v0.0.128

The CLI moves to Bun 1.4.4, a crawl with a live owner is never retired, and a check that has nothing to check on a page stops keeping an old finding open.

Changed

• The CLI is built with Bun 1.4.4. A TLS chain that holds any of eight blocked eMudhra intermediate CA public keys is now refused, and the root store moves to NSS 3.131.1. Seven roots are no longer bundled (Entrust Root Certification Authority 2006, ePKI, Atos TrustedRoot 2011, SecureSign Root CA12, emSign Root CA C1, emSign ECC Root CA G3 and emSign ECC Root CA C3), so a site whose chain ends only at one of those can fail TLS. SECOM and Telia TLS roots are added. The binary is about 24 MB larger (73 to 97 MB on macOS arm64).

Fixed

• a11y: an element a CSS-nesting rule may hide (b { @media (min-width: 0) { display: none } }, .a { & .b { display: none } }) now reads as unconfirmed instead of shown, so an unnamed control a browser hides is reported as <check>-unconfirmed, not as a failure. A nested rule that sets neither display nor visibility changes nothing. The reader's Chromium table gains 13 nesting rows measured in headless Chromium (#1013, repro from #1014 by @dbdefault).
• A smart audit now closes a finding on a page the check no longer applies to, instead of carrying it forever, where the skip is a property of the page's own headers, URL or markup: no Link header (core/canonical-header), no file extension (content/mime-type), not paginated (crawl/pagination), no canonical tag (crawl/canonical-chain), no viewport meta (mobile/viewport-zoom), no <picture> (images/picture-element), a documentation page (content/placeholder-contact), no form sets novalidate (a11y/input-types), no copyright year (content/stale-copyright), a small 2xx page (ax/token-weight) and a page excluded by pattern (links/dead-end-pages). Those skip with a shared not-applicable reason that the resolution signal and the local and cloud merges read as evaluated and clean. A skip that could be a fetch, parse or rendering artifact (an empty response, no body, no images or form fields on a page a script may fill, no footer) still carries its finding, as does a check that did not run (no timing data, a scan stopped at its work cap). The skipped row's JSON carries details.foldKey: not-applicable and no longer the free-text skipReason; its message keeps the text (#1011).
• a11y: a page past the style reader's limits (more than 5,000 style rules, an over-long <style> block or selector, a no-break or other non-ASCII space in a style block, or a rule nested inside another) now reads every element as unconfirmed for what a style might hide, instead of as shown. Before, the rules past the limit were dropped, so an element they hid could read as shown and an unnamed control inside it failed; now the naming checks report <check>-unconfirmed there. A page under the limits reads as before (#1015).

Added

• a11y, links: link-text and anchor-text now recognise generic link text in Spanish, French, German, Portuguese, Italian, Dutch, Japanese, Chinese, Korean and Russian (cliquez ici, mehr, haga clic aquí, 詳しくはこちら and similar), chosen by the page's <html lang>, with English always checked. A page with no or an unknown lang keeps the English list, matching is on the whole text, and the conventional account and legal labels are never reported (#840).
• content: word-count skips pages kept out of search (noindex meta or X-Robots-Tag), like core/meta-title, core/meta-description and core/h1: a login, sign-up or dashboard page is short by design. The page gets one skipped check naming the source, and nothing is skipped on a staging or preview site whose homepage is noindex (#841).
• Retention and self disk --prune now read the crawl lease that v0.0.127 started writing (#946). A crawl whose heartbeat is under 5 minutes old, or whose owner process is still alive on this machine (trusted for up to 24 hours of silence, so a suspended laptop is safe and a reused pid cannot hold a crawl forever), is never retired, including when a later audit of the same project finishes first. A killed crawled crawl is retired by the next audit and by --prune once its heartbeat is 5 minutes old, and a killed running crawl, which --resume continues, after 24 hours, in both cases without waiting for a later audit; stopped, paused and failed crawls are never retired sooner by a dead lease: stopped and paused keep their 7 days, failed its 30 minutes. A newer finished audit plus the idle time (30 minutes, or 7 days for stopped and paused) retires any of them as before. An owner on another host or one that cannot be read counts as live until the 5 minutes pass, and the check runs again inside the retiring transaction. Crawls written by older versions have no lease and follow the previous rules, and --prune --dry-run shows a held crawl's owner pid and last heartbeat. A --resume after a kill takes the lease over at once when the old owner's process is gone.