v0.0.153
Released Nov 1, 2026
Release Notes
Technology detection recognises the Klaviyo script loader forms browsers actually run (an unquoted or long-attribute src, a preload link, the inline element.src = loader and a proxied script URL) without the loader scan slowing a page that holds many empty scripts or a tag stuffed with openers. Thanks to William for the Klaviyo loader recall fix (#1457, #1463).
Fixed
- Klaviyo detection again recognises the script loader forms browsers actually execute. It accepts an unquoted
src, asrcafter long attributes, a lazydata-src, a preload link, the inlineelement.src = "//static.klaviyo.com/..."loader and a collected script URL passed through a proxy. The URL signatures remain anchored, and an anchor link, an escaped code sample or a commented-out script tag does not count as a loaded script. Only arel=preloadorrel=modulepreloadlink counts as a loader, and the inline-loader check stays inside its own script, so a page of many empty script tags is no slower to scan. Known limits of the loader recall: a page that quotes the markers in a raw<pre>or JSON block, anelement.src = "..."assignment on a non-script element and an assignment inside a block comment still count. (#1457)
Update to this version
squirrelscan will auto-update, or run this command to update now:
$