v0.0.165

A new link rule, links/anchor-mismatch, and tech detection that ignores vendors named only in content the browser does not run. The anchor text parser now separates block children and link text is read the same way in stored and fresh crawls.

Added

• links/anchor-mismatch compares the anchor text pointing at a page with that page's title, H1 and URL words, per source page and target page, and warns when no meaningful word is shared. Navigation, header, footer and sidebar links, utility pages (privacy, terms, contact), the homepage, fragment links and pagination are left out; only pages that answered 2xx with HTML are judged; plurals, accents and two-character brands match; text in any script other than Latin, Cyrillic and Greek (Chinese, Japanese, Thai, Arabic, Hebrew, Korean, Devanagari and the rest) is counted as not judged, and so is text glued from adjacent elements that CSS may have laid out as separate words when its stored pieces were cut. A WordPress /?p=123 or /?page_id=5 target is judged as a page, not skipped as the homepage. The message says when the mismatching text is the only contextual anchor text a page receives. See links/anchor-mismatch.

Fixed

• Technology detection no longer counts a vendor that only sits in content the browser does not run or show. A vendor URL or tag inside the text of a script the browser does not run (JSON, JSON-LD, an import map, or any type that is not empty, module or a JavaScript MIME type), inside <template> content, or inside an HTML comment (commented-out code) was detected by the html detectors, and a <script src> or iframe inside a <template> by the script-URL ones. The page is now read once, and those regions are left out of what the detectors read. Only the detector that matches a comment on purpose reads comments (WordPress plugin banners, Jekyll, Mailchimp, Klaviyo's app block marker, Font Awesome's banner), so a commented-out Klaviyo or Font Awesome loader no longer counts, and CSS in <style> still does. Script ends need </script plus a space, / or >, a self-closing <template/> opens a template, and only a shadowrootmode of open or closed makes a shadow root, as in a browser. A region is only left out when the pass saw both of its edges: a comment with no -->, a <template> with no </template>, and everything after a tag over 64 KB stay as written. The exception is an import map inside a <template> that never closes: a browser keeps it inert, so its URLs are not read. (#1550)
• The security/leaked-secrets docs now record which caps bounded its findings before the per-page cap: the report's 1,000 items per check and the 1 MiB published-report cap, both downstream of the rule (#1554)
• A link's text now has a space between block-level child nodes (headings, paragraphs, list items), so a card link wrapping a heading and a description is read as separate words instead of one glued word. Text inside script, style, template and noscript is no longer part of a link's text, and the stored parse now marks rel="nofollow", sponsored and ugc links as nofollow. That is a behaviour change for the streaming link-graph rules: those links now leave the incoming-link counts links/orphan-pages, links/weak-internal-links and links/no-contextual-inbound read from stored parses, as they already did on the in-memory path. Crawls stored before this release keep their old glued link text and unmarked nofollow links until they are crawled again, so a11y/link-text section placement and links/anchor-mismatch can differ when an old crawl is re-analysed. Stored links now carry rel (and glued links textGlued and textParts), so a crawl's stored parsed_data grows slightly.