Skip to content

fix: remove LHCI js-yaml 3 path#186

Merged
saagpatel merged 3 commits into
masterfrom
codex/fix/remove-lhci-js-yaml
Jul 4, 2026
Merged

fix: remove LHCI js-yaml 3 path#186
saagpatel merged 3 commits into
masterfrom
codex/fix/remove-lhci-js-yaml

Conversation

@saagpatel

Copy link
Copy Markdown
Owner

What

  • Replace the @lhci/cli dependency path with a repo-owned Lighthouse budget runner.
  • Keep the existing pnpm perf:lhci and pnpm perf:lhci:prod command contracts as aliases to the new runner.
  • Remove the LHCI-specific overrides and lockfile entries that kept @lhci/utils -> js-yaml@3.15.0 present.
  • Add .prettierignore for pnpm-lock.yaml so dependency PRs do not churn the pnpm lockfile through generic YAML formatting.

Why

  • Fixes Fully remove vulnerable js-yaml 3.x from LHCI dependency tree #185.
  • The prior LHCI wrapper still resolved js-yaml@3.15.0 through @lhci/utils@0.15.1, and forcing js-yaml v4 under LHCI would be brittle because LHCI utilities still use the old v3 API.
  • This preserves the release/performance gate while removing the stale transitive dependency path.

How

  • scripts/perf/run-lighthouse-budget.mjs reads the existing .lighthouserc*.json files, starts the configured preview server, runs Lighthouse for the configured URLs/runs, and enforces category/audit assertions with warn/error semantics.
  • package.json now exposes perf:lighthouse* commands and keeps perf:lhci* aliases for compatibility.
  • pnpm-workspace.yaml and pnpm-lock.yaml drop the LHCI/js-yaml-v3 override and dependency entries.

Testing

  • pnpm why js-yaml -> only js-yaml@4.3.0 remains.
  • rg -n '@lhci|js-yaml@3|js-yaml: 3\.15\.0|lighthouse@12\.6\.1|"@lhci/cli"' package.json pnpm-workspace.yaml pnpm-lock.yaml -> no matches.
  • pnpm audit --audit-level high -> pass; still reports one unrelated moderate OpenTelemetry advisory through direct Lighthouse.
  • pnpm exec prettier --check package.json pnpm-workspace.yaml scripts/perf/run-lighthouse-budget.mjs -> pass.
  • pnpm exec eslint scripts/perf/run-lighthouse-budget.mjs -> pass.
  • pnpm perf:build -> pass.
  • pnpm perf:bundle -> pass.
  • pnpm perf:assets -> pass.
  • pnpm perf:memory -> pass.
  • pnpm perf:lhci -> pass, 3 Lighthouse runs, all configured assertions passed.
  • pnpm perf:lhci:prod -> pass, 3 Lighthouse runs, all production assertions passed.
  • Commit hooks also passed: branch/atomic/generated/large-file/secrets/commitlint.

Performance impact

  • No application runtime code changed.
  • The Lighthouse gate still performs three local preview audits and enforces the existing score/metric assertions.
  • Local budget checks passed for build, bundle, assets, memory, default Lighthouse, and production Lighthouse.

Risk/Notes

  • The new runner implements the assertion shapes currently used by this repo: category minScore checks and audit maxNumericValue checks. If future configs use more LHCI assertion operators, the runner should be extended deliberately.
  • pnpm audit --audit-level high passes, but direct lighthouse@13.3.0 still brings one moderate OpenTelemetry advisory. That is separate from the js-yaml/LHCI path fixed here.

Screenshots (UI only)

  • Not applicable; dependency/performance-gate repair only.

Lockfile rationale

  • Lockfile removes @lhci/cli, @lhci/utils, js-yaml@3.15.0, and the old lighthouse@12.6.1 path that existed only through LHCI.

Copy link
Copy Markdown
Owner Author

@codex review

@saagpatel saagpatel changed the title [codex] Remove LHCI js-yaml 3 path fix: remove LHCI js-yaml 3 path Jul 4, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 60d2c12343

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread scripts/perf/run-lighthouse-budget.mjs Outdated
for (let run = 1; run <= numberOfRuns; run += 1) {
console.log(`\n== Lighthouse ${url} run ${run}/${numberOfRuns} ==`);
const lhr = runLighthouse(url, run);
allResults.push(...evaluate(lhr, `${safeName(url)}-${run}`));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve LHCI's aggregation across runs

With the current .lighthouserc*.json files using numberOfRuns: 3 and no aggregationMethod, @lhci/cli did not evaluate each run separately; its default optimistic aggregation picks the best score for minScore and the lowest value for maxNumericValue before deciding an error. This line records each run's result independently, so one noisy CLS/LCP/performance sample now fails pnpm perf:lhci(:prod) even when the old gate would pass, making the replacement materially stricter/flaky instead of preserving the existing budget.

Useful? React with 👍 / 👎.

Comment thread scripts/perf/run-lighthouse-budget.mjs Outdated
});

if (result.status !== 0) {
process.exit(result.status ?? 1);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid bypassing preview cleanup on Lighthouse errors

When pnpm exec lighthouse exits nonzero after the preview server has been started (Chrome missing, audit crash, or page fetch failure), calling process.exit here bypasses the surrounding finally, so stopServer(server) is never reached. Because the server was spawned detached on Linux/macOS, Vite preview can be left running on port 4104 and poison later retries in the same job/session; throw or return the status and let the outer cleanup run instead.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Owner Author

Addressed both Codex P2s:

  • Preserved LHCI-style optimistic aggregation across numberOfRuns: 3 before applying assertions, so noisy individual samples do not make the replacement stricter than the old LHCI gate.
  • Replaced the inner process.exit path with a thrown error that lets the outer finally stop the preview server.

Local validation:

  • pnpm exec eslint scripts/perf/run-lighthouse-budget.mjs
  • pnpm exec prettier --check package.json pnpm-workspace.yaml scripts/perf/run-lighthouse-budget.mjs
  • git diff --check
  • pnpm perf:lhci
  • pnpm perf:lhci:prod
  • Forced failure after preview startup with a missing npm_execpath; command failed as expected and port 4104 was clear afterward.

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f15afbb809

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +62 to +66
const cleanupTimer = setTimeout(() => {
reject(
new Error(
`Timed out waiting for Lighthouse server readiness pattern: ${readyPattern}`,
),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Stop the preview server when readiness times out

When the preview command starts but never prints the configured readiness text (for example a changed Vite banner or a bad .lighthouserc startServerReadyPattern), this timeout rejects before waitForServer resolves, so the outer finally still has server === undefined and cannot terminate the spawned pnpm preview; that can leave port 4104 occupied and poison later Lighthouse runs. Please kill the child on this timeout path, or otherwise make the child available to the existing cleanup, before rejecting.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Owner Author

Addressed the readiness-timeout cleanup finding. waitForServer now stops the spawned preview child before rejecting on readiness timeout.

Validation added locally:

  • pnpm exec eslint scripts/perf/run-lighthouse-budget.mjs
  • node --check scripts/perf/run-lighthouse-budget.mjs
  • Forced readiness timeout with an impossible startServerReadyPattern; command failed as expected and port 4104 was clear afterward.
  • pnpm perf:lhci happy path still passed with optimistic aggregation.

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: c459ef470b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@saagpatel saagpatel merged commit f05b19a into master Jul 4, 2026
19 checks passed
@saagpatel saagpatel deleted the codex/fix/remove-lhci-js-yaml branch July 4, 2026 09:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fully remove vulnerable js-yaml 3.x from LHCI dependency tree

1 participant