v0.0.95

Two fixes for scores that moved when nothing on the site had, one for local audits that reached out to the cloud, and an installer that works where GitHub does not.

Changed

• Audits of localhost, loopback, and private-network addresses no longer hand anything to a hosted runner: no publish, no run registration, no cloud rendering, and no site added to your dashboard. This covers squirrel report --publish as well as squirrel audit, and internal names such as box.local and metadata.google.internal as well as private IP ranges. The audit, its report, and the content-based cloud analysis are unchanged, and the CLI prints one line saying the report stayed local. Hosted services cannot reach those addresses, so a dashboard site for one could never be screenshotted, re-rendered, or re-audited.

Fixed

• Published cloud reports no longer count findings the CLI carried from its local store as pages crawled this run. A machine with an old local audit database could publish thousands of stale findings, which the cloud stored as first seen today and scored as if every one of those pages had just been crawled, swinging the health score by tens of points between identical runs. Carried findings keep the date the cloud last saw them, and the audited-page count is now the pages the crawl actually visited.
• Two page URLs that differ only by their query string are two pages again. Findings on /p?id=1 and /p?id=2 were stored under one URL, piling every page's issues onto a single entry in the report.
• A signed-in audit of a local or private-network address no longer submits its pages to the cloud render service, which charged on submit for renders the hosted browser then refused.
• The installer now downloads from install.squirrelscan.com when GitHub is unreachable, so an install no longer dies on networks that cannot reach GitHub's release hosts. Both sources are checksum-verified against the release manifest. Set SQUIRREL_FORCE_MIRROR=1 to skip GitHub from the start, and if both hosts fail the installer now prints the two URLs it tried.
• A download host that answers with a sign-in or error page instead of the release manifest is now treated as a failed source, so the installer moves on to the other host rather than stopping on a parse error. This is what a captive portal or an intercepting proxy looks like.