v0.0.122

A release about saying what actually happened. A rule that runs out of time is now reported as not checked, with a Not checked line in every report, rather than as a failure, and a timed-out security rule trips warning gates instead of error gates (see below). squirrel audit without a terminal prints a progress line while it walks the crawled pages, and WordPress's image and lightbox styles no longer soften accessibility failures on controls nothing else hides.

Added

• squirrel audit without a terminal now prints Walking pages: N/M to stderr, about every 15 seconds, while it walks the crawled pages before the rules run. That step could go minutes without output on a big site, so a supervisor with a no-output watchdog could not tell it from a hang. The line is written at the end of a batch of pages, other than the last, once the interval has passed since the walk started or the last line. Batch length varies with page size, so a walk that fits in one batch prints no line, and a batch that takes longer than the interval shows nothing until it ends. Set SQUIRREL_WALK_HEARTBEAT_MS to a positive number of milliseconds to change the interval. A terminal keeps its spinner, and stdout (--format json, pipes) is unchanged. See audit.

Changed

• A rule abandoned for its time budget is now a skipped check, not a failed one. It is reported as <rule>-error with skipReason: "rule-timed-out" on every page it timed out on, the first included, with elapsedMs, the wall-clock time it ran before it was stopped. It adds nothing to the failed counts and no longer lowers the health score, so a site where a rule timed out may score higher than before.
  • Every report format, the CLI's own output included, prints a Not checked line for a timed-out rule above info severity, with the rule's name and how many pages it did not check, such as Not checked: External Link Security. External Link Security timed out on 1 page (exceeded its 1000 ms time budget).
  • --fail-on: a timed-out security rule counts as one warning-severity finding, so warnings>0 and severity>=warning trip on it and the gate summary names the rule. It is counted only for the gate, not in the report's warning count or the score. The timeout itself adds nothing to the error count or the score, a security rule's included, so a CI job that gated on errors>0 and failed only because a rule timed out now passes. Add a warning gate to keep catching a timed-out security rule, or raise time_budget_ms. Other rules that time out are not counted by any gate.
  • A page-time extractor that runs past the budget is handled the same way, when the site rule that reads it runs.
  • See Rule time budget.

Fixed

• The accessibility checks that skip hidden controls no longer leave a control unconfirmed because of a <style> rule squirrel cannot fully decide whose declarations can only show an element (display: inline-block, display: flex, visibility: visible). WordPress core's .wp-block-image>a and .wp-lightbox-container button rules kept a page's links and buttons unconfirmed, so a11y/button-name and the other naming checks can fail them again. Such a rule can still leave a control unconfirmed where it could undo something else that hides it, such as the hidden attribute, a closed dialog, a popover, a display: none or an inherited visibility: hidden. display: contents, inherit and unset do not count as only showing. See a11y/button-name.
• The <rule>-timeouts info check, which counts the pages a timed-out rule did not check (pagesNotChecked, and maxElapsedMs when it was measured), now reaches the stored results and every report for a page rule too. It was dropped before, so a timed-out page rule left no such row in project.db or the report. See Rule time budget.