Update dependency critical to v9

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
critical	8.0.0 → 9.0.0

---

Release Notes

addyosmani/critical (critical)

v9.0.0

Compare Source

Critical v9 — a two-engine rewrite for how the web is built in 2026

Critical has always had one job: get the above-the-fold CSS onto the page now, and stop render-blocking stylesheets from standing between your users and first paint. v9 is a ground-up rewrite of how it does that — faster on the common case, more accurate on the hard case, and built to be driven by humans, build pipelines, and coding agents alike.

Two engines, picked automatically

The biggest change: Critical now ships two engines and routes between them for you.

• static — matches CSS against the delivered DOM. No browser, runs in milliseconds.
  Perfect for SSG/SSR/MPA output that ships real markup.
• render — loads the page at a real viewport and measures what actually paints above the fold.
  Ideal for SPA shells and when you want a tight, viewport-accurate set.

With engine: "auto" (the default), Critical inspects your HTML: real content → static; an empty <div id="root"> shell → it escalates to render. It always tells you which one it used and why. No browser is pulled in unless you actually need one — Playwright is an optional peer dependency, imported lazily.

Deterministic by design

Same input, byte-identical output. That means you can run Critical in CI and diff the result in version control without noise. First paint needs only the HTML.

Safe under a strict CSP

Deferring is done by swapping each <link rel="stylesheet"> for a <link rel="preload"> and moving it out of the critical path — no inline scripts added. Works cleanly under a strict Content-Security-Policy.

Agent-native

Critical now speaks to coding agents directly: an MCP server, an --explain mode that shows what it would do and why, and a structured report (engine used, bytes, rules, warnings, timing) on every run.

A lighter, more modern core

Rebuilt on lightningcss, css-tree, and linkedom. The static path — and the default install — never pull in a browser. Node.js 22+.

---

Upgrading from v8? v9 is a major release with a new API surface and option set — see the README for the current CLI and API.
As always, feedback and issues are welcome. Thanks to everyone who helped shape this one. 💛

What's Changed

• Critical v9: a two-engine rewrite for how the web is built in 2026 by @​addyosmani in #​623
• test: cover CLI, css option, foldAware, MCP & API surface by @​bezoerb in #​624
• fix(docker): build v9 image from source on official Playwright base by @​bezoerb in #​625
• chore: upgrade vite-plus to 0.2.9 by @​fengmk2 in #​626

Full Changelog: addyosmani/critical@v8.0.0...v9.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • On day 14 and 28 of the month (* * 14,28 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud