[PAMulligan]

Closes the remaining work on #169.

What changes

• @lhci/cli 0.14 → 0.16.0 (Lighthouse 12.1 → 13.6, puppeteer-core 22 → 25). The new @puppeteer/browsers no longer depends on extract-zip, and chromium-bidi now uses zod 4. That removes the two open Dependabot alerts (extract-zip, GHSA-jmr9-qjv8-65gv and GHSA-7pqw-9j4j-h8q3, no patched release exists) and the dev-only zod 3.23.8 finding, instead of dismissing them.
• minimatch@9 and minimatch@10 → 11 via pnpm.overrides, for GHSA-g3hv-75wg-m249 (>= 7.0.0, < 11.0.1, medium), the advisory the Dependabot Updates run has failed on since 2026-11-02 (security_update_not_possible). The affected copies sit under electron-builder, @electron/universal and typescript-eslint. Every consumer calls minimatch() or new Minimatch(), which v11 keeps; the exports v11 drops (makeRe, AST) are unused in the tree.
• lighthouserc.json: Lighthouse 13 removed the uses-http2 audit, so it leaves skipAudits (Lighthouse ignores unknown ids, so this is cleanup). resource-summary, which every budget assertion relies on, is still present in 13.6. Docs in tests/lighthouse/README.md and CONTRIBUTING.md updated to match.
• Four workflow steps named "Set up Node 20" already installed Node 22 and now say so. @lhci/cli 0.16 requires Node 22.19; every workflow uses node-version: 22.

Audit

pnpm audit: 6 findings → 1. The survivor is basic-ftp 5.3.1 under lhci's proxy-agent (dev-only, only used when an HTTP proxy is configured, already auto-dismissed on GitHub as alert 130; the fix is a major bump that get-uri has not taken).

Verification

• node --test tests/claude-code/*.test.mjs: 88 pass
• pnpm test:pipeline: 133 pass
• pnpm test:init: 1 failure in canva-generator.test.mjs, identical on main (an awk syntax error in scripts/canva-fse/convert-html-to-blocks.sh on this Linux awk; unrelated to dependencies)
• GUI: lint, typecheck, 55 unit tests, electron-vite build and electron-builder --dir --linux (exercises app-builder-lib's file matcher on minimatch 11) all pass; the smoke test passes locally (GUI launched and reached the setup view)
• Lighthouse 13.6: lhci collect + lhci assert with this repo's lighthouserc.json against a local static page runs the resource-summary budgets and skips is-on-https as before (the only failure was the probe page's own a11y score). The lighthouse-ci workflow runs on this PR because package.json and pnpm-lock.yaml changed, so the real WooCommerce gate is exercised here; see the known /cart/ performance flakiness in tests/lighthouse/README.md if it fails on a slow runner.

After merge

The next Dependabot Updates run should be green: no open alert has a published fix left to apply. GitHub will mark alerts 106 and 113 fixed once main carries this lockfile.

🤖 Generated with Claude Code