sitespeed.io release feed

sitespeed.io 42.5.1

Sitespeed.io — Wed, 29 Jul 2026 00:00:00 GMT

Fixed
- The Compare tab merged metrics with identical run values into one stacked row, which read as if before-FCP and before-LCP element counts were one metric when they are different measurements that happen to agree whenever FCP and LCP are the same paint, and the stacked names broke the name column mid-word. Every metric is its own row again and counts separately in the verdict; a row whose values match an earlier one carries a quiet "same values as X" tag instead, so identical numbers don't read as a rendering mistake. Direction words now follow the unit (higher/lower for counts and unitless metrics like CLS, slower/faster for times), since a "slower" chip on an element count read as a bug, and the about-the-statistics fold spells out what negligible, small, medium and large effect mean in plain text #4885.

sitespeed.io 42.5.0

Sitespeed.io — Tue, 28 Jul 2026 00:00:00 GMT

Added
- Every tested Compare row now shows how big the change is, not just how certain: the Hodges-Lehmann shift estimate with a 95% confidence interval ("shift +7 (+4 to +9 ms)"). A p-value kept being read as a size, but 21 fully separated runs give p = 1e-10 whether the shift is 1 ms or 100 ms. An interval away from zero is a real change of about that size, an interval straddling zero is noise no matter what the bare delta suggests. Added as a new additive field on the compare.pageSummary message, the graphite export is untouched #4882.
- Compare catches regressions that change run-to-run behaviour without moving the median. The rank test is blind to a metric whose median holds while the runs split into a fast and a slow group, for example a race sending a third of the iterations down a slow path. Every compared metric now also runs a two-sample Kolmogorov-Smirnov test over the whole distributions; it only surfaces when the rank test saw nothing, marking the row amber with "spread changed" and the change in the middle-80% span, and the verdict card lists it as possible intermittent behaviour rather than a regression. The new statisticalTestKS field is additive #4883.
- The Compare statistics explain themselves to engineers who are not statisticians: the setup strip carries a collapsed "about the statistics" fold naming every algorithm and what it contributes, the verdict card ends with a "How to read the numbers" primer, every p-value and effect line explains itself on hover and the spread verdict is worded from the data ("spread changed" when the median held, "less steady" when it moved but runs vary more) instead of citing test initials #4884.

Fixed
- The compare plugin skipped the statistical test whenever either sample had zero variance, reporting "No variability". In a WebPageReplay lab the most deterministic metrics are constant within a session, so the guard suppressed exactly the clearest regressions: every run shifting cleanly from 303 ms to 310 ms was never tested while noisy metrics always were. Constant samples now reach Mann-Whitney (which handles them fine), only truly identical datasets are short-circuited. Also fixes the compare CLI option definitions: the only non-default Mann-Whitney method choice was misspelled so picking it crashed scipy, three choices carried leading spaces and one misspelled describe key kept its help text from rendering #4881.
- The Compare tab is honest about tiny, duplicate and hidden changes. A 0.0005 CLS shift rendered as "0 → 0, Δ 0 (0 %)" yet was flagged red as significantly slower; small values now keep two significant digits and a significant change whose medians display the same value gets an amber "detectable, tiny" tier so it cannot read as a regression. Before-FCP/before-LCP pairs with identical values merge into one row instead of rendering and counting twice (old #chart- anchors kept), runs piling on the same value render as counted pills instead of a single dot, the effect size gets its own line under a short verdict pill and a clear improvement under a one-sided test is called out as "likely faster" instead of "no change" #4880.

sitespeed.io 42.4.0

Sitespeed.io — Sun, 26 Jul 2026 00:00:00 GMT

Added
- Where the JavaScript and CSS bytes go: the Coverage tab opens with a plain-language lead and a treemap sized by bytes and tinted by unused share, so you can see at a glance which few files own most of the weight and how much never ran. Bundles with a module breakdown drill into a per-module treemap and back, the smallest files fold into one tile so nothing becomes an unclickable sliver#4875.
- Cumulative Layout Shift is now actionable: the card leads with a verdict naming the element that took the biggest share of the shift, when it fired and the fix that always applies (reserve space). Each shift shows its exact share of CLS, a score coloured by how dominant it is, its timing and its selector, and a cause line appears only where the markup proves one (an image or embed with no width and height, unmistakable ad markup), never a guess from a loose substring #4874.
- The Compare graphic shows run-to-run spread, not just the median: each series draws its middle-80% band (p10 to p90) behind the dots with a grey stripe marking where the two bands overlap, so a wide grey band means the shift sits inside run-to-run noise and a clean gap means it is real. Cliff's delta rides on every chip whether the change is significant or not, and the median percentage is shown only when the test calls the change real #4879.
- Firefox 153 and Edge 150 in the Docker container #4876.

Fixed
- A shared or bookmarked link to any Metrics-tab card opened on the default tab with the target hidden, so the card looked empty. Every Metrics-tab anchor now resolves to its tab so deep links land on the card they name #4874.
- The Cumulative Layout Shift list showed sub-0.01 shifts that printed as "0.000" and "0% of CLS", a row that reads like a bug, and disagreed with the screenshot beside it, which only highlights shifts above 0.01. The list now shows shifts of 0.01 and up while smaller ones stay counted in the score and the verdict, and a page whose whole CLS is tiny movements gets an honest empty state pointing at the video #4878.
- The Coach Page info card was lopsided, stacking Document, DOM structure and Storage and connection in the left column while the right showed only a short Resource hints card. Storage and connection moved to the right column so the two end at roughly the same height, and the right column is no longer empty on pages that ship no resource hints #4872.

sitespeed.io 42.3.0

Sitespeed.io — Wed, 22 Jul 2026 00:00:00 GMT

Added
- The per-URL summary page leads with an action-first hero (what the user saw, the Coach score and the top fixes) instead of a box of numbers #4867.
- The CrUx tab opens with a Core Web Vitals verdict and draws the field-data breakdowns as donuts #4865.
- The Axe tab sorts violations worst-first, leads with a verdict and shows a real clean state when nothing failed #4866.
- The Coach Page info card groups the facts and explains each value in plain language #4870.
- Report composition donuts and cleanups #4871:

Fixed
- Score bands are inclusive at 80 and 90, so an exactly-80 score is no longer colored as a failure #4868.
- The summary hero's verdict phrases no longer look spaced out before their commas #4869.

sitespeed.io 42.2.0

Sitespeed.io — Mon, 20 Jul 2026 00:00:00 GMT

Added
- Browsertime 28.2 #4862, with the report surfacing its new visual diagnostics #4863. --videoParams.filmstripDiff adds a Diff toggle in the filmstrip lightbox (working on file:// too, where a tainted canvas used to block it) and a heatmap that tells a restless element apart from sub-pixel noise that inflates Last Visual Change and Speed Index. --videoParams.noiseTolerance ignores that noise at the source.
- The Rendering tab's "Why was rendering delayed?" section now opens with a verdict, and the render-blocking requests are one sortable table named by file (ResourceLoader load.php batches by their first module) with each download drawn on a clock ending at the paint, so a late-injected resource is visibly not the culprit Chrome's blocking flag makes it look like. Falls back to the pagexray shape without bars when the run has no HAR (Safari, old data) #4856 #4859.
- The Rendering tab's style cards lead with a verdict on whether to act and where, and Chrome's raw invalidation reasons (Affected by :has(), Inline CSS style declaration was mutated) are translated to plain language with a one-line fix on the four a developer can act on #4857 #4861.
- Web fonts, the classic "document done, text late" cause, appear in the render-blocking table as context rows flagged when they finished after a paint. With browsertime 28.2 the style-invalidation split uses the real first-paint boundary from the trace instead of guessing by reason category #4858.
- The playback timeline marks when the main thread was busy: the run's long tasks draw as a thin red band under the axis, so a filmstrip stall shows whether the CPU was the cause without leaving the tab #4860.

Fixed
- The CPU tab's bar lists now line up: each row was its own grid, so bars started at a different x position whenever the value text length changed #4855.
- Shared links to the newer Rendering anchors (#slow-ttfb, #recalculate-style, #reflows-before-paint, #main-thread-animations) loaded onto the default tab with the target hidden #4859.
- The render-blocking document row disappeared on sites that redirect to a trailing slash #4857.

browsertime 28.2.0

Sitespeed.io — Mon, 20 Jul 2026 00:00:00 GMT

Added
- New videoParams.noiseTolerance: a percentage of a frame's pixels that is allowed to differ before duplicate-frame elimination still treats the frame as unchanged. Browsers re-rasterize a visually-done page long after it settles, leaving invisible sub-pixel noise on glyph edges that the default handful-of-pixels tolerance counts as real change, inflating Last Visual Change, VisualComplete95/99 and Speed Index. Off by default #2528.
- New videoParams.filmstripDiff frame diffs: writes diff_.png next to each filmstrip frame (the frame dimmed with every changed pixel painted red, using the same per-pixel threshold report UIs use at runtime) plus a Frame Diffs metric. Report UIs cannot read frame pixels from file:// results, so an exact "what changed in this frame" view was impossible exactly where people debug local results. Off by default #2531.
- Visual instability heatmap: the same videoParams.filmstripDiff run now also writes one instability.png showing how many times each pixel changed across the video (amber for changed once, deep red for ten or more), plus a Frame Instability summary in the JSON. Answers "which parts of the page keep changing", so invisible re-rasterization noise can be told apart from a genuinely restless element #2533.
- cpu.styleInvalidations (Chrome only) now splits every reason, trigger and source at first paint: new afterFirstPaint counts and styleRecalcsAfterFirstPaint / layoutInvalidationsAfterFirstPaint totals separate building the page from churn on a page the user is already looking at. The fields only exist when the trace carried the FCP event, so absent means unknown rather than zero #2530.

Fixed
- Visual metrics no longer require OpenCV and pyssim unless the metrics that need them are requested: OpenCV is only used by --contentful and pyssim only by --perceptual, so a default install now runs on just ffmpeg, Numpy and Pillow. The Docker image keeps installing everything so both metrics keep working there #2535.
- VisualComplete99 is now reset when the page repaints backward. Two copy-paste typos reset VisualComplete95 twice and never reset VisualComplete99, so on a page that reaches 100%, repaints backward and then recovers, VisualComplete99 could report a time earlier than VisualComplete95 (99% complete before 95%, which cannot happen) #2537.

sitespeed.io 42.1.1

Sitespeed.io — Sat, 18 Jul 2026 00:00:00 GMT

Fixed
- The HTML report no longer speaks Chrome internals: raw data keys shown as metric labels (backEndTime, RecalcStyleCount, FirstVisualChange), LoAF/Long Task spec tokens, HAR phase keys (blocked, ssl, wait), trace event names used as headings and profiler jargon (self time, invoker) are replaced with plain language across every page. The raw keys stay in tooltips and explainer folds since the exported JSON and metrics still use them, and the help page's Firefox metric entries now lead with what each metric means instead of which browser preference enables it #4854.
- The CPU tab tells you what to do, not just what happened: the blocking-time card leads with a verdict and links each dominant kind to the section that names the culprits, the Timers section calls out the page's own polling and timeout-0 offenders with their cost and a suggested fix, and headings, KPI labels and quicklinks were renamed so the chip row scans as a table of contents #4853.
- On the Pages listing the Web Vitals verdict pill and the metric dots were centered against each other, so whichever was wider pushed the other sideways and the column looked randomly misaligned from row to row. Both are left-aligned now and line up across every row #4852.

sitespeed.io 42.1.0

Sitespeed.io — Fri, 17 Jul 2026 00:00:00 GMT

Added
- Browsertime 28 #4844 and 28.1 #4850. The engine can now tell you not just that the main thread was busy but what kept it busy: function-level CPU sampling, setTimeout/setInterval pressure per install site, per-selector style-recalculation cost, style/layout invalidation tracking, blocking time split by kind, CPU time per module — and in 28.1 the Long Animation Frame data carries per-script timings, frame timestamps, whole-page totals and readable load.php labels. See the Browsertime changelog for the full list.
- The CPU tab leads with the verdict: a top-offender callout, then long tasks and blocking time split into script, style/layout and HTML parsing (a page blocked by parsing its own huge document is named as such instead of hiding as "unknown"). Two new sections: Slowest JS functions (self vs total time from the V8 sampling profiler) and Timers (setTimeout/setInterval churn credited to the script that installed each timer). The tab is always present on Chrome and points to --enableProfileRun when the deeper data is missing #4845.
- Long Animation Frames are actionable and live on the CPU tab next to Long tasks: exact totals over every frame, each frame placed on the page timeline (blocking before LCP = fix first, after load = a different conversation), frames where an input was waiting flagged for INP, and one attribution model everywhere — blocking split by run-time share of the frame's work, capped at each script's own run time, so a parse-heavy frame can't pin 240 ms on an 8 ms inline script. Inline scripts and load.php batches get readable names, zero-blocking frames collapse into one quiet line, and old #longAnimationFrames links keep working #4851.
- The Rendering tab explains where style time goes: the slowest CSS selectors during style recalculation — including wasted selectors with thousands of match attempts and zero matches — and style invalidations: which class/attribute changes keep forcing recalculation and which scripts cause them #4845. Frame delivery (dropped frames, effective FPS, longest gap) also moved here from the CPU tab — it is the smoothness half of "what did the user see" #4849.
- Big JavaScript bundles are split into their modules: CPU time and code coverage per module (ResourceLoader bundles, including TemplateStyles labels for inline CSS). Everything sourced from the extra profile run carries a "Profile run" badge, and the PageXray tab shows the main document's response headers per run #4845.

Fixed
- Long tasks that started after the last visual change painted outside the visual progress timeline. Tasks past the axis end are dropped from the lane (the CPU tab still lists them all) and an edge-straddling task is clamped #4839.
- With --enableProfileRun the coverage section claimed no data was collected whenever the median run wasn't run 1 — the profile run is a single sample and is now shown regardless of which iteration became the median #4841.
- --enableProfileRun leaked into the measured runs, misnaming every measured trace as the profile trace and letting the profile trace overwrite the first iteration's. Per-run traces and the extra-run trace now coexist with correct names #4842.
- The Toplist page's run links were off by one ever since iteration pages became 1-based: with one iteration every link 404:ed, with more the link silently opened the previous run's page #4843.
- Long CSS selectors (deep :has()/:not() chains) made the Rendering tab's selector tables horizontally scrollable, pushing the metric columns out of view — selectors now wrap #4846.
- The timers table underlined its whole install-site cell, running a blue line under the code pills — the links are quiet now and tint on hover #4847.
- The Pages table forced a horizontal scroll even for a single tested page: the full metric names made the header row the widest thing in it. Headers now use the short Web Vitals vocabulary (LCP, CLS, TBT, …) with the full name in the tooltip #4848.
- GitHub Actions use Node.js 24 by default, with Node.js 26 added to the test matrix #4840.

browsertime 28.1.0

Sitespeed.io — Fri, 17 Jul 2026 00:00:00 GMT

Added
- Long Animation Frames (pageinfo.loaf) now ship every per-script field the LoAF API exposes (startTime, duration, executionStart, pauseDuration) plus startTime and firstUIEventTimestamp per frame — enough to attribute blocking time to individual scripts, place each frame on the page timeline and spot frames where an input was waiting #2522 #2523 #2526.
- New pageinfo.loafSummary key (totalFrames, totalBlockingDuration, totalDuration): pageinfo.loaf only ships the 10 frames with the most blocking, so totals computed from it understate busy pages #2524.
- LoAF script URLs get the same ResourceLoader labels as cpu.urls (load.php[startup] and friends) #2525.
- Multi-module load.php batches are labeled with their first module name — pages lazy-load several general batches, so the bare load.php[scripts] label collided as soon as there was more than one #2527.

browsertime 28.0.0

Sitespeed.io — Fri, 17 Jul 2026 00:00:00 GMT

Added
- New mainDocument field per iteration (any browser with a HAR): final URL, status, redirect count and response headers of the main document, with sensitive headers always removed. Tag runs by cache state (x-cache, age) or experiment enrollment (server-timing) without HAR post-processing #2500.
- New cpu.blocking and cpu.domains keys (Chrome/Edge, --cpu): long-task blocking time per script (whole trace and before LCP) plus first vs third party CPU totals. Answers "which script should I fix first" #2503.
- cpu.blocking also splits blocking time by kind of work (kinds: script, style/layout, HTML parsing, …), and blocking HTML-parse tasks are attributed to the document URL instead of the anonymous unknown bucket. A page blocked by parsing its own large HTML needs a completely different fix than one blocked by JavaScript #2512.
- New cpu.functionCosts key (Chrome/Edge): the slowest JS functions by main-thread self time, with total time, source position and the owning ResourceLoader module for bundled code, parsed from the V8 sampling profiler that --enableProfileRun already enables. Says which function is slow instead of stopping at "this script used 300 ms" #2511. Rows also carry callees, showing where an orchestrator's total went (for example which modules MediaWiki's runScript executed) #2515.
- New cpu.selectorStats key (Chrome only, on --enableProfileRun): per-selector CSS matching cost, showing the slowest selectors by elapsed time plus the wasteful ones with thousands of match attempts and zero matches. The only signal that says which selectors the style-recalc time goes to #2517.
- New cpu.styleInvalidations key (Chrome only, with --chrome.timeline): style/layout invalidations aggregated by reason, by trigger (which class/attribute keeps changing) and by source, resolved to the owning ResourceLoader module when coverage runs. The invalidation-tracking events were in every trace for years but never parsed #2516 #2521.
- New cpu.timers key (Chrome only, with --chrome.timeline): setTimeout/setInterval pressure per script (installs, fires, fire time, timeout-0 and recurring counts) plus the individual timers grouped by install site, resolved to the owning ResourceLoader module when coverage runs. On Wikipedia the timeout-0 offender turns out to be jquery's deferred machinery #2518 #2519 #2520.
- cpu.nonCompositedAnimations entries now include failureReasons, the compositeFailed bitmask decoded via Blink's FailureReason enum, so consumers can tell a harmless "animation has no visible change" from a real "unsupported CSS property" #2514.
- New cpu.frames key (Chrome/Edge, --cpu): presented/partial/dropped frames, effective FPS and the longest gap between presented frames, from Chrome's PipelineReporter events. Counts only drops Chrome flags as smoothness-affecting #2506.
- Per-module coverage for MediaWiki ResourceLoader bundles: load.php coverage entries get a modules array with used/unused bytes per module, derived from the mw.loader.impl boundaries in the bundle source. Automatic, Chrome only #2502.
- New cpu.moduleCosts key: per-module main-thread CPU time inside ResourceLoader bundles, when both trace and coverage are collected. Per-module selfTime plus an otherTime bucket for whole-bundle work #2505.
- Stable label fields (load.php[startup], load.php[scripts], …) on ResourceLoader URLs in cpu.urls, cpu.blocking, scriptCosts, forcedReflows and coverage entries #2504, and on cpu.moduleCosts #2507. The raw URLs embed a version= parameter that changes every deploy and breaks per-bundle time series. Additive: url is untouched.
- Inline CSS coverage entries are labeled with the owning MediaWiki template (TemplateStyles:rNNNNNNN, from the style element's data-mw-deduplicate attribute). Inline sheets all share the document URL (or an empty one), so Wikipedia's CSS coverage collapsed into anonymous buckets and nobody could see which template ships the dead CSS #2509.
- The renderBlocking.recalculateStyle summary (Chrome only) now includes the event count and the largest single event (maxElements, maxDurationInMillis), before FCP and LCP. Tells one massive style invalidation apart from thousands of small forced recalcs #2496.
- Bumped chromedriver and edgedriver to 149 #2487.
- Updated the Docker image to Chrome 149 / Firefox 151 / Edge 149 #2486 #2488.
- Updated @sitespeed.io/throttle to 6.0.1 #2499.
- Releases are now built and published from GitHub Actions with npm provenance and an SBOM, so the published package can be verified against the source it was built from #2491.

Fixed
- --enableProfileRun no longer affects the measured runs: combined with --cpu it misnamed every measured trace as trace-N-extra-run.json, let the profile trace overwrite iteration 1's trace and suppressed the result log line #2508.
- Navigation-script failures now include the URL and iteration number in the error message #2489.

Changed
- Coverage from --enableProfileRun is now a single object marked source: 'profileRun' instead of a one-element array keyed by iteration; indexing it by run number read undefined and reported no coverage. --chrome.coverage keeps the per-iteration array shape #2501.
- Document body-loading events (DocumentLoader::*, NavigationBodyLoader::*, URLLoader::*) now count as parse time and V8 interrupt/housekeeping as script evaluation in cpu.categories, instead of falling into other. What remains in other is almost entirely Chrome's task-scheduling overhead (RunTask self time), so consumers can present the bucket honestly instead of as unexplained mystery time #2513.

throttle 6.0.1

Sitespeed.io — Thu, 16 Jul 2026 00:00:00 GMT

Fixed
- Make throttle work on GitHub Actions again: Linux throttling no longer fails with "Exclusivity flag on, cannot modify" when another tool already holds the ingress qdisc slot on the interface. GitHub-hosted Actions runners now come with an eBPF network-monitoring agent that attaches a clsact qdisc to the default interface (other eBPF-based security agents do the same), and since only one ingress/clsact qdisc can exist per device, throttle's tc qdisc add ... ingress failed and took the whole measurement run down with it. The original code path is unchanged and runs first; only when it fails does throttle fall back to attaching its redirect filters to the existing qdisc (on the clsact ingress hook when needed), with explicit filter priorities so stop removes exactly its own filters and leaves the other tool's qdisc and filters untouched. #108.

sitespeed.io 42.0.1

Sitespeed.io — Tue, 14 Jul 2026 00:00:00 GMT

Fixed
- The Timings Summary's "Runs agree?" column grades agreement in three bands instead of two. A single stable/disagree cutoff had to choose between two audiences: on a controlled test rig ±10% is too forgiving to call "stable", while on shared cloud runners ±5% flags ordinary noise as disagreement on most rows — and a column that always warns stops meaning anything. Stable now means within ±5%, a neutral uncolored "varies" band covers the ±5–10% range that is normal run-to-run noise, and "runs disagree" is reserved for spreads past ±10% where the median genuinely hides something #4837.
- Removed em dashes from user-facing text in the HTML report #4838.

sitespeed.io 42.0.0

Sitespeed.io — Tue, 14 Jul 2026 00:00:00 GMT

Added
- The start page is a scorecard: one verdict for the whole test ("2 of 6 pages pass every check") and every tested page plotted as a dot on each metric's threshold track — hover a dot to trace that page across metrics, click to open its report. Failed URLs are called out instead of silently lowering the page count. The classic summary boxes remain only as a fallback for runs without browsertime data #4807.
- CrUX field data is shown alongside the lab Web Vitals, so you can see what real Chrome users experience next to what the lab measured #4794.
- The Domains page answers "which domain is hurting me": callout tiles for the slowest/heaviest/chattiest domains, worst-first ordering, warning/error tones on slow DNS/connect/SSL/TTFB and third-party marking #4808.
- The Toplist page answers "which files do I fix first": a plain-language hint per list, warning/error tones on huge transfers, short cache times and slow responses, and a new short-cache-time list. Fonts and other content types are no longer dropped #4809.
- The Assets page opens with an overview (unique assets, total transfer/size, biggest asset, per-type counts) and spells out transfer (wire bytes) vs size (decoded bytes) so the numbers can't be misread #4811.
- The Detailed Summary groups all metrics into cards by concern and leads with a "What stands out" strip (worst Web Vital, 4xx/5xx responses, redirect-heavy pages, critical accessibility violations). Single-run results collapse the five identical stat columns into one value column #4812.
- The Pages tab sorts pages worst Web Vitals first with a per-page verdict and per-metric status dots, and large runs get a URL filter. Missing data renders as a dash instead of a misleading zero, and an unknown metric name no longer breaks the whole page #4813.
- Long Animation Frames are actionable: the frames with the most blocking time, split into phases, with the scripts that ran in them #4803.
- Visual metrics are easier to understand: a milestones timeline on the page summary shows when the page started rendering, hit 85% and finished #4804.
- Video and Filmstrip are merged into one Rendering tab: the video plays with a clickable milestone timeline (TTFB/FCP/LCP/visual metrics), the filmstrip is one chronological strip with per-frame completeness that seeks the video, and frames open full size in a lightbox. Runs that keep a filmstrip but no video get the same experience with a frame preview instead of the player. Old #video and #filmstrip links keep working #4816.
- The Rendering tab tells the full render story: what the user saw (video, filmstrip, this run's screenshots) followed by why it was delayed — recalculate-style work from the Chrome trace, render-blocking requests, forced reflows before the page painted (a page can paint early and still thrash layout before its largest paint) and animations running on the main thread instead of the compositor. The tab shows up whenever any of that exists, so a --cpu run without video still gets its render story, and old #screenshots and #requests-render-blocking links keep working #4827 #4828. A server that is slow to answer is part of the story too: when TTFB is past the 800 ms Web Vitals threshold, the why-section opens with the value and its share of the time to first contentful paint — and a slow TTFB alone brings the tab up, even for runs without video, filmstrip or trace data #4834.
- The render blocking section answers "what do I attack first": one section per blocking type with a plain-language line on what the status means and how to fix it, and the assets in a sortable table with transfer size and total time, heaviest first — instead of raw URLs and Chrome's enum values. Dynamically injected resources that never block rendering no longer show up as something to investigate #4824 #4826.
- Problems are easier to find: the Errors page counts and tints its errors, the Budget page shows value/limit/verdict per check with failing URLs first, the Coach tab leads with a "What to fix first" strip, the Pages and Detailed pages link to the Errors page when a run had errors, and console errors surface as a red KPI tile on the PageXray tab #4819.
- The side-by-side runs page got the modern card treatment; run navigation is now compact number chips with the current run highlighted — a 21-run test fits on one line instead of three — and all tabs share the same jump-link style #4820 #4835.
- The Timings Summary table answers "do the runs agree?": a new column grades run-to-run agreement per metric (identical, stable ±N%, or runs disagree ±N%), so a flaky Total Blocking Time of 0/0/214 ms no longer hides behind a perfect-looking median of 0. It grades agreement rather than speed, so it works for every metric without per-metric limits, and only renders with more than one iteration #4832.
- The page summary's stacked metric boxes became one overview stat card that leads with the values — big numbers, quiet labels, opening with a Google Web Vitals group so the summary shares vocabulary with the Timings Summary and the Metrics tab — and the screenshot now says which run it shows #4833.
- The Compare tab is one row per metric: the p-value, a distribution strip showing every baseline and current run on a shared value axis, median → median with the delta, and a verdict chip — replacing a nine-column statistics table cross-referenced against 24 scatter charts. A verdict card on top gives the headline count with chips that jump to the flagged metrics, significant rows are tinted by direction (regressions red, improvements green — the old layout showed a significant improvement in error-red), and old chart deep links keep landing on their metric #4836.

Fixed
- Runs that collect no asset data at all (for example a CrUX-only configuration) no longer crash the Toplist page — the empty aggregator fallbacks were plain objects where the populated case ships arrays, so the template died with "pool is not iterable" and the whole page was lost #4829.
- A User Timing mark that fires several times in one run (or only in some runs) produces statistics whose computed median matches no run; the Timings Summary silently dropped that cell and shifted every later column left. The cell is now always emitted, just without a run link when no run matches #4832.
- Report polish: asset content types render as a color swatch plus plain text instead of pill chips, and the Assets overview shows the type composition as the same stacked bar the start page uses #4822; explanation texts use the full card width instead of wrapping at 80 characters #4823; information labels no longer look like clickable buttons #4825; and the Pages tab's verdict pill is centered over its status dots #4830.
- The Waterfall tab works in dark mode: its ~350 lines of inline light-only CSS moved into proper light/dark stylesheets built on the theme tokens, reusing the report's card, button and filter components #4818.
- Style consistency across all report pages: one cell size for data tables, one numeric-cell class, one cell-tone spelling, h3 card titles/h2 tab leads, and the nav no longer narrower than the content on wide screens. Also fixes the Screenshots tab id typo that broke #screenshots deep links, screenshots glowing white in dark mode, and adds the missing good/poor dots to the Timings Summary Web Vitals #4817.
- The Timings Summary table matches the modern report styling, and its markup no longer relies on browser error recovery #4806.
- Cap the "Elements that shifted" text in the CLS card at 300 characters — an ad iframe attribute could dump an entire serialized HTML document into the report #4805.
- Upgrade waterfall-tools to 0.4.0 #4801.
- Upgrade @tgwf/co2 to 0.19.0. Reported CO2 numbers are unchanged — sitespeed.io always passes an explicit model — but co2.js's own default changed to SWD v4, which affects library users who enable the sustainable plugin without setting sustainable.model #4810.

Changed
- The Pages tab's default columns are now timing-first — LCP, CLS, TBT, Speed Index, total transfer, total requests and the Coach score — and the auto-appended visual metrics columns are gone. Any old column can be restored with --html.pageSummaryMetrics #4813.
- The Assets page selects the heaviest assets instead of the most requested ones (a huge asset requested once could be missing entirely) and --maxAssets defaults to 100 instead of 20 #4811.
- The green/yellow/red KPI tiles are gone from the Detailed and page summaries. They duplicated verdicts that already live elsewhere — the "What stands out" strip, the "Runs agree?" column and the Web Vitals verdicts — so every summary led with a second color-coded scoreboard that added noise without adding information #4831.

sitespeed.io 41.4.1

Sitespeed.io — Fri, 03 Jul 2026 00:00:00 GMT

Fixed
- Update base Ubuntu and NodeJS #4799

browsertime 27.4.1

Sitespeed.io — Mon, 25 May 2026 00:00:00 GMT

Fixed
- --chrome.coverage no longer reports "0 B unused" for functions that executed at least once. The JS used-bytes calculation took the union of every V8 range with count > 0, but V8 returns nested ranges — an outer range over the whole function body and inner ranges over sub-blocks. If a function ran at all, its outer range already covered the whole body and the inner count == 0 ranges (the actual dead branches) got absorbed into the union and contributed nothing. On modern bundles where module-evaluation top-level code runs for almost every function, the per-script unused-% collapsed to roughly zero across the board, leaving sitespeed.io rendering a "0 B unused" column on pages that obviously ship plenty of dead code. The calculation now walks the ranges as nested intervals, painting the innermost range's count at every byte (the same definition Chrome DevTools' Coverage panel uses), so dead branches inside executed functions show up correctly. CSS rule-usage tracking returns flat, non-overlapping ranges and is unchanged #2484.

browsertime 27.4.0

Sitespeed.io — Sun, 24 May 2026 00:00:00 GMT

Added
- JS/CSS coverage collection for Chrome. --chrome.coverage turns it on for every iteration for users who want the data and accept that detailed V8 coverage deoptimizes scripts and will skew their timing metrics. --enableProfileRun also turns coverage on for Chrome alongside the existing trace, so users who want coverage without affecting their timings can lean on the same extra-iteration pattern they already use for tracing — the result is merged back into the main browsertime.json so consumers like sitespeed.io see the data in the same place they read every other metric. Each entry has a per-file breakdown (url, totalBytes, usedBytes, unusedBytes, unusedPercent) #2480.

Fixed
- HAR post-processing no longer throws when a page has no matching entries. Occasionally a HAR contains a page whose pageref has no entries — typically a navigation that didn't produce any requests, or an extension-injected page. getDocumentRequests and getFinalURL dereferenced shift() / pop() without a guard, and getMainDocumentTimings wrapped its entire per-page loop in a single try/catch so one bad page wiped out the main-document timings for every other page in the same HAR. Downstream this surfaced as a noisy triplet of warnings followed by an empty coach-data payload in sitespeed.io. The three crash points are now guarded and unresolvable pages are skipped #2483.
- Bumped geckodriver to a version with native ARM-64 support #2482.

onlinetest 4.0.1

Sitespeed.io — Fri, 22 May 2026 00:00:00 GMT

Fixed
- Compare page now renders screenshots, the filmstrip and the run video when the HAR points at a different sitespeed.io result server (e.g. wikiperformance comparing HARs that live on wikimedia.sitespeed.io). The helmet CSP only allowed 'self' for images and — via the inherited default-src — for video, so the cross-origin URLs the HAR carries in _meta.screenshot / _meta.filmstrip[].file / _meta.video were blocked and the slots came up empty. img-src now also allows any https: origin and a new media-src does the same for video #269.

browsertime 27.3.0

Sitespeed.io — Wed, 20 May 2026 00:00:00 GMT

Added
- browsertime --help is now navigable by topic. The default view shows a short curated list of common options plus the available topic names. browsertime --help shows just that topic, and browsertime --help-all reproduces the historical full dump for scripts and power users. The old single-screen dump of every option from all 13 topic groups was overwhelming for new users and slow to skim; the topic-filtered view follows the curl/ffmpeg pattern #2467.

Fixed
- TypeScript types and IntelliSense for navigation scripts are tightened across the script-facing surface. A new BrowsertimeScript type alias lets scripts annotate their default export and get both context and commands typed in one line. The high-level command helpers (navigate, find, getText, fill, hover, press, getTitle, waitForUrl, …) now surface their JSDoc parameter and return types in IntelliSense instead of being typed as Function, and commands.find resolves to a real WebElement so chained calls get completion from selenium-webdriver #2476. context.options, context.result, and context.taskData are typed as Record so editors offer completion on context.options. etc. #2478. commands.mouse is now a proper shape (selector typed as string, singleClick's options surface waitForNavigation) instead of an anonymous object literal, and measure.stop / measure.clickAndMeasure / measure.stopAsError return types are explicit (Promise / Promise) instead of Promise #2479.
- How Browsertime publishes its TypeScript types is now safer. scripting.d.ts moved to the repo root next to package.json so it can't be clobbered by a future tsc outDir change, the types condition comes first under exports to match TypeScript's documented resolution rules, and publint runs as part of prepublishOnly so common package.json mistakes fail before a release goes out #2477.
- Replaced the direct lodash.merge dependency with a small in-tree merge() helper in lib/support/util.js. The helper matches lodash's actual semantics for the cases Browsertime relies on — arrays merged by index, undefined source values skipped unless the key is missing on the target, Date/RegExp/class instances passed by reference, prototype-pollution keys rejected — which finishes the lodash unbundling the same way sitespeed.io did #2468.
- Bumped dependencies: chrome-har 1.3.1 #2469, chrome-remote-interface and selenium-webdriver #2475, @sitespeed.io/log 2.0 #2471, chromedriver / edgedriver / geckodriver #2472.

chrome-har 1.3.1

Sitespeed.io — Tue, 19 May 2026 00:00:00 GMT

onlinetest 4.0.0

Sitespeed.io — Fri, 15 May 2026 00:00:00 GMT

Added
- New failed_reason TEXT and finished_date TIMESTAMP columns on sitespeed_io_test_runs. failed_reason is populated from three paths the DB previously knew nothing about: Bull's global:failed event (the testrunner threw), the queue-down submit path in add-test.js (Redis unreachable when the test was queued), and the result-queue path when sitespeed.io itself exits non-zero (testrunner now sends Test runner exited with code N: , capped at 500 chars). finished_date is stamped on every terminal transition, so end-to-end duration can be derived as finished_date - added_date and run duration as finished_date - run_date (which is the browsertime start timestamp, not finish) #264.
- server/database/migrations/ directory establishes the convention for schema changes against existing deployments — setup.sql only runs on a fresh Postgres data dir, so live databases need ALTERs applied separately. Each migration ships with a .sh helper (check / backup / dry-run / apply / verify / rollback) that runs psql inside the compose Postgres container, plus a README documenting the manual path. Existing deployments must run 001-add-failure-fields.sh apply before rolling the server forward #264.

onlinetest 3.8.0

Sitespeed.io — Fri, 15 May 2026 00:00:00 GMT

Added
- Default sitespeed.io Docker image bumped from 40 to 41 in .env.example. The README "Update sitespeed.io version" snippets now reference 41 / 42 as the current and next-major tags.
- Vendored compare bundle rolled to pagexray 5.0.0 (HTTP/3 detection, case-insensitive Cache-Control directives, missingCompression over-count fix). The bundle shrinks from ~28 KB to ~17 KB thanks to pagexray's switch from uglify-es to terser #262.

Fixed
- /admin "failed" pill is now a real health signal: it counts failed test runs in the last 24 h from Postgres instead of Bull's getJobCounts(), which was capped by removeOnFail and only decayed on a successful retry — so the pill accumulated weeks of stale failures and shouted "13 failed" next to activity cards that correctly showed 0 in 24 h #261.
- Compare cookie list no longer renders domains like .example.com\nUIDR=... when a HAR concatenates multiple Set-Cookie response headers into one newline-joined value — the next cookie's name was leaking into the previous cookie's Domain= attribute. Picked up via the pagexray bump #262.

pagexray 5.0.0

Sitespeed.io — Thu, 14 May 2026 00:00:00 GMT

Added
- CLI can now read a HAR from stdin: pagexray - or piping into pagexray with no path argument #131.
- CLI prints a friendly error to stderr and exits 1 when the file is missing or the input isn't valid JSON (previously threw a raw Node stack trace) #131.
- README updated to drop the long-removed cookieStats example block and document fields added across 3.x / 4.x (fullyLoaded, afterOnLoad, afterOnContentLoad, renderBlocking, googleWebVitals, cpu, firstPartyRegEx) #130.

Fixed
- Classify HTTP/3 / HTTP/3.0 connections as h3 (previously only the lowercase h3 / h3-29 shorthand was recognised — the canonical form fell through to h1) #128.
- Parse Cache-Control directives case-insensitively (RFC 7234 §5.2). Max-Age=42 is now read as 42 instead of 0, and No-Cache / No-Store are honoured #128.
- Replace the deprecated url.parse (Node DEP0169) with the WHATWG URL parser in getHostname #128.
- Stop throwing in getDocumentRequests when a page has no matching entries — return an empty array instead #128.
- missingCompression was flagging every large text asset, including gzipped ones, because headers.flatten wraps values in arrays and the encoding check compared the array to a string. Unwrap before comparing, accept compound codings (br, gzip), and recognise zstd #129.
- Match the Domain= cookie attribute case-insensitively (RFC 6265 §5.2) so third-party cookies set with lowercase domain= are detected #129.
- Recognise common two-label public suffixes (.co.jp, .com.br, .com.au, ...) in getMainDomain so the auto-generated first-party regex isn't wrong for non-.co.uk country domains #129.
- defaultContentTypes now includes favicon so every page has a consistent shape (matches the example in the README) #129.
- xml is now considered for missingCompression reporting #129.
- engines.node bumped from >=8.9.0 to >=22.0.0 (the current Node.js LTS), and the GitHub Actions matrix now runs on Node 22 + 24 #132, #133.
- Test runner switched from Mocha + Chai to AVA, matching the rest of the sitespeed.io / browsertime ecosystem. Test helpers no longer depend on bluebird or lodash #133.
- ESLint upgraded from 8 to 9 with the new flat config (eslint.config.js replaces .eslintrc.json and .eslintignore) #133.
- All devDependencies bumped to current major versions: prettier 3, browserify 17, browserify-banner 2, @babel/core + preset-env 7.29, jsdoc 4. The abandoned uglify-es is replaced by terser, and mkdirp is dropped in favour of native fs.mkdirSync({recursive:true}) in the browserify script #133.

Changed
- Node.js 22 is minumium.

onlinetest 3.7.0

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Added
- Per-queue 24 h sparkline on each /admin queue row, independently scaled so low- and high-traffic queues both show shape #256.
- Subtle motion on /admin: one-time staggered bar-chart entrance, refresh-indicator pulse, and tweened number rollups when totals change. All honour prefers-reduced-motion #256.

Fixed
- Queue defaults bumped to removeOnComplete: 50 / removeOnFail: 100 / attempts: 2; code-level fallbacks aligned with the yaml #255.
- Internal queues (testrunners, result) no longer listed on /admin — they had no failures, no sparkline, and an inert Empty button #258.
- Refresh indicator on /admin now sits in a fixed-width column so the version pill can't shift sideways each tick #258.
- Testrunner setup duplicated on restart — registration was concatenating old + new instead of deduping #257.
- Multi-type setups on one location (e.g. desktop + emulatedMobile) collapsed into the last entry after a restart; dedupe now keys on full setup identity, not just queue name #259.

onlinetest 3.6.0

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Added
- Activity stats on /admin: totals for the last 24 hours and 7 days plus a stacked bar chart of tests per hour over the last 24 h (completed / failed / other). Pure server-rendered SVG, cached for 60 s so the auto-refresh doesn't beat on Postgres #252.

Fixed
- Hide the Failed count for the internal testrunners and result queues — the number was unactionable because the queues don't appear in Recent failures #251.
- Age labels in Recent failures now graduate to d/mo past 48 h instead of shouting 12608h ago #251.
- Long URLs no longer push the /search/ results table past its container and shove the page off-centre. URL cells now wrap at any character; the form has overflow-x: auto as a safety net #253.

onlinetest 3.5.0

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Added
- Health banner on /admin: Redis up/down, Postgres up/down, connected testrunners, totals for pending/running/failed jobs #247.
- "Currently running" table on /admin — every active job with URL/script, queue, runner, and elapsed time. Runs over 10 minutes are highlighted #247.
- "Recent failures" table on /admin with the error message and a one-click Retry button #248.
- Active and Failed counts on the queue table, plus a red "no worker" badge when a queue has pending jobs but no testrunner serving it #246.
- /admin auto-refreshes every 15 seconds. Pauses in background tabs #249.
- Opt-in auto-refresh toggle on /search/, 60 seconds. Off by default. Pauses while any test is ticked, so Compare selections aren't lost. State remembered in localStorage #250.
- /admin mobile layout reworked for the new tables — rows stack into name → counts → action on narrow screens #246 #247 #248.

onlinetest 3.4.0

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Added
- Connected testrunners table on /admin showing hostname, location, the setup each machine serves, and a fresh / stale "last seen" badge. Each testrunner publishes a heartbeat on the existing testrunners Bull queue every 30 s; the server tracks lastSeenAt per runner and prunes anything quiet for >120 s, so crashed runners (OOM, host reboot, docker kill) drop off the admin page within ~2 minutes instead of haunting the metrics gauge forever. When two runners pick the same LOCATION_NAME + deviceId, the server logs a clear Testrunner queue collision: hostA and hostB both claim queue X. Change LOCATION_NAME (or deviceId) on one of them. — the registration still goes through so existing deployments don't break, but the collision is no longer silent #244.
- deploy/PRODUCTION.md gets an "Adding a third (or Nth) testrunner" section with three concrete troubleshooting cases: not registering, stale row, queue collision #244.
- Compare workflow on /search/: the column over the per-row checkbox is now its own Compare header (split out from the generic "Actions"), a one-line helper below the table explains the affordance, and each checkbox carries an aria-label / title of "Select this run to compare with another". The Compare button itself starts disabled, gates submission until exactly two completed runs are ticked (a third tick is refused — the unchecked boxes go disabled when the limit is hit), and shows a transient inline message on a premature click ("Select 1 more test to enable Compare." / "Select 2 completed tests above first.") via aria-disabled + a polite aria-live region #240.
- deploy/update.sh — a single operator command that pulls the latest images, restarts services with up -d --remove-orphans, prints docker compose ps, and tails logs for 10 seconds so first-boot errors land in the same terminal. --mode {all-in-one|server|testrunner} picks the right production compose file; --version X.Y.Z rewrites SITESPEED_IO_SERVER_VERSION / SITESPEED_IO_TESTRUNNER_VERSION in .env atomically before pulling. PRODUCTION.md is updated to call the helper in every place it used to spell out the compose invocation by hand.
- .env.example is now the single source of truth for every variable any compose file reads (dev or production). New header walks through the three deployment shapes, and the previously-undocumented DOMAIN variable (used by the Caddy single-server compose for automatic HTTPS) is included. PRODUCTION.md drops its inline env-var snippets and points at .env.example so the two can't drift.

Fixed
- SIGTERM / SIGINT now actually drain in-flight HTTP requests before the process exits. The previous shutdown chain ended at this.app.close() on the Express app object (no such method exists), so the HTTP server was never told to stop — it just disappeared when process.exit(0) fired a few lines later, killing in-flight requests mid-response. The web server now keeps the real http.Server reference and calls close() on it; a configurable server.shutdown.timeoutMs (default 30 s) caps the drain and falls back to closeAllConnections() after the deadline. A second signal during shutdown short-circuits to immediate exit for operators who'd rather not wait #243.
- Custom hero / navbar logo overrides now use whatever dimensions the operator sets in html.logo.*. Two hardcoded aspect-ratio: 90.488 / 19.543 / aspect-ratio: 123 / 25.375 CSS rules were forcing every logo back to the bundled SVG's proportions #239.
- The analyze button on the Extras tab no longer sits a few pixels lower than on the other tabs. #extras .control was applying padding: 4px 0 to the submit button's wrapper as well as to the intended checkbox rows; scoped to .extras-fieldset .control so only the diagnostics checkboxes get the extra spacing #239.
- Footer spacing: removed the duplicate before "version" and added one between the trailing dash and "AGPLv3", so the footer now reads "©sitespeed.io 2026 - version X.Y.Z - AGPLv3" with consistent spacing #239.
- Search help panel: tighter copy. "You can combine your search commands. To find a test for a URL, date and browser you can search like this" is now "Combine commands to narrow your search. Example". The "Find tests by …" preamble that repeated on every line is gone — each command now leads with its field name and (where applicable) the allowed values #239.

Security
- Stop logging and echoing back invalid API keys. validateKey used to write the rejected value to the server log and return it in the 403 response body, so typos and stale secrets piled up in log aggregation. The log line is now Invalid API key supplied (no value, no length) and the response carries a single "Invalid API key." message in every locale #242.
- Close two XSS vectors that the recent UI work uncovered:
- Enforce a defense-in-depth CSP (default-src 'self'; script-src / style-src allow 'unsafe-inline' transitionally because pug templates still ship inline blocks; frame-ancestors 'none', object-src 'none', base-uri 'self', form-action 'self') and re-enable HSTS. Both were disabled previously #242.
- Block sensitive sitespeed.io flags from the GUI's "Command line args" tab. The user-supplied extras textarea used to forward arbitrary flags to the testrunner with only --verbose filtered. A GUI submission could load plugin / JS code (--plugins.add, --browsertime.preScript), run any binary as the browser (--browsertime.chrome.binaryPath), redirect HARs and metrics to an attacker-controlled destination (whole --graphite.* / --s3.* / --gcs.* / --scp.* / --slack.* / --matrix.* / --datadog.* / --influxdb.* namespaces), or read arbitrary files via --config. A denylist now drops these tokens (and their value arguments) before they reach sitespeed.io, and /sitespeed-help.json filters the same set so the CLI picker stops suggesting them (277 → 187 entries). API submissions (which pass a userConfig object, not extras) are deliberately untouched #241.

compare 2.0.0