Research Issues found with Lighthouse

[JennaySDavis]

Research multiple issues with Best Practices and Accessibility found when Lighthouse was run on the 889 Tool. The following items were reported: Best Practices

• Browser errors were logged to the console (Source: digitalgov.gov Description: Refused to load the script 'https://www.googletagmanager.com/gtag/js?id=G-CSLL4ZEK4L' because it violates the following Content Security Policy directive: "script-src 'self' https://dap.digitalgov.gov https://www.google-analytics.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.)
• Issues were logged in the Issues panel in Chrome Devtools (Content security policy-- /gtag/js?id=G-CSLL4ZEK4L(www.googletagmanager.com)Content security policy /gtag/js?id=G-CSLL4ZEK4L(www.googletagmanager.com))
• Missing source maps for large first-party JavaScript (cloud.gov and digitalgov.gov)

*The Lighthouse report is available in Google Docs > Accessibility Compliance Testing Results folder

[john-labbate]

We cannot resolve the PostCSS Dependabot issues, linked below, because our systems rely on uswds-compile. We currently have the latest version(1.1.0) installed, which depends on the vulnerable version of PostCSS. The USWSDS package should be updated first, or we should move away from using it, but in the meantime, we will not be able to upgrade to a safe version.

In addition, Astro v2 depends on a vulnerable version of PostCSS. We would need to migrate to a newer version, requiring an overhaul since we are two full versions behind. We have spent about a week attempting this upgrade to Astro v4.

We do not currently have an accurate estimate of how long it will take to upgrade Astro as there are several unknowns around what is now preventing the upgraded version from working. Regardless, we will still need to resolve the dependency on USWDS-Compile before this vulnerability can be properly addressed.

[clyncha]

@john-labbate any update on this?

[john-labbate]

@clyncha uswds/compile has been updated in our system at this point and is no longer a blocker. We have not allocated the resources to updating the Astro version yet.