chore(deps): bump web-vitals from 4.2.4 to 5.2.0

[dependabot]

Bumps web-vitals from 4.2.4 to 5.2.0.

Changelog

Sourced from web-vitals's changelog.

v5.2.0 (2026-03-25)

• Replace filter()[0] with find() for better performance (#658)
• Use queueMicrotask for microtask scheduling (#660)
• Simplify the event and LoAF entry clean up logic (#662)
• Remove obsolete FID polyfill types (#675)
• Use LargestContentfulPaint.id as fallback when element is removed from DOM (#676)
• Fix bug for onLCP when attached late (#697)
• FHandle initially hidden pages and onLCP registered on visibility change (#698)
• Ensure we clear idle callbacks in whenIdleOrHidden (#707)
• Limit pending events to conserve memory (#710)
• Add includeProcessedEventEntries option (#714)
• Reduce bundle size by refactoring (#713)

v5.1.0 (2025-07-31)

• Register visibility-change early (#637)
• Only finalize LCP on user events (isTrusted=true) (#635)
• Fallback to default getSelector if custom function is null or undefined (#634)

v5.0.3 (2025-06-11)

• Remove visibilitychange event listeners when no longer required (#627)

v5.0.2 (2025-05-29)

• Handle layout shifts with no sources (#623)

v5.0.1 (2025-05-13)

• Fix missing FCP and LCP for prerendered pages (#621)

v5.0.0 (2025-05-07)

[!NOTE] See the upgrading to v5 guide for a complete list of all API changes in version 5.

• [BREAKING] Remove the deprecated onFID() function (#519)
• [BREAKING] Change browser support policy to Baseline Widely available (#525)
• [BREAKING] Sort the classes that appear in attribution selectors to reduce cardinality (#518)
• Extend INP attribution with extra LoAF information: longest script and buckets (#592)
• Add support for generating custom targets in the attribution build (#585)
• Support multiple calls to onINP() with different config options (#583)
• Use visibility-state performance entries (#612)
• Ensure idle callbacks don't run twice (#541) and (#548)
• Cap nextPaintTime at processingStart (#540) and (#546)
• Cap INP breakdowns to INP duration (#528)
• Cap LCP load duration to LCP time (#527)

Commits

• c071fd0 Release v5.2.0
• 15cd449 Prep changelog for v.5.2.0 (#693)
• 384dd9c Reduce bundle size by refactoring (#713)
• 1742e6b Add includeProcessedEventEntries option (#714)
• 4733a93 Bump flatted from 3.3.3 to 3.4.2 (#718)
• efc4845 Bump fast-xml-parser from 5.5.6 to 5.5.7 (#717)
• 8e4e689 Bump undici from 6.23.0 to 6.24.1 (#716)
• 9750cc9 Bump fast-xml-parser from 5.4.2 to 5.5.6 (#715)
• 8fb24d7 Limit pending events to conserve memory (#710)
• 1a8233e Address flaky test (#711)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

[cloudflare-workers-and-pages]

Deploying my-website-dev with    Cloudflare Pages

Latest commit:	472ce53
Status:	🚫  Build failed.

View logs

[greptile-apps]

Greptile Summary

This PR bumps web-vitals from 4.2.4 to 5.2.0 (a major version jump). The lockfile and package.json changes are correct, but the upgrade introduces a breaking incompatibility in src/reportWebVitals.tsx.

• web-vitals v5.0.0 removed the deprecated onFID() (First Input Delay) function as a breaking change. The project's reportWebVitals.tsx still imports and calls onFID, which no longer exists in v5. This will cause a TypeError at runtime and likely a TypeScript compilation failure.
• FID has been superseded by INP (Interaction to Next Paint); onFID should be replaced with onINP in src/reportWebVitals.tsx.
• Other v5 features (INP attribution improvements, includeProcessedEventEntries option, browser-support policy change to Baseline Widely Available) are otherwise welcome improvements.

Confidence Score: 2/5

Not safe to merge as-is — the breaking API removal in web-vitals v5 will crash the reportWebVitals function at runtime and likely fail the TypeScript build.

The dependency bump is a major version upgrade containing a documented breaking change (onFID removal). The consuming file src/reportWebVitals.tsx has not been updated to reflect this, so merging will introduce a runtime TypeError and a TS compile error. A one-line fix (swap onFID for onINP) in src/reportWebVitals.tsx is all that's needed, but it must be included in this PR before it can be safely merged.

src/reportWebVitals.tsx — must remove onFID and add onINP to be compatible with web-vitals v5.

Important Files Changed

Filename	Overview
package.json	Bumps web-vitals in devDependencies from 4.2.4 to 5.2.0; the version change itself is clean, but the consuming code is not compatible with v5's breaking API changes.
pnpm-lock.yaml	Lockfile correctly reflects the new web-vitals@5.2.0 resolution with its integrity hash; no issues here.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[reportWebVitals called] --> B{onPerfEntry provided?}
    B -- No --> Z[Return]
    B -- Yes --> C[Dynamic import 'web-vitals']
    C --> D{web-vitals v4}
    D --> E["Destructure: onCLS, onFID, onFCP, onLCP, onTTFB"]
    E --> F[Call all 5 functions ✅]
    C --> G{web-vitals v5 - this PR}
    G --> H["Destructure: onCLS, onFID=undefined, onFCP, onLCP, onTTFB"]
    H --> I["onFID(onPerfEntry) → TypeError ❌"]
    I --> J[catch: console.error - all vitals reporting silently fails]

Loading

Comments Outside Diff (1)

1. src/reportWebVitals.tsx, line 7-12 (link)

   onFID removed in web-vitals v5 — will cause a runtime crash

   web-vitals v5.0.0 removed the deprecated onFID() function as a breaking change. After this bump, onFID will no longer be exported from the package, so it will be undefined when destructured from the dynamic import. Calling undefined(onPerfEntry) will throw a TypeError at runtime, breaking all web-vitals reporting whenever reportWebVitals is invoked.

   Additionally, the TypeScript build will likely fail since onFID is no longer present in the web-vitals type definitions exported by v5.

   FID (First Input Delay) has been superseded by INP (Interaction to Next Paint); the fix is to remove onFID and replace it with onINP:

_{Reviews (4): Last reviewed commit: "chore(deps): bump web-vitals from 4.2.4 ..." | Re-trigger Greptile}

[greptile-apps]

dependabot[bot] has reached the 50-review limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[cloudflare-workers-and-pages]

Deploying my-website with    Cloudflare Pages

Latest commit:	472ce53
Status:	🚫  Build failed.

View logs