jQuery slim build reports "invalid version"

[topaxi]

I'm using the jQuery slim build on a website, lighthouse is reporting "invalid version", my guess is it parses some kind of semver like versions while the jQuery slim version looks like this:

3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector

[patrickhulce]

Thanks for the report! Could you clarify what you mean by Lighthouse is reporting "invalid version"? Is there a specific audit that is failing or a fatal error? A copy of the report/json here or screenshot with test URL would be helpful here too if you have them.

[topaxi]

Under "Best Practices" - "Includes front-end JavaScript libraries with known security vulnerabilities":

Test URL: https://sarahtherad.com/

[patrickhulce]

Great thanks for sharing the URL @topaxi! I can reproduce.

[patrickhulce]

Indeed our bug, basically need to wrap

lighthouse/lighthouse-core/audits/dobetterweb/no-vulnerable-libraries.js

Line 69 in 76e51f3

if (semver.satisfies(lib.version, vuln.semver.vulnerable[0])) {

in try/catch

[paulirish]

we have two fixes here:

1. apply a trycach so we dont fail so hard (as patrick's comment points out)
2. js-library-detector lib correctly extracts the version in this case.

@topaxi can you report this upstream to js-library-detector? they should be trimming off anything separated by whitespace, IMO.

---

edit: sentry issue: https://sentry.io/google-lighthouse/lighthouse/issues/407623160/

[johnmichel]

@paulirish @topaxi This should be resolved in v4.3.0 via johnmichel/Library-Detector-for-Chrome#104, which was just published to both npm and the Chrome Web Store. Please let me know if you see any other strange behavior.