v0.0.116

A release about link results and local sites. Cloudflare email-protection links no longer count as broken links, a public page's leftover link to a local-only name is flagged again, a .test or .local site typed without a scheme is audited over http, and the external link check shows its progress as it runs.

Changed

• The external link check now reports its progress while it runs, so the CLI's "Checking external links" progress counts up as links are answered, where before it showed no count until the check ended. The check can also be given a time budget, which squirrelscan's cloud audits use. Links still unanswered when the budget runs out, or when one request takes too long, are reported as Not checked with reason external-links-out-of-time, never as broken, and the audit completes. See links/broken-external-links.
• The notice a CLI audit prints when some external links could not be verified from your machine now says what gets them checked by squirrelscan's cloud link checker: a signed-in Surface or Full audit, at 1 credit per link it checks (at most 1 per page). Signing in alone is not enough, since a Quick audit checks links from your machine either way. A signed-in Quick audit now gets the notice too, naming --level surface. The --external-links help no longer suggests that some level skips external links. See Link checking.

Fixed

• links/broken-links no longer reports Cloudflare email-protection links as broken. With Cloudflare's Email Address Obfuscation on, every mailto: link and every email address in a page's text becomes a link to /cdn-cgi/l/email-protection, which answers an error when requested, so a site with an address in its footer had one broken link per address, sourced from every page. These links are email addresses, not pages: the crawl, the internal link check and the external link check never request them, and they are read as the mailto: links they stand for. The broken-links row's details.emailProtectionLinks says how many were left out. Other /cdn-cgi/ links, such as image resizing URLs, are still checked. See links/broken-links.
• A public page's link to a local-only name, such as a leftover http://myapp.test/ from a CMS preview, stands out again. Since 0.0.114 the external link check does not request a .test, .example or .invalid name, or one under .localdomain or .home, and lists it as info where it used to count as a broken link. content/dev-leakage now warns about them as a new local-name kind: names under .test, .example, .invalid, .local, .lan, .internal, .localdomain, .home and the other local-only zones, and single-label hosts such as intranet. .onion and .alt names are not included. An audit of a local site such as myapp.test skips the rule, so its links to other local names are not reported. reliability/broken-forms likewise reports a form that posts to one of these names as non-production-form-action, without sending it, unless the audited site is itself local. See content/dev-leakage.
• squirrel audit myapp.test, typed without a scheme, now audits http://myapp.test/ instead of https://myapp.test/. Laravel Valet and Herd serve .test sites over plain http unless the site is secured, so the audit used to fail to connect. Every host the CLI treats as local or private now defaults to http:// the way localhost and private addresses already did: box.local, nas.lan, db.internal and the other local-only names. A public host still defaults to https://, and a scheme you type is kept. See Local audits.
• a11y/aria-dialog-name, a11y/aria-command-name, a11y/aria-input-field-name, a11y/aria-labels and a11y/form-labels no longer report controls that are out of the accessibility tree, as a11y/button-name already does. That covers a control with the hidden attribute or aria-hidden="true", an inline display: none on it or an ancestor, an inline visibility: hidden on it, or a control inside a closed <dialog> or an unopened popover. A closed modal marked aria-hidden="true" no longer counts as an unnamed dialog. A control an inline style may hide in a form squirrel does not read exactly is reported as unconfirmed, a warning, not a failure. A closed native <dialog> is still checked, since pages open it with script. Hiding by <style> blocks and stylesheets is not read yet, so a control hidden only by a class rule is still reported. See a11y/aria-dialog-name.