v0.0.155

Technology detection recognises fewer look-alikes and more real loaders: a Clerk key must decode to a Clerk host (a Stripe publishable key is no longer Clerk), a Next.js script component's bare loader is read, a config past many look-alike strings in a bundle is found, and surge, railway, amplify and ActiveCampaign Pages hosting is read from the page's own host. [[ignore]] entries take element selectors, and --max-duration judges a gzip page by its decoded size, so a small compressed page can no longer force a long parse. Thanks to William for the Clerk key validation (#1481, #1482).

Added

• [[ignore]] entries take selectors. A waiver can now name an element by where it sits (selectors = ["localization-form select"]: tags, #id, .class, descendant and >), so a rule keeps reporting your own elements while it waives the one your platform renders. a11y/label-content-name-mismatch, a11y/form-labels and a11y/select-name report the element's place; squirrel config validate names a rule that does not, refuses an unsupported selector, and the waived items are counted and listed in meta.ignored like items. Reports never carry the recorded place. (#1440)

Fixed

• integrity/brand-impersonation bounds the logo alt text it reads per control. A control wrapping many logos reads the alt of its first four in full and the next ones for 300 characters, at most 100 in all; a later alt longer than 300 characters, or more than 100 alts, counts the control as not read in full. The window arrays are freed before the reads. (#1424)
• A Stripe publishable key is no longer mistaken for Clerk. A pk_live_ or pk_test_ value written next to publishableKey now counts as Clerk only when its body decodes to a Clerk frontend host ending in $; opaque Stripe keys no longer trigger the Clerk signature. (#1478)
• --max-duration's parse cap judges the decoded page, not the compressed one. The cap (5 MiB, because a parse cannot be interrupted) compared the recorded size, which is the Content-Length header, so a gzip response of a few KB that inflates to megabytes was parsed in full, in the crawl, the audit pass and the streaming pass that counts the pages left out. All three now compare the larger of the recorded size and the decoded body's bytes, so such a page is stored, counted in pagesTooLarge and listed like any other too-large page. A run without --max-duration is unchanged. (#1497)
• A Next.js loader written as a bare script child is read when its component is next/script elsewhere on the page. A page uses one component reference for every use, and a real layout passes a Clarity loader as { type: "text/javascript", children: "..." } with no id and no strategy beside two uses of the same reference that carry them. Once any use of a reference has one of next/script's four strategies, every use of it is read as a script; a reference never seen with a strategy is not, so a component that merely displays a code sample is still dropped. (#1487)
• A real Firebase, Supabase or Clerk config deep in a whole bundle is found past any number of look-alike strings. An inCode detector gave up after 64 pattern matches that started inside strings, and a whole bundle (the local scan reads one up to 8 MB) holds far more than a 256 KB head: docs text, error messages and vendor snippets that quote a config. The search now continues past the string a match was in, so many mentions in one string are one candidate, and the bound is 4,096. A config that only appears in strings and comments is still not detected, and one that comes after more than 4,095 such matches is still missed, with no truncation signal. (#1422)
• surge-sh, railway-app, aws-amplify-hosting and ActiveCampaign Pages are read from the page's own host. Their signatures matched .surge.sh, .railway.app, .amplifyapp.com and .ac-page.com anywhere in the page HTML, so a site that only loads a third-party script or links to one of those hosts read as hosted there (the same class as the firebase-hosting fix). Surge and Railway keep their Server response header signal. (#1449)