v0.0.148

[[ignore]] in squirrel.toml waives findings by item or URL without disabling a rule, the technology scan reports the scripts it never read, and the JSON report schema is now 1.4. integrity/brand-impersonation and integrity/fake-auth-overlay no longer miss the common evasions, a keyword-stuffing plain-div menu shape is covered, and the audit ignore list drops nine entries whose advisories no longer match.

Added

• [[ignore]] in squirrel.toml waives findings without disabling a rule. Some findings are right in general and not actionable on your site (the cookies Shopify sets itself, a country selector the platform renders, a path served by an app proxy). An [[ignore]] entry names a rule (or a glob such as a11y/*) and the items and urls to waive, with an optional reason: items match exactly by default (glob: and regex: by prefix), urls use the excludePatterns forms, fields in one entry combine with AND and entries with OR. The engine drops the waived items before a finding is counted, on every rule and every kind of result: a check with items left keeps its status and shows (N ignored), a check whose items are all waived becomes a pass reading N waived, and a page waived by urls alone is skipped for the rule, so scores and counts stay stable. Nothing is dropped silently: every report says what was waived (Ignored by squirrel.toml: ..., meta.ignored in JSON, an <ignored> element in the LLM and XML reports), lists entries that matched nothing, and squirrel audit --no-ignore runs without the table. Compromise detection (integrity/*) cannot be ignored, squirrel config validate reports entries that name no rule, name a rule that cannot be ignored or use a regex the matcher refuses, and editing an entry re-evaluates only the rules it names. Cloud audits do not read squirrel.toml; selector ignores and website-level settings follow. Ignore regexes run on a linear-time engine (no back-references or lookaround), so no pattern can hang an audit; an entry that runs over its work budget stops waiving and the report says so instead of hiding findings, and an entry with neither items nor urls is refused rather than waiving everything the rule finds. See Ignore. meta.schemaVersion is now 1.4 (the new meta.ignored). (#1262)

Changed

• Technology detection reports the scripts it never read. A first-party script the crawl dropped for being over its 5 MB fetch cap, and the first-party scripts a page references that the audit's script limit left unfetched (10 to 50), are now counted in technologies.truncated (script-too-large, script-limit) beside the byte and time reasons, so a bundle that hid a technology no longer reads as a clean scan. When a scan detects nothing but was cut short, the technologies section is kept, empty, with truncated; it is not synced to the dashboard, so the stack an earlier scan found is not cleared. (#1408)

Fixed

• integrity/brand-impersonation and integrity/fake-auth-overlay no longer miss the common evasions. A "Sign in with Google" or "Continue with Google" control is read when it is a <button>, an <input type=submit> or a link whose label is only in aria-label, title or a logo's alt; Cyrillic and Greek look-alikes and fullwidth letters are normalised; hidden text spliced into a label does not hide it; links inside <template> are read. Sign-in links to Auth0, Okta, Cognito, Supabase and Firebase are no longer reported as Google impersonation, and login.windows.net, login.microsoftonline.us and b2clogin.com count as Microsoft. Overlay geometry from !important, inset: 0 or a class in a <style> block is detected. Reading is bounded by work, and the bounds that can cut a relevant read are reported: every control gets a fair share of a fixed reading budget and the relevant ones a longer read, and when a limit (controls, templates, attribute length, CSS rules for iframes) is passed the rules say so instead of staying silent; a page of thousands of unclosed anchors, templates nested in templates, a run of combining marks, thousands of iframe {} rules or frames with hundreds of classes is read within a fixed bound of work, and links to the page's own site (as a browser resolves the URL) are not read; and when a bound cuts a relevant read the rules emit an info check with details.scanTruncated instead of nothing. A broker spares only Google and Microsoft sign-in to its authorize endpoint, not the whole host. The overlay's reported source no longer carries credentials or a query. (#784)