New Audits

This release adds new security audits. These audits are informative and won't affect your best practices score.

Ensure proper origin isolation with COOP (#16275)
Use a strong HSTS policy (#16257)

Core

font-size: exclude invisible text (#16281)

Deps

upgrade puppeteer to v23.10.4 (#16279)
upgrade trace_engine to 0.0.38 (#16269)

I18n

import (#16283)
inject strings from trace engine npm package (#16272)

Docs

update releasing instructions (#16252)

Tests

update network target type expectations (#16273)
devtools: sync e2e (#16253)

`v12.2.2`

Compare Source

Full Changelog

This release is only for PageSpeed Insights and we expect it to ship within 2 weeks.

Notable Changes

The CPU throttling factor for PageSpeed Insights has been adjusted (#16256) to account for the low CPU performance benchmarks typical in PageSpeed production environments. In general, TBT metric times for all sites should improve when testing with PageSpeed Insights.

All other Lighthouse clients (Lighthouse CLI, the Node API, Lighthouse panel in DevTools, etc) should not be affected by this change.

Tests

inline-fs: fix error in Node 20 (#16262)

`v12.2.1`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 133, and to PageSpeed Insights within 2 weeks.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Nate @servusdei2018
Gareth Jones @G-Rath
JDev @JWebDev

Core

network-monitor: treat EventSource as non-critical (#16225)
target-manager: ignore target if type is unknown (#16221)

CLI

create writeFile destination if necessary (#15990)

Deps

upgrade puppeteer to 23.8.0 (#16248)
upgrade third-party-web to 0.26.1 (#16219)
upgrade puppeteer to 23.5.2 (#16220)
lighthouse-stack-packs: upgrade to 1.12.2 (#16242)
lodash: migrate lodash to lodash-es (#16211)
sentry: upgrade to v7 (#16215)

Clients

lr: set CPU throttling based on benchmark (#16226)
lr: fix wrong render-blocking-resources transfer size (#16190)

I18n

import (#16250)

Docs

readme: add lighthouse-matchers to related projects (#16239)
readme: add Guardius to services list (#16235)

Tests

smoke: fix devtools test runner & a11y errors (#16236)

Misc

ci: upgrade old actions (#16191)

`v12.2.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 130, and to PageSpeed Insights within 2 weeks.

Core

third-party-cookies: update description for 3PCD updates (#16177, #16158)
uses-text-compression: ignore percent threshold for large savings (#16165)

Deps

upgrade puppeteer to 23.3.0 (#16178, #16161)
upgrade axe-core to 4.10.0 (#16162)

Clients

devtools: require third-party-web to be provided (#16166)

I18n

support reusing the same placeholder for ICU (#16159)

Tests

pass logger to smokehouse runners to get log even on timeout (#16175)
update BUILD.gn due to upstream CDT change (#16171)
devtools: sync e2e (#16174)
devtools: sync e2e (#16160)

Misc

format lighthouse-result.proto (#16170)

`v12.1.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 129, and to PageSpeed Insights within 2 weeks.

Core

import lantern from trace engine (#16092)
long-tasks: link to latest guidance (#16138)
stylesheets: disable transient stylesheet detection (#16121)
third-party-summary: correct blocking time calculation (#16117)
trace-engine-result: disable invalidations handler (#16142)

Deps

upgrade trace_engine to 0.0.32 (#16143)
upgrade puppeteer to 22.15.0 (#16139)
upgrade third-party-web to 0.24.5 (#16140)
upgrade puppeteer to 22.13.1 (#16123)
upgrade typescript to 5.5.3 (#16091)

Tests

devtools: sync e2e (#16120)
treemap: ignore cookie deprecation error (#16141)

Misc

remove alertdesk from README (#16133)
build: update README.chromium when rolling devtools (#16144)

`v12.0.0`

Compare Source

Full Changelog

We expect this release to ship in the DevTools of Chrome 128, and to PageSpeed Insights within 2 weeks.

New Contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Hamir Mahal @hamirmahal
angad-sethi @angad-sethi
Junaid Ramzan @ajuni880

Notable Changes

remove first-meaningful-paint metric (#16047)

Core

move simulator creation and network analysis to lib/lantern (#16003)
handle target crash at any point (#15985)
aria-allowed-role: fix title and description (#16042)
inspector-issues: add shared dictionary issue (#15993)
lantern: refactor to DevTools modules convention (#16071)
lantern: rename files to PascalCase (#16068)
lantern: remove last usages of Lighthouse NetworkRequest (#16067)
lantern: remove usage of Lighthouse constants module (#16062)
lantern: remove all LH types (#16061)
lantern: move tbt-util.js to lib/lantern (#16058)
lantern: separate TraceEngine specific code (#16051)
lantern: extract main thread events w/o TraceProcessor (#16049)
lantern: remove usage of Lighthouse's ProcessedNavigation (#16048)
lantern: use LCP instead of FMP for TTI simulation bounds (#16046)
lantern: use computed artifact to create graph using trace (#16040)
lantern: rename NetworkRequest record to rawRequest (#16037)
lantern: resolve some differences when using trace (#16033)
lantern: create network graph from trace (experimental) (#16026)
network: align headers end time with send when no data received (#16044)
network: fix time units in network quiet calc (#16013)
test: add generatable squoosh trace (#15997)
test: add generatable trace for paint metrics (#15994)
test: add generatable iframe trace (#15995)
types: add missing fields to Result.Category and NodeDetails (#16006)

CLI

stop treating chrome launcher kill() as async (#15998)

Deps

upgrade puppeteer to 22.11.1 (#16070)
upgrade chrome-launcher to 1.1.2 (#16069)
upgrade puppeteer to 22.10.0 (#16054)
upgrade third-party-web to 0.24.3 (#16055)
upgrade axe-core to 4.9.1 (#16056)

I18n

import (#16080)

Docs

remove await from chrome.kill() (#15982)

Tests

use newer traces in network-analyzer-test.js (#16043)
default to 0 for network trace data length (#16041)
update remaining old traces for Lantern (#16039)
use new trace in metrics-test for pwa (#16025)
update many test traces, support .json.gz (#16007)
add timeout to runSmokeTest (#16017)
fix devtools e2e test runner (#16018)
reduce expected value of render-blocking-requests smoke (#16011)
update interactive test trace (#16001)
use new button class name for devtools run script (#15999)
ci: remove reference to deleted smoke test (#16010)
lantern: fix some tests not running (#16073)
lantern: refactor to DevTools test convention (#16072)
lantern: remove usage of devtoolsLog in simulator tests (#16065)
lantern: remove usage of computed SpeedIndex (#16064)
lantern: remove usage of computed PageDependencyGraph (#16063)
lantern: use TraceEngine directly in test fixtures (#16057)
lantern: remove Speedline from Lantern unit test for now (#16060)
lantern: remove

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

bolt-new-by-stackblitz · 2025-10-10T03:09:50Z

Run & review this pull request in StackBlitz Codeflow.

socket-security · 2025-10-10T03:11:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	lighthouse@13.0.1

View full report

socket-security · 2026-01-08T20:58:57Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Malicious package: npm `acorn` Note: This VS Code extension is classified as malware because it exhibits high-confidence brandjacking and typosquatting indicators that strongly imply deceptive distribution and user impersonation: Publisher impersonation: The VSIX claims to be “JFrog VSCode Extension,” but it is published by `Artifactory-Software-Studio`, not the official JFrog publisher. Typosquatted identifier: The extension’s identity is `vscode-jrrog-extension` (note the “jrrog” typo), which is a look-alike of the official JFrog extension identifier and consistent with marketplace typosquat tactics. Abuse of trust via branding: The manifest and package metadata deliberately reuse JFrog’s brand name (“JFrog VSCode Extension”) to induce installation under false provenance. High-risk capability overlap: The extension’s functionality includes reading JFrog CLI configuration/credentials and initiating outbound network connections for scanning workflows. In a typosquatted/impersonating package, these capabilities materially increase the likelihood of credential theft or sensitive project metadata leakage, regardless of whether the current bundle contains overt C2 logic. Together, the deceptive provenance (non-official publisher + typo-lookalike ID + brand reuse) is sufficient to classify the extension as malicious because it is designed to obtain installs by masquerading as a trusted vendor extension, a common precursor to credential harvesting and supply-chain compromise. From: pnpm-lock.yaml → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is known malware? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: It is strongly recommended that malware is removed from your codebase. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Malicious package: npm `function-bind` Note: This VS Code extension is classified as malware because it exhibits high-confidence brandjacking and typosquatting indicators that strongly imply deceptive distribution and user impersonation: Publisher impersonation: The VSIX claims to be “JFrog VSCode Extension,” but it is published by `Artifactory-Software-Studio`, not the official JFrog publisher. Typosquatted identifier: The extension’s identity is `vscode-jrrog-extension` (note the “jrrog” typo), which is a look-alike of the official JFrog extension identifier and consistent with marketplace typosquat tactics. Abuse of trust via branding: The manifest and package metadata deliberately reuse JFrog’s brand name (“JFrog VSCode Extension”) to induce installation under false provenance. High-risk capability overlap: The extension’s functionality includes reading JFrog CLI configuration/credentials and initiating outbound network connections for scanning workflows. In a typosquatted/impersonating package, these capabilities materially increase the likelihood of credential theft or sensitive project metadata leakage, regardless of whether the current bundle contains overt C2 logic. Together, the deceptive provenance (non-official publisher + typo-lookalike ID + brand reuse) is sufficient to classify the extension as malicious because it is designed to obtain installs by masquerading as a trusted vendor extension, a common precursor to credential harvesting and supply-chain compromise. From: pnpm-lock.yaml → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is known malware? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: It is strongly recommended that malware is removed from your codebase. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

renovate bot force-pushed the renovate/lighthouse-13.x branch 2 times, most recently from c969666 to 9fe3a27 Compare October 22, 2025 20:01

renovate bot force-pushed the renovate/lighthouse-13.x branch from 9fe3a27 to 954aae7 Compare November 10, 2025 23:00

renovate bot force-pushed the renovate/lighthouse-13.x branch from 954aae7 to 2485af6 Compare November 18, 2025 23:32

renovate bot force-pushed the renovate/lighthouse-13.x branch from 2485af6 to 060c24b Compare December 3, 2025 16:50

renovate bot force-pushed the renovate/lighthouse-13.x branch from 060c24b to c93c142 Compare December 31, 2025 18:27

Update dependency lighthouse to v13

c22176e

renovate bot force-pushed the renovate/lighthouse-13.x branch from c93c142 to c22176e Compare January 8, 2026 20:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency lighthouse to v13 #69

Update dependency lighthouse to v13 #69

Uh oh!

renovate bot commented Oct 10, 2025 •

edited

Loading

Uh oh!

bolt-new-by-stackblitz bot commented Oct 10, 2025

Uh oh!

socket-security bot commented Oct 10, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Update dependency lighthouse to v13 #69

Are you sure you want to change the base?

Update dependency lighthouse to v13 #69

Uh oh!

Conversation

renovate bot commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Core

Core

New contributors

Notable Changes

Core

CLI

Report

Deps

I18n

Tests

Misc

New contributors

Core

Report

Deps

I18n

Tests

Misc

New contributors

Core

I18n

Tests

Misc

New Audits

Core

Deps

Tests

Core

New contributors

Notable Changes

Core

Report

Deps

Docs

Tests

Misc

New contributors

Core

Report

Deps

Clients

Tests

Misc

New contributors

Notable Changes

Core

Report

Deps

Docs

Tests

Misc

Core

Notable Changes

Core

Deps

I18n

Tests

Misc

New contributors

Notable Changes

New Audits

Core

Report

Deps

I18n

Docs

Tests

Misc

New contributors

New Audits

Core

Deps

renovate bot commented Oct 10, 2025 •

edited

Loading

socket-security bot commented Oct 10, 2025 •

edited

Loading