Chore(deps): bump web-vitals from 2.1.4 to 6.0.1 in /with-react

[dependabot]

Bumps web-vitals from 2.1.4 to 6.0.1.

Changelog

Sourced from web-vitals's changelog.

v6.0.1 (2026-07-27)

• Prevent JavaScript error if PerformanceObserver not available (#772)

v6.0.0 (2026-07-21)

v6 introduces Soft Navigation support for the Web Vitals metrics when supported by the browser.

[!NOTE] See the upgrading to v6 guide for a complete list of all API changes in version 6.

• [BREAKING] Remove unneeded modules with tsconfig verbatimModuleSyntax (#741)
• Add source maps (#771)
• Cap RequestIdleCallback to 1 second to ensure metrics report even when busy (#755)
• Flip default for includeProcessedEventEntries to false for v6 (#763)
• Add Soft Navigation support (#308)
• Add bfcache support for reporting small INP interactions (part of #308)

v5.3.0 (2026-05-28)

• Remove getFirstHiddenTimePolyfill (#729)
• Fixed issue where the same configuration object to multiple metric functions can result in errors (#731)
• Add more robust interactionTarget setting for INP (#744)

v5.2.0 (2026-03-25)

• Replace filter()[0] with find() for better performance (#658)
• Use queueMicrotask for microtask scheduling (#660)
• Simplify the event and LoAF entry clean up logic (#662)
• Remove obsolete FID polyfill types (#675)
• Use LargestContentfulPaint.id as fallback when element is removed from DOM (#676)
• Fix bug for onLCP when attached late (#697)
• FHandle initially hidden pages and onLCP registered on visibility change (#698)
• Ensure we clear idle callbacks in whenIdleOrHidden (#707)
• Limit pending events to conserve memory (#710)
• Add includeProcessedEventEntries option (#714)
• Reduce bundle size by refactoring (#713)

v5.1.0 (2025-07-31)

... (truncated)

Commits

• 45a09da Release v6.0.1
• e631507 Update CHANGELOG for 6.0.1
• 2d7ca2d Prevent JavaScript error if PerformanceObserver not available (#772)
• d889518 Update README
• 949d522 Fix CHANGELOG
• 67a9ddb Release v6.0.0
• 11b0b22 Prep CHANGELOG and unique id prefix for v6.0.0 (#764)
• 51d781c Add sourcemaps (#771)
• 6b2e2f6 Fix flakey INP soft nav tests (#769)
• fd936cb Flip default for includeProcessedEventEntries (#763)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by tunetheweb, a new releaser for web-vitals since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[yosriady]

Superseded by #208, which consolidates, security-reviews, and locally validates the dependency updates. Incompatible major versions are intentionally held on supported combinations and documented in the replacement PR.