Bump sitespeed.io from 39.5.0 to 40.4.1

[dependabot]

Bumps sitespeed.io from 39.5.0 to 40.4.1.

Release notes

Sourced from sitespeed.io's releases.

v40.4.1

Fixed

• Stop parsing scripting files as URL-alias lists in getAliases #4724.

v40.4.0

Added

• Browsertime 27.2.0 — recalculateStyle is now summarised at the HAR page level as _renderBlocking.recalculateStyle (beforeFCP / beforeLCP element counts + durations), so the metric is reachable from the page entry instead of only inside browsertime.json #4723.

v40.3.0

Added

• Bump the bundled Docker browsers to Chrome 148, Firefox 150, Edge 147 #4709.

Fixed

• Compare plugin no longer crashes when running with --verbose — a typo in a log.verbose call ('%j'.results instead of '%j', results) threw once the Python statistical tests returned.
• coach-core bumped to 9.0.1 #4703.

v40.2.0

Added

• Update the CPU tab for Chrome to show more valuable metrics #4691.
• Add a scrubbable timeline to the visual-progress card #4690.
• Style the Server timings table to match the rest of the metrics tab #4689.
• Make Domains, Toplist and Assets pages easier to scan/read #4688
• A friendlier third-party tab #4687

Fixed

• Update to Browsertime 27.1.0 #4691

v40.1.0

Added

• Per-request detail panel on the HAR waterfall — clicking a request opens a slide-in side panel with General / Headers / Cookies / Timing / Body tabs, with syntax-highlighted body previews and copy buttons when response bodies are in the HAR (use --browsertime.chrome.includeResponseBodies html|all for Chrome) #4684.
• URL filter on the waterfall card — type a substring and the canvas narrows to matching requests, with a "N of M" counter next to the box #4685.
• Page-metric legend now explains the orange render-blocking marker, the yellow redirect row tint, and the red error row tint — previously these visuals had no key in the report #4685.

Changed

• The waterfall canvas adopts a slate/blue palette so its border, gridlines, and row stripes match the surrounding sitespeed.io card chrome instead of the standalone-viewer default #4685.

v40.0.0

Highlights

A big release. The HTML report has been almost entirely re-skinned around a unified card-based design language; Browsertime jumps to 27 with a much improved scripting API and iOS-device testing; coach-core jumps to 9 with a severity tier on every rule, an INP rule, and a set of modern-image rules.

• A new look and feel for every page of the report. Every tab and every top-level result page has been refreshed. Charts that used to need Chartist are now inline SVG with no JS dependency #4619, #4654.
• Coach severity is now on the advice cards. Every finding leads with a colour-coded error / warn / info chip; the section header gets a category-level breakdown (1 error · 8 warnings · 1 info). The numeric score follows in muted parentheses for error/warn and is hidden entirely for info, where the number isn't a meaningful urgency signal #4667. Rules has been updated to match 2026.
• Browsertime 27 (major). Unified selector syntax for every interaction command (commands.click('#btn'), commands.addText('#input', text)), a much bigger convenience-command surface (type, find, fill, cookie, clickAndMeasure, clickByText, …), Chrome soft-navigation support so SPA route changes produce a HAR page + Core Web Vitals, Safari on iOS over USB (HAR via iwdp, video + visual metrics via CoreMediaIO), and TypeScript navigation scripts on Node 22.18+. See the Browsertime 27 release notes for the full list and the breaking-change details (default --timeouts.elementWait is now 6000ms; clicks now use the Selenium Actions API).
• Coach-core 9 (major). New interactionToNextPaint rule (INP became a Core Web Vital in March 2026), four new modern-image rules (decodingAsync, lazyLoadingImages, modernImageFormats, lcpImageHints), modern privacy/security header rules (Permissions-Policy, X-Content-Type-Options, the cross-origin isolation trio, NEL, Reporting-Endpoints, DOM-side iframeSandbox / referrerPolicy / sessionReplay), CSP scored on its directives instead of its byte length, refreshed thresholds across the rule set, the surveillance category typo fixed (was survelliance), and the package is now ESM-only on Node 20+. See the coach-core 9 release notes.
• HAR waterfalls render via waterfall-tools. The waterfall code moved out of the HTML plugin into the dedicated waterfall-tools package so the same renderer can be reused outside sitespeed.io #4614.
• Compare plugin rewrite. The per-metric scatter plots are now DOM-positioned dots over a relative wrapper (round at any width) with a real Y-axis gutter showing five labelled ticks plus grid lines; setup is split into separate Run-setup and Content-breakdown cards, and the wide stats table scrolls horizontally with paired baseline/current columns #4656.
• Mobile-friendliness pass. Hero KPI bands fit two tiles at a 360px viewport, dt/dd metadata grids stack to one column on narrow screens, and the matched-LCP element image goes fluid-width below 600px #4669.

Breaking

... (truncated)

Changelog

Sourced from sitespeed.io's changelog.

40.4.1 - 2026-05-13

Fixed

• Stop parsing scripting files as URL-alias lists in getAliases #4724.

40.4.0 - 2026-05-12

Added

• Browsertime 27.2.0 — recalculateStyle is now summarised at the HAR page level as _renderBlocking.recalculateStyle (beforeFCP / beforeLCP element counts + durations), so the metric is reachable from the page entry instead of only inside browsertime.json #4723.

40.3.0 - 2026-05-10

Added

• Bump the bundled Docker browsers to Chrome 148, Firefox 150, Edge 147 #4709.

Fixed

• Compare plugin no longer crashes when running with --verbose — a typo in a log.verbose call ('%j'.results instead of '%j', results) threw once the Python statistical tests returned.
• coach-core bumped to 9.0.1 #4703.

40.2.0 - 2026-05-06

Added

• Update the CPU tab for Chrome to show more valuable metrics #4691.
• Add a scrubbable timeline to the visual-progress card #4690.
• Style the Server timings table to match the rest of the metrics tab #4689.
• Make Domains, Toplist and Assets pages easier to scan/read #4688
• A friendlier third-party tab #4687

Fixed

• Update to Browsertime 27.1.0 #4691

40.1.0 - 2026-05-06

Added

• Per-request detail panel on the HAR waterfall — clicking a request opens a slide-in side panel with General / Headers / Cookies / Timing / Body tabs, with syntax-highlighted body previews and copy buttons when response bodies are in the HAR (use --browsertime.chrome.includeResponseBodies html|all for Chrome) #4684.
• URL filter on the waterfall card — type a substring and the canvas narrows to matching requests, with a "N of M" counter next to the box #4685.
• Page-metric legend now explains the orange render-blocking marker, the yellow redirect row tint, and the red error row tint — previously these visuals had no key in the report #4685.

Changed

• The waterfall canvas adopts a slate/blue palette so its border, gridlines, and row stripes match the surrounding sitespeed.io card chrome instead of the standalone-viewer default #4685.

40.0.0 - 2026-05-05

Highlights

A big release. The HTML report has been almost entirely re-skinned around a unified card-based design language; Browsertime jumps to 27 with a much improved scripting API and iOS-device testing; coach-core jumps to 9 with a severity tier on every rule, an INP rule, and a set of modern-image rules.

• A new look and feel for every page of the report. Every tab and every top-level result page has been refreshed. Charts that used to need Chartist are now inline SVG with no JS dependency #4619, #4654.
• Coach severity is now on the advice cards. Every finding leads with a colour-coded error / warn / info chip; the section header gets a category-level breakdown (1 error · 8 warnings · 1 info). The numeric score follows in muted parentheses for error/warn and is hidden entirely for info, where the number isn't a meaningful urgency signal #4667. Rules has been updated to match 2026.
• Browsertime 27 (major). Unified selector syntax for every interaction command (commands.click('#btn'), commands.addText('#input', text)), a much bigger convenience-command surface (type, find, fill, cookie, clickAndMeasure, clickByText, …), Chrome soft-navigation support so SPA route changes produce a HAR page + Core Web Vitals, Safari on iOS over USB (HAR via iwdp, video + visual metrics via CoreMediaIO), and TypeScript navigation scripts on Node 22.18+. See the Browsertime 27 release notes for the full list and the breaking-change details (default --timeouts.elementWait is now 6000ms; clicks now use the Selenium Actions API).

... (truncated)

Commits

• 5432ebf 40.4.1
• 08fa5ab fix
• 49853e7 Stop parsing scripting files as URL-alias lists in getAliases (#4724)
• 20a1ab9 bump
• 74924bc 40.4.0
• caa2410 new release
• e7dd956 bump
• bf00b5a Browsertime 27.2.0 (#4723)
• 9d62554 bumpe
• 8d1f1f9 bump
• Additional commits viewable in compare view

[7h3Rabbit]

@dependabot rebase