v0.0.121

A release about where your custom request headers go. Asset requests now send them to the audited origin only, with a new header_hosts setting for the site's other hosts that need them, and the soft-404 and cloaking probes no longer carry them across a redirect to another site. Also: squirrel analyze applies keep_audits retention, Tailwind v4's preflight no longer softens accessibility failures, and the link checks leave two more shapes of sign-out and credential link alone.

Thanks to @deniskern, whose report is behind the squirrel analyze retention fix below.

Security

• Custom request headers (-H, [crawler] headers) now go only to the audited origin on asset requests such as stylesheets, scripts and images, not to every subdomain of the audited host. The audited origin is the scheme, host and port the audit runs on: the start URL, after a redirect within the site. A subdomain is not always run by the site's owner, and these headers usually carry credentials. To send them to one of the site's hosts that needs them, such as assets.example.com behind Cloudflare Access, name it with [crawler] header_hosts = ["assets.example.com"] or --header-host assets.example.com (repeatable or comma-separated). Assets on other sites never get them, as before. When an audit has custom headers set, a script or stylesheet on a host that was not sent them and answers 401 or 403 is now listed as unverified by reliability/broken-resources, naming its host, instead of being reported as broken, and mobile/web-app-manifest reports such a manifest or icon as not checked. See Crawler configuration.
• The soft-404 confirmation and the cloaking probe follow redirects one hop at a time and drop your custom headers, other than standard browser headers such as User-Agent and Accept, on a hop to a different origin. They also refuse a hop to a link-local or cloud metadata address. Private networks still work for an audit of a site on your own network.

Fixed

• The accessibility checks that skip hidden controls no longer make every unnamed control on a page unconfirmed when the page inlines Tailwind v4's preflight ([hidden]:where(:not([hidden="until-found"]))). A :where(), :is() or :has() beside a tag, class, id or attribute test now only narrows the rule, so the rule reaches elements that have that part, and a11y/button-name and the other naming checks can fail visible unnamed controls again. A :where() or :is() with nothing beside it can still reach any element. See a11y/button-name.
• content/placeholder-text no longer flags NaN listed beside Infinity, as in Special values: NaN, Infinity or a list of NaN, Infinity and -Infinity on adjacent lines. That is floating-point vocabulary, not a leaked value. NaN shown as a value (a line that is just NaN, Rating: NaN, Price: $NaN) still flags, unless an Infinity sits right next to it. See content/placeholder-text.
• squirrel analyze now applies [storage] keep_audits retention, unless keep_audits is off, so a project audited with squirrel crawl, squirrel analyze and squirrel report no longer keeps every audit's results. It retires audits beyond the window, and crawls that killed audits left behind, the way squirrel audit does, and prints the same notice on stderr when it retires something. It skips retention for a blocked or failed crawl, for a crawl in another project than the one the directory's squirrel.toml names, and, when no project is named, for a crawl picked with --id. See Storage.
• The internal and external link checks no longer request two more shapes of action or credential link. A sign-out with a version number after it (/LogOut2, /SignOut1.aspx) now counts as a sign-out, while /oauth2/docs is still a page, and a credential in a matrix parameter (/file;sig=…, /a.zip;X-Amz-Credential=…) now counts as a credential. See External links.