Releases

New Audit Rules

This release significantly expands rule coverage with improved detection across accessibility, performance, and security categories.

Accessibility Enhancements

• Color Contrast: Now performs actual WCAG 2.1 contrast ratio calculations (4.5:1 for normal text, 3:1 for large text) instead of pattern matching
• Link Text Detection: Expanded generic link text patterns from 12 to 50+ terms including action words, CTAs, and navigation patterns
• Redundant Alt Text: Added 20+ new patterns covering technical diagrams, file references, and lazy placeholder text
• ARIA Role Mappings: Added implicit ARIA role detection for 40+ HTML elements (lists, tables, forms, landmarks)

Performance Enhancements

• JS Library Detection: Expanded from 12 to 35+ libraries including:
  • Frameworks: Svelte, Next.js, Nuxt
  • State management: Redux, MobX, Zustand
  • Visualization: Chart.js, Highcharts, ApexCharts
  • Animation: Framer Motion, Anime.js, Lottie
  • Legacy libraries with vulnerability tracking: Prototype.js, YUI
• Total Byte Weight: Now tracks external JavaScript file sizes for more accurate page weight reporting

Security Enhancements

• CSP Detection: Upgraded severity from info to warning, now validates specific directives (script-src, frame-ancestors, object-src) and detects weak values
• Leaked Secrets: Reduced false positives by filtering code identifiers (camelCase, snake_case function names) and requiring assignment context

View all rules →

Other Improvements

• Improved accuracy of AWS secret key detection patterns
• Fixed false positive detection in security scans for array elements vs assigned values

New Features

Diff Reports

We added an issue fingerprinting system and a new diff/reporting mode to squirrel report so agents can track regressions and improvements between audits. Diff mode compares a baseline audit to a current audit and outputs added, removed, and changed issues with stable fingerprints, making it easier to see what actually changed across runs. It supports the existing output formats (console, text, json, llm, markdown), and treats status shifts (warn ↔ fail) as a change rather than a new/removal, so trend analysis is consistent.

New flags include --diff <audit-id|domain>, --regression-since <audit-id|domain>, and --allow-cross-site (for comparing different base URLs when needed). The JSON/LLM outputs include structured diff summaries plus baseline/current metadata, so automation and agent workflows can reliably parse and act on regressions.

Compare audit reports to track changes over time:

# Compare current report against a baseline
squirrel report --diff <audit-id>

# Compare latest report against a baseline for regression tracking
squirrel report --regression-since <audit-id-or-domain>

# Allow comparison across different base URLs
squirrel report --diff <audit-id> --allow-cross-site

Diff reports show:

• Added - New issues not in baseline
• Removed - Issues fixed since baseline
• Changed - Issues with status changes (regressions/improvements)

Output formats: console, text, json, markdown, llm

XML Output Format

Export audit reports in XML format:

squirrel audit https://example.com --format xml
squirrel audit https://example.com --format xml --output report.xml

Other Improvements

• Streamlined publish output - --publish flag now outputs just the URL for easier scripting and CI integration
• Improved URL pattern matching - --exclude and --include patterns now match against pathname instead of full URL, making patterns more intuitive (e.g., /blog/* works as expected)
• Better shell completions - Added completions for new --diff, --regression-since, and --allow-cross-site flags

Bug Fixes

• JSON-LD validation fix: Fixed schema/json-ld-valid rule always reporting failure due to accessing wrong field (#3) - thanks @Fede654
• Schema deserialization fix: Fixed cached audit results losing schema getter methods, causing rules to fail on subsequent runs (#4) - thanks @Fede654
• Multi-type schema preservation: Schemas with multiple @type values (e.g., ["LocalBusiness", "Organization"]) are now preserved as arrays instead of being normalized to a single type (#5) - thanks @Fede654
• Schema.org @context inheritance: Child items within @graph structures now properly inherit the parent's @context, fixing false "Missing @context" validation errors (#2)
• thanks @bberenberg

Improvements

• Expanded LocalBusiness detection: Extended support from ~15 types to the full Schema.org LocalBusiness hierarchy (140+ subtypes including all Restaurant, Store, MedicalBusiness, and other specialized business types) (#7) - thanks @Fede654
• Multilingual E-E-A-T page detection: About, Contact, Privacy, Terms, and Editorial policy page detection now supports URLs in 10+ languages (English, Spanish, French, German, Portuguese, Italian, Dutch, Polish, Russian, Japanese) (#6) - thanks @Fede654

New Audit Rules

62 new audit rules added across multiple categories, bringing comprehensive coverage for accessibility, performance, and security best practices.

Accessibility (48 new rules)

ARIA validation and naming:

• aria-valid-attr / aria-valid-attr-value - Validates ARIA attribute names and values
• aria-roles - Checks for valid ARIA role values
• aria-required-attr / aria-required-parent / aria-required-children - Ensures proper ARIA structure
• aria-hidden-body / aria-hidden-focus - Prevents hiding content from assistive technology incorrectly
• aria-command-name / aria-input-field-name / aria-toggle-field-name - Ensures interactive elements have accessible names

Element accessibility:

• button-name - Checks all buttons have accessible names
• empty-heading - Detects headings without content
• frame-title - Ensures iframes have title attributes
• select-name - Validates select elements have labels

Structure and navigation:

• definition-list / dlitem / list-structure / listitem - Validates list markup
• landmark-one-main - Ensures exactly one main landmark
• tabindex - Checks for appropriate tabindex values
• duplicate-id-aria - Prevents duplicate IDs in ARIA references

Language and content:

• html-lang-valid / valid-lang / html-xml-lang-mismatch - Validates language attributes
• meta-refresh - Detects problematic auto-refresh
• link-in-text-block - Ensures links are visually distinguishable
• paste-inputs - Detects inputs that block pasting (accessibility anti-pattern)

Performance (14 new rules)

• doctype / charset - Validates HTML5 document structure
• compression - Checks for Gzip/Brotli compression
• cache-headers - Analyzes Cache-Control configuration
• http2 - Checks HTTP/2 protocol support
• total-byte-weight - Monitors total page weight
• unminified-css / unminified-js - Detects unminified assets
• duplicate-js - Finds duplicate JavaScript libraries
• legacy-js - Detects ES5 polyfills and legacy code
• js-libraries - Identifies libraries and known vulnerabilities
• source-maps - Checks for exposed source maps
• animated-content - Suggests converting GIFs to video
• images/offscreen-lazy / images/optimized / images/responsive-size - Image optimization checks

Security (1 new rule)

• third-party-cookies - Detects third-party tracking resources

📖 Full rule documentation: https://docs.squirrelscan.com/rules

New Commands

squirrel auth - Authentication

Authenticate with your squirrelscan account for publishing reports and accessing :

squirrel auth login           # Opens browser for OAuth login
squirrel auth status          # Check authentication status
squirrel auth logout          # Sign out and revoke token

squirrel report --publish - Report Publishing

Publish audit reports to share with your team:

squirrel report --publish                        # Publish with default visibility
squirrel report --publish --visibility unlisted  # Unlisted report
squirrel report --publish --visibility private   # Private report

Published reports are available at reports.squirrelscan.com and can be managed from your dashboard.

Other Improvements

• squirrel report --list now shows published report status and URLs
• Added crawlId to JSON report output for tracking
• Shell completions updated with new auth commands and --publish/--visibility options
• Added musl (Alpine Linux) platform support in release manifest

Added

• Linux musl/Alpine builds in x64 and arm64

Fixed

• Hotfix on race condition on install

Added

• New feature: Coverage mode for crawling with --coverage flag. Options are: quick for a quick scan, surface for surface level (with single-sample url tree detection) or full for a full crawl (which will also check all content). Documentation is here and the default is surface
• Support for 8-character short ID prefix in report command
• URL pattern detection for surface crawl mode

Fixed

• SQLite file lock cleanup issues on Windows

Performance

• Parallel crawl loop with content store caching improves performance across crawls

Added

• llm output format is now further optimized with token outputs
• squirrel skills update subcommand to update skill installs - see reference
• core audit-website skill updated to version 1.10 - more performance and running hints

Fixed

• squirrel feedback was failing at times
• fallback with squirrel skills commands

Performance

• Removed redundant details section from LLM output

Added

• New performance rule - perf/js-redirects - detect javascript 3xx redirects [see docs]
• New crawlability rule - crawl/redirect-chain - detects redirects in links and suggests shortcutting to target [see docs]
• New link rule - links/weak-internal-links - Detects pages with a low number of internal dofollow links pointing to them [see docs]

Fixed

• Improved rule detection for js-redirects and weak-internal-links

Fixed

• Hang on first run that would happen sometimes

Added

• Added squirrel skills install command for managing skills
• Added release permalink pages on website
• Installer now installs skills

Changed

• Increased maximum pages cap from 500 to 5,000

Added

• Added security/leaked-secrets security rule for detecting exposed credentials - rule docs
• Added security/form-captcha rule for form protection checks - rule docs
• Install now available on npm as squirrelscan

Changed

• CLI options now use kebab-case for consistency
• Agent use documentation

Added

• --bin-dir flag for CLI with shell-aware PATH instructions
• Markdown and LLM output formats for audit command

Fixed

• App formatting issues

Added

• WAF detection in crawler
• Display config and database paths on command execution

Changed

• Removed node-tls-client dependency from crawler

Fixed

• Project setup on init and config setting
• Updated quickstart configuration

Added

• Compact LLM output format for reports
• Skills updates with Makefile support

Changed

• Improvements and refactoring to core functionality
• Updated core audit-website skill

Fixed

• Graceful fallback to standard fetch when TLS client unavailable in compiled binary