Lighthouse is using a vulnerable version of inquirer and tmp

[kennethbigler]

Describe the bug
Lighthouse is using a vulnerable version of inquirer and tmp.

To Reproduce
Steps to reproduce the behavior:

1. run npm i
2. run npm audit fix

Expected behavior
There should be 0 vulnerabilities when running npm audit.

Logs/Screenshots

# npm audit report

tmp  <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
fix available via `npm audit fix --force`
Will install @lhci/cli@0.1.0, which is a breaking change
node_modules/external-editor/node_modules/tmp
node_modules/tmp
  @lhci/cli  *
  Depends on vulnerable versions of inquirer
  Depends on vulnerable versions of tmp
  node_modules/@lhci/cli
  external-editor  >=1.1.1
  Depends on vulnerable versions of tmp
  node_modules/external-editor
    inquirer  3.0.0 - 8.2.6 || 9.0.0 - 9.3.7
    Depends on vulnerable versions of external-editor
    node_modules/gts/node_modules/inquirer
    node_modules/inquirer
      gts  *
      Depends on vulnerable versions of inquirer
      node_modules/gts

5 low severity vulnerabilities

Environment (please complete the following information):

• OS: Mac Tahoe 26.3
• Browser: N/A
• Lighthouse Version: v0.15.1
• Node Version: v24.11.0
• npm Version: v11.9.0

Additional context
N/A