Lighthouse is using a vulnerable version of inquirer and tmp

Author: kennethbiglerCreated Feb 26, 2026Updated Feb 26, 2026

Describe the bug Lighthouse is using a vulnerable version of inquirer and tmp.

To Reproduce Steps to reproduce the behavior:

run npm i
run npm audit fix

Expected behavior There should be 0 vulnerabilities when running npm audit.

Logs/Screenshots

# npm audit report

tmp  <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
fix available via `npm audit fix --force`
Will install @lhci/[email protected], which is a breaking change
node_modules/external-editor/node_modules/tmp
node_modules/tmp
  @lhci/cli  *
  Depends on vulnerable versions of inquirer
  Depends on vulnerable versions of tmp
  node_modules/@lhci/cli
  external-editor  >=1.1.1
  Depends on vulnerable versions of tmp
  node_modules/external-editor
    inquirer  3.0.0 - 8.2.6 || 9.0.0 - 9.3.7
    Depends on vulnerable versions of external-editor
    node_modules/gts/node_modules/inquirer
    node_modules/inquirer
      gts  *
      Depends on vulnerable versions of inquirer
      node_modules/gts

5 low severity vulnerabilities

Environment (please complete the following information):

OS: Mac Tahoe 26.3
Browser: N/A
Lighthouse Version: v0.15.1
Node Version: v24.11.0
npm Version: v11.9.0

Additional context N/A

Source: GoogleChrome/lighthouse-ci

View original on GitHub View discussion on GitHub