v0.0.127

Custom request headers stay with the audited origin unless you name another host, the default rule time budget doubles, and a smart audit keeps findings it did not get to re-check.

Changed

• Each crawl records which process drives it: squirrel audit, crawl and analyze write their pid, host name and a heartbeat (every 15 seconds, on a second database connection that skips a beat rather than wait on a busy database) on the crawl, and clear the owner when they end. Nothing reads it yet, so retention and self disk --prune behave as before; a later release will use it to keep a live crawl and retire a killed one sooner. The database gains three nullable columns (schema 35) that older versions ignore, and an audit of 1,000 pages is no slower (#946).
• a11y: an unnamed control inside an element that display: none hides only inside width-only media queries (a theme's mobile menu, @media (min-width: 990px) { menu-drawer { display: none } }) is still reported as <check>-unconfirmed, but with its own reason, hidden-only-at-some-widths, and the widths where it shows ("shown below 990px"), so it reads apart from a style squirrel cannot settle. Queries that together cover every width (min-width: 990px with max-width: 989.98px, in colon or range syntax, em or rem) leave the element hidden at every width and it is not reported. Any other media feature, not, @container, @supports or a <style media> keeps the generic reason. A control inside a rule whose queries can never both match ((min-width: 990px) and (max-width: 989px)) is shown, so one an earlier audit reported as unconfirmed can now fail, as it does in a browser (#988).
• The default per-rule time budget is now 2 seconds (was 1 second), so a rule that runs slowly on a busy machine is abandoned less often. A site rule gets 2 seconds per page of the site, still capped at 60 seconds. [rules] time_budget_ms still overrides it, and values below 1000 are still refused.
• legal/cookie-consent finds its consent signals in one pass over the page's elements instead of 28 selector sweeps, and social/share-buttons no longer lowercases a copy of the page. Both give the same answers as before; on a 1 MB script-heavy page legal/cookie-consent is about 3 to 6x faster (#270).

Fixed

• Custom request headers (-H, [crawler] headers) are now sent only to the audited origin (scheme, host and port) on the crawl's page fetches, the sitemap and license fetches, and the soft-404 and cloaking re-fetches, as they already were for assets. A page on another scheme, port or host, including one [project] domains or an include pattern admits, is still crawled and reported but is requested without them, and an https: start URL that redirects to http: keeps its https: scope. Name a host in [crawler] header_hosts (or --header-host) to send them there; a named host now gets them over https: only (before, any scheme matched), so write an entry with an http:// prefix to keep sending them over plain http. An entry may carry a scheme, port, path or trailing slash, which are ignored; a wildcard, userinfo, empty label or trailing dot is refused. A www host of an apex audit now needs to be named too (#959).
• A smart audit no longer marks a finding fixed when its check was skipped on the page in the re-crawl (for example perf/ttfb with no timing data, or a scan that stopped at its work cap) while the check ran on other pages. The finding stays open as carried. This now holds in the local audit and in a cloud publish whose resolution signal is over budget, not only when the signal lists the page (#508). A rule that timed out or threw on a page carries its findings there in the local audit too. A check skipped on every page, a rule disabled in config and a cloud audit that streams its findings to the store (which never sees skipped checks) still close the finding. A few rules also skip a page because the check does not apply to it, and those carry for now (#1011).
• links: Cloudflare email-protection links (/cdn-cgi/l/email-protection#<hex>) are read as the mailto: links they are. tel-mailto counts them and checks the decoded address (one that does not decode is never reported as invalid or mismatched), nofollow-internal and https-downgrade no longer judge them as page links, and the crawler never queues the path from a sitemap, a carried finding or a cached page's links. /cdn-cgi/image/ URLs are still checked as images (#838).
• a11y: link-text no longer reports conventional account and site-utility labels (Sign in, Sign up, Log out, Register, Terms, Privacy policy, Contact, FAQ and similar, in 11 languages) as generic link text. click here, read more and the other generic phrases are still reported (#839).
• links: no-contextual-inbound no longer reports legal pages (privacy, terms, imprint, /legal, in any recognised language and under any path prefix) that are linked only from the footer, which is where they belong (#981).
• A smart audit no longer marks a finding fixed when its rule threw an error on every page of the re-crawl. The rule never finished, so nothing was checked, and the earlier finding now stays open until a run completes the rule, the same as for a rule that times out (#999). A rule that timed out on only some pages still carries only those pages' findings, and a page it finished still resolves (#1000).
• a11y: frame-title, object-alt and empty-heading now read which elements are out of the accessibility tree the same way as button-name and the other naming rules. A hidden element is skipped and counted, and one a style may hide (a no-js fallback on a page with an external stylesheet included) is reported as <check>-unconfirmed instead of a failure. A visible one still fails (#1002).