Update dependency web-vitals to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
web-vitals	3.5.1 → 5.3.0

---

Release Notes

GoogleChrome/web-vitals (web-vitals)

v5.3.0

Compare Source

• Remove getFirstHiddenTimePolyfill
  (#​729)
• Fixed issue where the same configuration object to multiple metric functions can result in errors
  (#​731)
• Add more robust interactionTarget setting for INP
  (#​744)

v5.2.0

Compare Source

• Replace filter()[0] with find() for better performance (#​658)
• Use queueMicrotask for microtask scheduling (#​660)
• Simplify the event and LoAF entry clean up logic (#​662)
• Remove obsolete FID polyfill types (#​675)
• Use LargestContentfulPaint.id as fallback when element is removed from DOM (#​676)
• Fix bug for onLCP when attached late (#​697)
• FHandle initially hidden pages and onLCP registered on visibility change (#​698)
• Ensure we clear idle callbacks in whenIdleOrHidden (#​707)
• Limit pending events to conserve memory (#​710)
• Add includeProcessedEventEntries option (#​714)
• Reduce bundle size by refactoring (#​713)

v5.1.0

Compare Source

• Register visibility-change early (#​637)
• Only finalize LCP on user events (isTrusted=true) (#​635)
• Fallback to default getSelector if custom function is null or undefined (#​634)

v5.0.3

Compare Source

• Remove visibilitychange event listeners when no longer required (#​627)

v5.0.2

Compare Source

• Handle layout shifts with no sources (#​623)

v5.0.1

Compare Source

• Fix missing FCP and LCP for prerendered pages (#​621)

v5.0.0

Compare Source

[!NOTE]
See the upgrading to v5 guide for a complete list of all API changes in version 5.

• [BREAKING] Remove the deprecated onFID() function (#​519)
• [BREAKING] Change browser support policy to Baseline Widely available (#​525)
• [BREAKING] Sort the classes that appear in attribution selectors to reduce cardinality (#​518)
• Extend INP attribution with extra LoAF information: longest script and buckets (#​592)
• Add support for generating custom targets in the attribution build (#​585)
• Support multiple calls to onINP() with different config options (#​583)
• Use visibility-state performance entries (#​612)
• Ensure idle callbacks don't run twice (#​541) and (#​548)
• Cap nextPaintTime at processingStart (#​540) and (#​546)
• Cap INP breakdowns to INP duration (#​528)
• Cap LCP load duration to LCP time (#​527)

v4.2.4

Compare Source

• Fix memory leak in registering new event listeners on every keydown and click (#​554)

v4.2.3

Compare Source

• Fix missing LoAF entries in INP attribution (#​512)

v4.2.2

Compare Source

• Fix interaction count after bfcache restore (#​505)

v4.2.1

Compare Source

• Fix compatibility issues with TypeScript v5.5 (#​497)

v4.2.0

Compare Source

• Refactor INP attribution code to fix errors on Windows 10 (#​495)

v4.1.1

Compare Source

• Fix pending LoAF cleanup logic (#​493)

v4.1.0

Compare Source

• Move the support check to the top of the onINP() function (#​490)
• Fix missing LoAF attribution when entries are dispatched before event entries (#​487)

v4.0.1

Compare Source

• Add the ReportCallback type back but deprecate it (#​483)

v4.0.0

Compare Source

[!NOTE]
See the upgrading to v4 guide for a complete list of all API changes in version 4.

• [BREAKING] Update types to support more generic usage (#​471)
• [BREAKING] Split waitingDuration to make it easier to understand redirect delays (#​458)
• [BREAKING] Rename TTFBAttribution fields from *Time to *Duration (#​453)
• [BREAKING] Rename resourceLoadTime to resourceLoadDuration in LCP attribution (#​450)
• [BREAKING] Add INP breakdown timings and LoAF attribution (#​442)
• [BREAKING] Deprecate onFID() and remove previously deprecated APIs (#​435)
• Expose the target element in INP attribution (#​479)
• Save INP target after interactions to reduce null values when removed from the DOM (#​477)
• Cap TTFB in attribution (#​440)
• Fix reportAllChanges behavior for LCP when library is loaded late (#​468)

v3.5.2

Compare Source

• Pick the first non-null target for INP attribution (#​421)

---

Configuration

📅 Schedule: (in timezone Asia/Jerusalem)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
b2b-react-sample-app	Ready	Preview, Comment	Jun 11, 2026 9:14am

[ghost]

Wiz Scan Summary

Displaying only findings that violated a policy

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Total	-

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.