astro-post-auditv0.10.0

Changelog

Generated from CHANGELOG.md in the project repository. Never maintained twice.

Unreleased

  • addedAccessibility: rules.a11y.contrast checks text contrast and other style-dependent rules without a browser, computing styles from the stylesheets in dist/. A stylesheet that is not on disk keeps the affected rules untested (#115). Off by default; see Contrast.
  • addedPerformance: with rules.a11y.contrast on, 1000 generated pages sharing two stylesheets take about 1.5 s in the accessibility check instead of 0.1 s; without the option nothing changes.
  • addedReport: the JSON report gains inputs, one note per stylesheet that could not be read (remote URL, missing file, unresolved @import) with the number of pages affected; the text and Markdown reports list them under "Stylesheets not read".
  • changedAccessibility: rules come from a11y-rules 0.28 (was 0.26). An empty page now reports headings/none instead of landmarks/main-missing; the full list of upstream changes is in the a11y-rules changelog.
  • changedPages: the project site uses the current shared theme (0.12.12).
  • changedReport: runemark 0.10: with color: 'auto', an empty NO_COLOR counts as unset and TERM=dumb gives plain output without colour or Unicode symbols. Everything else renders as before.
  • changedPerformance: measured on a real site (insights.casoon.de, 1092 HTML pages, html_validation on, cache cold): 0.9.0 takes 73–81 s, 0.10.0 takes 4.5–4.8 s (#109, #113). Errors (0) and warnings (5583) are identical; the info count drops from 1100 to 23 because structured-data/website-missing-search-action is no longer reported (1088 pages), while 11 info findings from the new link rules appear.

0.10.0

31 October 2026

  • changedPerformance: html-conform 0.3.4 (relax-ng 0.2.3, schematron-engine 0.2.1, xpath-eval 0.2.3) cuts html_validation from about 0.5 s to roughly 15–20 ms CPU per page when the cache is cold; findings are unchanged (#109, #113).
  • changedSite: the footer follows the page language instead of always showing German text, and the start page now carries a release teaser and an FAQ (theme 0.11.1).
  • changedAccessibility: rules come from a11y-rules 0.26. Several heuristic rules now report review instead of fail, landmark and heading-structure rules count as best practice, and new link rules (links/new-window-unannounced, links/purpose-link-only, URL and single-character link names) are added.
  • changedAccessibility: findings that only concern WCAG AAA criteria are reported once per element pattern across the site instead of once per page; the message gives the number of occurrences and pages.
  • changedAI visibility and UX: heuristic findings carry the outcome review instead of fail: ai-visibility/low-word-count, no-semantic-sections, no-subheadings, missing-author-schema, ux/no-cta, ux/no-trust-signals, ux/high-link-density and ux/high-interactive-density. Severity and build gating are unchanged. Messages say what was found, not what AI systems or users supposedly prefer (#103).
  • changedDocumentation: the README states the cold-cache cost of rules.html_validation and recommends persisting node_modules/.cache/astro-post-audit/ in CI (#109).
  • removedAI visibility and UX: five rules that repeated other modules are gone: ai-visibility/lang-missing, missing-og-title, missing-og-description, missing-canonical and ux/generic-link-text. document/lang-missing, opengraph/title-missing, opengraph/description-missing, canonical/missing and links/generic-name report the same. Old ids keep working in severity overrides and baselines. Enable rules.opengraph.require_og_title and require_og_description to keep the Open Graph checks (#103).
  • fixedAI visibility: the word count no longer includes the text of <script>, <style>, <noscript> and <template>; ai-visibility/low-word-count and no-subheadings counted inline code before (#103).

0.9.3

27 October 2026

  • addedGo-live: goLive.imageHosts lists further hosts that may serve og:image, such as an image CDN on another domain (#100).
  • changedGo-live: og:image may come from a subdomain of the production host without a golive/og-origin finding; og:url still has to use the production origin. og:url and og:image on a forbidden domain are reported as golive/forbidden-domain (#100).
  • changedGroups: a group set to 'warn' caps every finding of its check modules at warning, including rules added later through a11y-rules; an explicit severity entry still wins (#98).
  • changedDocs: release history lives in the changelog, and the full rules reference lives in the integration options documentation.
  • fixedLinks: sites with an Astro base are audited against their public URLs: links, canonicals, sitemap entries and assets under the base resolve to the files at the root of dist/, and a root-relative link that misses the base is reported as broken (#97).
  • fixedSitemap: a sitemap-index.xml (as written by @astrojs/sitemap) and its child sitemaps are read, so sitemap, robots and go-live checks see their URLs instead of reporting sitemap/missing (#95).
  • fixedReports: the binary writes the JSON report itself, so large reports no longer fail with ENOBUFS (#96).
  • fixedBaseline: errors already in the baseline no longer count towards maxErrors, which could stop the audit before new errors were found; writeBaseline ignores maxErrors so the snapshot is complete (#93).
  • fixedReports: a run that maxErrors stopped early is marked truncated even when no finding was dropped (#94).
  • fixedImages: a missing width/height is reported once as images/missing-dimensions; assets/img-dimensions only reports when the images check is off (#99).
  • fixedStructured data: structured-data/website-missing-search-action only reports on the start page; WebSite reference nodes on subpages no longer produce one hint per page (#88).
  • fixedUX heuristics: minCtaPerPage compares the number of CTAs on a page with the minimum instead of only checking for one (#102).
  • fixedUX heuristics: uxHeuristics: false switches the check off, and true or an object keep the other settings from rules.ux_heuristics (#101).
  • fixedDocs: historical changelog entries use flat lists so their details render on the project site.
  • fixedDocs: the project site's version badge and metadata read the npm package version instead of a separately maintained value.
  • fixednpm: published packages exclude compiled unit and end-to-end test files and their declarations.
  • securityDependencies: updated rustls, rustls-webpki and webpki-roots (external link checks), quick-xml 0.42 (sitemap parsing) and c2pa 0.91 (pulls in zip 9); cargo audit reports one remaining advisory (rsa, no fix available, only affects private-key operations, which this tool does not perform).

0.9.2

26 October 2026

  • addedReleases: the Release workflow publishes the npm package through trusted publishing, after approval in the npm environment — no npm token is stored anywhere and the package carries a provenance statement. Every release archive carries a signed build provenance attestation (gh attestation verify <archive> --repo casoon/astro-post-audit).
  • changedDocs: the start page of the project site opens with an excerpt of a real report next to the install commands instead of the full report.

0.9.1

4 October 2026

  • fixedUpdate the shared accessibility crates to 0.19.1: quiz radios and checkboxes no longer request format instructions, search controls no longer request personal autocomplete, and language detection respects marked descendants (#75–#77).
  • fixedAccessibility findings include unique CSS selectors in text, JSON, Markdown and SARIF reports (#80).
  • fixedMissing-srcset hints only flag images wider than 1,000 px, or assets above 100 KiB when width is unknown (#79).
  • fixedThe navigation-location remedy explains that the home/logo link can indicate the current home page (#78).

0.9.0

3 October 2026

  • addedRule group viz_alternatives (groups: { viz_alternatives: true }, or rules.a11y.viz_alternatives) checks barrierlab's display-mode convention: viz/* for figure[data-viz] (text layer, still image, caption, data table) and display/* for html[data-display] (toggle, early init, hidden text layer). Off by default; pages without the convention produce no findings (#69).
  • addedhtml_validation caches its results per page, keyed by a hash of the page's HTML, in node_modules/.cache/astro-post-audit/html-validation.json. Incremental builds validate only the pages whose HTML changed (1,000 pages: 34 s → under 10 ms when nothing changed). On by default; rules.html_validation.cache: false switches it off (#70).
  • addedrules.a11y.manual_checklist (default false) lists the manual/* checklist items from a11y-rules, once per page where they apply, with outcome untested. Like any finding they count by severity — items with severity high fail the build; tune them with severity.
  • changedHreflang: checks use web-checks 0.5 (shared with auditmysite).
  • changedHreflang: new hreflang/invalid-code for values that are not a language code (ISO 639, optional script and region) or x-default, e.g. de_DE or deutsch. On by default when check_hreflang is on; hreflang.require_valid_code: false switches it off.
  • changedHreflang: x-default no longer counts as a page's self-reference, so a page that names itself only as x-default now gets hreflang/no-self-reference. x-default is matched case-insensitively.
  • changedHreflang: relative href values are resolved against the page URL, so a relative self-reference (href="/") counts. Query strings are kept when comparing URLs, so ?lang=de versions are no longer mistaken for the page itself.
  • changedAccessibility rules come from a11y-rules 0.18 (was 0.12), HTML validation from html-conform 0.3.1 (was 0.2). Finding counts change on upgrade — fewer false positives (hidden subtrees are skipped, lists, listbox, name next to RDFa property, skip-link detection by target), and new rule ids from the auditmysite migration (B1–B7): ARIA attributes (aria/*), accessible names (names/*, dialog/*, summary/*, status/*, label-in-name/*), forms (forms/*, context/*, auth/*), landmarks and structure (landmarks/not-unique, landmarks/not-top-level, landmarks/banner-duplicate, landmarks/contentinfo-duplicate, landmarks/content-outside, headings/none, keyboard/focusable-no-role, keyboard/interactive-not-focusable, dialog/focusable-missing, patterns/accordion-controls-missing), links and pointer (keyboard/click-handler-not-focusable, links/used-as-button, navigation/location-missing), images and media (images/area-alt-missing, images/input-alt-missing, objects/alt-missing, images/server-side-map, media/audio-autoplay, frames/name-missing), tables, document and language (tables/header-without-data, tables/data-undetermined, tables/headers-attr-invalid, document/lang-mismatch, language/*, timing/meta-refresh, headings/section-without-heading, aria/role-redundant, names/title-only, patterns/tooltip-unreferenced). New landmarks/* ids follow rules.a11y.check_landmarks; the others run by default and can be switched off per id with severity.
  • changedThe JSON report's rule_runs now also lists the other rules that need rendering (focus indicator, target size, reflow, motion, visual order) as capability_missing.
  • fixedgroups.seo and groups.a11y with 'warn' used pre-0.7 rule ids, which triggered legacy-id warnings the user never wrote; they now use the current ids.
  • fixedgolive/* findings can no longer be downgraded or switched off with severity, as documented.
  • fixedDocs: outputMarkdown and progress: 'verbose' documented, check count (32), the ai_bot_policy bot classes, links/broken in the sample output, and the npm badge on the project page corrected. rules.a11y.allow_decorative_images is marked deprecated — it has had no effect since the switch to a11y-rules.

0.8.0

28 September 2026

  • addedcolor option ('auto', 'always', 'never') for the text report and progress output, so a piped build log can still get colour and Unicode symbols (#56).
  • changedStructured data: JSON-LD is evaluated by web-checks 0.4 (structured_data), shared with auditmysite. The rule tables follow Google's structured-data docs, so finding counts change.
  • changedStructured data: no longer reported: Article/BlogPosting/NewsArticle headline, Organization/Person name and WebSite name/url as structured-data/missing-property (Google lists no required properties for these types).
  • changedStructured data: now reported: missing required properties of Event, Recipe, VideoObject, JobPosting, SoftwareApplication, ProfilePage, ItemList and Product (name plus one of offers/review/aggregateRating) as structured-data/missing-property; BreadcrumbList with fewer than 2 items or without item on a non-last entry; structured-data/invalid-structure for a non-object root, a non-array @graph or an empty array/@graph.
  • changedStructured data: severity changed: structured-data/news-article-missing-publisher High → Medium (recommended, not required); structured-data/local-business-missing-address Low → Medium (required by Google).
  • changedStructured data: behaviour: empty values ("", null, [], {}) count as missing; @context must be exactly http(s)://schema.org (also as array entry or @vocab) and is inherited into @graph; top-level arrays are expanded instead of reported as missing context; every @type entry is assessed, full IRIs included; structured-data/duplicate-type counts blocks, not repeats inside one block.
  • changedTitle and meta description length come from web-checks 0.3 and count characters, not bytes: before, every umlaut counted twice, so a 60-character German title could be reported as too long. Whitespace is collapsed as in the browser before counting.
  • changedOpenGraph / Twitter Card presence, twitter:card values and the absolute-og:image rule come from web-checks (shared with auditmysite). opengraph/image-missing and opengraph/twitter-card-missing now also fire when the tag exists with empty content, like the other presence checks already did.
  • changedrobots.txt is evaluated by the shared web-checks crate instead of a local copy.
  • changeda11y-* crates updated to 0.12.0. Accessibility finding texts now come in English from a11y-rules, and a duplicate id is only reported when an IDREF (e.g. aria-describedby, for) points to it, since WCAG 2.2 removed 4.1.1.
  • changedprogress: 'verbose' prints its per-check lines through runemark instead of raw stderr output.
  • changedrunemark updated from 0.1.1 to 0.9.0.

0.7.0

23 September 2026

  • breakingAccessibility and document rules come from a11y-rules (a11y-core), shared with auditmysite and LiveAudit. Rule ids changed (images/alt-missing instead of a11y/img-alt); old ids are still accepted in severity overrides and baseline files and translated with one warning per id.
  • breakingFindings carry two axes, outcome (fail, review, pass, untested) and severity (low … critical). The JSON report gained rule_runs, which lists rules static HTML cannot serve, such as contrast, as capability_missing.
  • breakingIntel macOS (darwin-x64) is no longer built or shipped.

0.6.0

9 September 2026

  • addedmode: 'fast' | 'full' option. 'fast' disables rules.html_validation regardless of the rest of the configuration.
  • fixedlinks.known_routes is honoured for cross-page fragment checks.

0.5.7

9 September 2026

  • addedCSS architecture check: local and inline CSS per route with payload limits and median-based outlier detection (css-architecture/route-payload, css-architecture/route-outlier).
  • changedTailwind source analysis handles class:list, ignores build and dependency directories and detects same-axis spacing conflicts.
  • changedRuntime, TypeScript and JSON Schema defaults are aligned and covered by regression tests.
  • changedRender blocking no longer recommends preloading every stylesheet.

0.5.6

4 September 2026

  • changedcrates.io publishing moved to a manual maintainer step.

0.5.5

3 September 2026

  • fixeddensity_per_1000_words matches the documented TypeScript and schema value; invalid rule types fail early.
  • fixedAstro's client-island runtime style no longer produces HTML conformance findings.

0.5.4

3 September 2026

  • addedOpt-in C2PA Content Credentials validation (rules.c2pa) with require_trusted.
  • addedlinks.known_routes to exclude SSR and dynamic routes from broken-link checks.
  • addedConfigurable content style thresholds.

0.5.2

29 July 2026

  • fixedContent style text extraction.

0.5.0

29 July 2026

  • addedContent style heuristics for recurring "reads like AI" writing patterns (contentStyle, preset: 'editorial').

0.4.6

23 June 2026

  • addedAstro 7 compatibility and end-to-end tests of the integration.

0.4.5

1 June 2026

  • addedprogress: 'verbose', which prints each check as its own line with finding count and timing.
  • fixedThe progress bar stays visible after the run.

0.4.4

1 June 2026

  • fixedThe progress bar fills up to total/total.

0.4.3

1 June 2026

  • fixedThe progress bar is clamped to the terminal width.

0.4.2

1 June 2026

  • addeddebug option with verbose diagnostics on stderr.

0.4.1

1 June 2026

  • addedLive progress bar on stderr during the audit.

0.4.0

1 June 2026

  • addedNew check modules: meta-refresh redirects, client-side JS weight per route, content sync (collection items without a page) and HTML5 parse errors.
  • addedOpen Graph image existence, dimensions and file size; URL depth limit; robots.txt noindex/Disallow contradictions; hreflang target existence; alt-text quality heuristics; GDPR third-party transfers.

0.3.2

26 May 2026

  • fixedAn empty Disallow: no longer counts as disallow-all (RFC 9309).
  • fixedLandmark false positives when header or footer sit inside a wrapper div.

0.3.0

25 May 2026

  • addedLandmark, ARIA and image checks, AI visibility, UX heuristics, extended Open Graph and robots.txt checks.
  • addedGo-live gate, several report formats in one run, SSR detection, Astro 7 support.

0.2.11

11 May 2026

  • addedTop-issue summary for large result sets and Astro-specific remedies.
  • changedFiles under /_astro/ are exempt from hashed-filename checks.

0.2.10

9 May 2026

  • addedstandard preset.

0.2.9

9 May 2026

  • addedPresets seo, accessibility, performance and production, maxWarnings and selector-based baselines.

0.2.7

9 May 2026

  • addedMarkdown and SARIF reports, baselines, source file hints and rule groups.

0.2.6

6 March 2026

  • addedCrawl budget, i18n audit, privacy/security, render blocking and structured data graph checks.

0.2.5

6 March 2026

  • addedPresets, benchmark output, fix suggestions and a JSON Schema for the options.

0.2.4

5 March 2026

  • addedSKIP_AUDIT environment variable, canonical cluster detection, external link checking.
  • fixedFragment check false positives with percent-encoded umlauts.

0.2.2

5 March 2026

  • addedJSON-LD duplicate type check.
  • removedTOML configuration; options are passed as JSON by the integration.

0.2.0

5 March 2026

  • addedAstro integration, page overview and skip-link check.

0.1.3

25 February 2026

  • changedPackage renamed to @casoon/astro-post-audit.