CSP audit does not recognize the `navigate-to` directive

FAQ

• Yes, my issue is not about variability or throttling.
• Yes, my issue is not about a specific accessibility audit (file with axe-core instead).

URL

https://seirdy.one

What happened?

The CSP-XSS audit contains the following result:

"items": [
      {
        "severity": "Syntax",
        "description": {
          "type": "code",
          "value": "default-src 'none'; img-src 'self' data:; style-src 'sha256-c7tfd/i7WbwPTbxi2MfuSn2JRsea7zAQwNbEPKDAoUk='; style-src-attr 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'; manifest-src 'self'; upgrade-insecure-requests; navigate-to 'none'"
        },
        "subItems": {
          "type": "subitems",
          "items": [
            {
              "directive": "navigate-to",
              "description": "Unknown CSP directive."
            }
          ]
        }
      }
    ]

What did you expect?

I expected the CSP to be valid, as navigate-to is a valid CSP directive documented in the spec for CSP Level 3, written largely by the Chrome team.

What have you tried?

No response

How were you running Lighthouse?

CLI

Lighthouse Version

8.5.1

Chrome Version

96.0.4659.0 (Developer Build) (64-bit), revision 927069

Node Version

v14.17.6

Relevant log output

No response

[adamraine]

Yeah, I’ll ping for an npm release

[Seirdy]

On Mon, Oct 04, 2021 at 12:25:00PM -0700, Adam Raine wrote:

Looks like this is an open bug on CSP evaluator https://github.com/google/csp-evaluator/issues/34

The bug was just closed; the master branch of CSP-evaluator now understands the “navigate-to” and “webrtc” CSPv3 diectives.

– Seirdy (https://seirdy.one)