site-inspector 3.2.0 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9da6e03626519a29904ac4f663565104f6793e9fedae46f786f268ea7beaf870
-  data.tar.gz: 100c9e6f24fd2f5ded3cc7239d37f30852eb7c7cd4a0c69651fc1d260c0043c6
+  metadata.gz: fcfea7cf5820cbc1cd0d845ce7a5e14bbbc5a62e76397b73fbc17c15657f2f57
+  data.tar.gz: 719dc99c75964e87815b198d8099580d304600f17b2f3ed27f247cef93ac741b
 SHA512:
-  metadata.gz: 974095f3bc91b3a83c90ef9fa9879942e66e3a4927b0e1d83a0cba2727c9f7e301ab151a3f0bac1ff507d3a16549c64af4be23fdd245ede0ac0dc25401096ba2
-  data.tar.gz: 16378f1054392ef3aa472469860367bab3c4d276bd57eaec9131382109aa85218ad535d82477d215d7c0294f310e82eac987275fd1b7d5148c5d3a1e722c8ab5
+  metadata.gz: b97dcdc47fe1f36846783ed03ca930ea381b359af5be5a08105af16fe11f1a4df025b1aeecf2f3b7533c956371e5e524a9245bd9ca9251a47288c065fbf7aa2f
+  data.tar.gz: 1043152c32b5f48f0e9190637e18ba8c3663fdf7b885d0f7d22dc11a8951f191deb3db415198a1c7bd6a72dd97c167948a6177f7b54f127b722321ade91b7884

data/.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby-version: ['3.2', '3.3', '3.4']
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby-version }}
+        bundler-cache: true
+    - name: Run tests
+      run: script/cibuild

data/.rubocop.yml

@@ -1,6 +1,6 @@
 inherit_from: .rubocop_todo.yml
 
-require:
+plugins:
   - rubocop-performance
   - rubocop-rspec
 
@@ -36,7 +36,3 @@ Style/ClassVars:
 
 Metrics/BlockLength:
   Enabled: false
-
-Security/MarshalLoad:
-  Exclude:
-    - lib/site-inspector/disk_cache.rb

data/.rubocop_todo.yml

@@ -1,139 +1,245 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config`
-# on 2020-11-13 02:59:59 UTC using RuboCop version 1.3.0.
+# on 2026-09-05 04:33:00 UTC using RuboCop version 1.90.0.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
+# Offense count: 7
+# Configuration parameters: EnforcedStyle, AllowedGems.
+# SupportedStyles: Gemfile, gems.rb, gemspec
+Gemspec/DevelopmentDependencies:
+  Exclude:
+    - 'site-inspector.gemspec'
+
 # Offense count: 1
-# Configuration parameters: Include.
-# Include: **/*.gemspec
-Gemspec/RequiredRubyVersion:
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: TreatCommentsAsGroupSeparators, ConsiderPunctuation.
+Gemspec/OrderedDependencies:
   Exclude:
     - 'site-inspector.gemspec'
 
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: AllowedMethods, AllowedPatterns.
+Lint/AmbiguousBlockAssociation:
+  Exclude:
+    - 'script/benchmark'
+
 # Offense count: 3
 # Configuration parameters: AllowComments, AllowEmptyLambdas.
 Lint/EmptyBlock:
   Exclude:
-    - 'spec/site_inspector_domain_spec.rb'
+    - 'spec/site_inspector/domain_spec.rb'
 
-# Offense count: 1
+# Offense count: 2
 Lint/NoReturnInBeginEndBlocks:
   Exclude:
     - 'lib/site-inspector/endpoint.rb'
+    - 'lib/site-inspector/endpoint/content.rb'
 
 # Offense count: 2
-# Configuration parameters: IgnoredMethods.
+# Configuration parameters: AllowedMethods, AllowedPatterns.
 Metrics/PerceivedComplexity:
   Max: 9
 
-# Offense count: 3
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle, BlockForwardingName.
+# SupportedStyles: anonymous, explicit
+Naming/BlockForwarding:
+  Exclude:
+    - 'lib/site-inspector/formatter.rb'
+
+# Offense count: 6
+# This cop supports unsafe autocorrection (--autocorrect-all).
 # Configuration parameters: EnforcedStyleForLeadingUnderscores.
 # SupportedStylesForLeadingUnderscores: disallowed, required, optional
 Naming/MemoizedInstanceVariableName:
   Exclude:
-    - 'lib/site-inspector/checks/accessibility.rb'
+    - 'lib/site-inspector/endpoint/accessibility.rb'
+    - 'lib/site-inspector/endpoint/wappalyzer.rb'
+
+# Offense count: 1
+# Configuration parameters: MinNameLength, AllowNamesEndingInNumbers, AllowedNames, ForbiddenNames.
+# AllowedNames: as, at, by, cc, db, id, if, in, io, ip, of, on, os, pp, to
+Naming/MethodParameterName:
+  Exclude:
+    - 'lib/site-inspector/endpoint/well_known.rb'
+
+# Offense count: 2
+# Configuration parameters: Mode, AllowedMethods, AllowedPatterns, AllowBangMethods, WaywardPredicates.
+# AllowedMethods: call
+# WaywardPredicates: infinite?, nonzero?
+Naming/PredicateMethod:
+  Exclude:
+    - 'lib/site-inspector/endpoint/content.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Performance/InefficientHashSearch:
+  Exclude:
+    - 'lib/site-inspector/endpoint/well_known.rb'
 
 # Offense count: 23
-# Configuration parameters: Prefixes.
+# Configuration parameters: Prefixes, AllowedPatterns.
 # Prefixes: when, with, without
 RSpec/ContextWording:
   Exclude:
-    - 'spec/checks/site_inspector_endpoint_content_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_dns_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_sniffer_spec.rb'
-    - 'spec/site_inspector_domain_spec.rb'
-    - 'spec/site_inspector_endpoint_spec.rb'
+    - 'spec/site_inspector/domain_spec.rb'
+    - 'spec/site_inspector/endpoint/content_spec.rb'
+    - 'spec/site_inspector/endpoint/dns_spec.rb'
+    - 'spec/site_inspector/endpoint_spec.rb'
 
-# Offense count: 1
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
 RSpec/EmptyExampleGroup:
   Exclude:
-    - 'spec/checks/site_inspector_endpoint_accessibility_spec.rb'
+    - 'spec/site_inspector/endpoint/wappalyzer_spec.rb'
+    - 'spec/site_inspector/endpoint/well_known_spec.rb'
 
-# Offense count: 24
-# Configuration parameters: Max.
+# Offense count: 23
+# Configuration parameters: CountAsOne.
 RSpec/ExampleLength:
+  Max: 20
+
+# Offense count: 3
+# This cop supports safe autocorrection (--autocorrect).
+RSpec/MatchWithSimpleRegex:
   Exclude:
-    - 'spec/checks/site_inspector_endpoint_dns_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_hsts_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_https_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_sniffer_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_wappalyzer_spec.rb'
-    - 'spec/site_inspector_disk_cache_spec.rb'
-    - 'spec/site_inspector_domain_spec.rb'
-    - 'spec/site_inspector_endpoint_spec.rb'
-    - 'spec/site_inspector_spec.rb'
-
-# Offense count: 15
-# Configuration parameters: Include, CustomTransform, IgnoreMethods, SpecSuffixOnly.
-# Include: **/*_spec*rb*, **/spec/**/*
-RSpec/FilePath:
-  Exclude:
-    - 'spec/checks/site_inspector_endpoint_accessibility_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_check_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_content_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_cookies_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_dns_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_headers_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_hsts_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_https_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_sniffer_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_wappalyzer_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_whois_spec.rb'
-    - 'spec/site_inspector_cache_spec.rb'
-    - 'spec/site_inspector_disk_cache_spec.rb'
-    - 'spec/site_inspector_domain_spec.rb'
-    - 'spec/site_inspector_endpoint_spec.rb'
-
-# Offense count: 55
+    - 'spec/site_inspector/endpoint/cookies_spec.rb'
+    - 'spec/site_inspector/endpoint/whois_spec.rb'
+
+# Offense count: 54
 RSpec/MultipleExpectations:
   Max: 5
 
-# Offense count: 240
-# Configuration parameters: IgnoreSharedExamples.
+# Offense count: 235
+# Configuration parameters: EnforcedStyle, IgnoreSharedExamples.
+# SupportedStyles: always, named_only
 RSpec/NamedSubject:
   Exclude:
-    - 'spec/checks/site_inspector_endpoint_accessibility_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_check_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_content_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_cookies_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_dns_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_headers_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_hsts_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_https_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_sniffer_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_wappalyzer_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_whois_spec.rb'
-    - 'spec/site_inspector_cache_spec.rb'
-    - 'spec/site_inspector_disk_cache_spec.rb'
-    - 'spec/site_inspector_domain_spec.rb'
-    - 'spec/site_inspector_endpoint_spec.rb'
+    - 'spec/site_inspector/domain_spec.rb'
+    - 'spec/site_inspector/endpoint/accessibility_spec.rb'
+    - 'spec/site_inspector/endpoint/check_spec.rb'
+    - 'spec/site_inspector/endpoint/content_spec.rb'
+    - 'spec/site_inspector/endpoint/cookies_spec.rb'
+    - 'spec/site_inspector/endpoint/dns_spec.rb'
+    - 'spec/site_inspector/endpoint/headers_spec.rb'
+    - 'spec/site_inspector/endpoint/hsts_spec.rb'
+    - 'spec/site_inspector/endpoint/https_spec.rb'
+    - 'spec/site_inspector/endpoint/whois_spec.rb'
+    - 'spec/site_inspector/endpoint_spec.rb'
+
+# Offense count: 6
+# Configuration parameters: AllowedPatterns.
+# AllowedPatterns: ^expect_, ^assert_
+RSpec/NoExpectationExample:
+  Exclude:
+    - 'spec/site_inspector/domain_spec.rb'
+
+# Offense count: 1
+RSpec/PendingWithoutReason:
+  Exclude:
+    - 'spec/site_inspector/endpoint_spec.rb'
 
 # Offense count: 2
 RSpec/RepeatedDescription:
   Exclude:
-    - 'spec/checks/site_inspector_endpoint_content_spec.rb'
+    - 'spec/site_inspector/endpoint/content_spec.rb'
 
 # Offense count: 9
 RSpec/RepeatedExample:
   Exclude:
-    - 'spec/checks/site_inspector_endpoint_accessibility_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_content_spec.rb'
-    - 'spec/site_inspector_domain_spec.rb'
+    - 'spec/site_inspector/domain_spec.rb'
+    - 'spec/site_inspector/endpoint/accessibility_spec.rb'
+    - 'spec/site_inspector/endpoint/content_spec.rb'
 
 # Offense count: 2
 RSpec/RepeatedExampleGroupDescription:
   Exclude:
-    - 'spec/site_inspector_domain_spec.rb'
+    - 'spec/site_inspector/domain_spec.rb'
+
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+RSpec/ScatteredSetup:
+  Exclude:
+    - 'spec/site_inspector/endpoint/accessibility_spec.rb'
 
 # Offense count: 30
 RSpec/SubjectStub:
   Exclude:
-    - 'spec/checks/site_inspector_endpoint_accessibility_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_dns_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_headers_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_hsts_spec.rb'
-    - 'spec/checks/site_inspector_endpoint_https_spec.rb'
-    - 'spec/site_inspector_endpoint_spec.rb'
+    - 'spec/cliver/dependency_ext_spec.rb'
+    - 'spec/site_inspector/endpoint/accessibility_spec.rb'
+    - 'spec/site_inspector/endpoint/dns_spec.rb'
+    - 'spec/site_inspector/endpoint/headers_spec.rb'
+    - 'spec/site_inspector/endpoint/hsts_spec.rb'
+    - 'spec/site_inspector/endpoint/https_spec.rb'
+    - 'spec/site_inspector/endpoint_spec.rb'
+
+# Offense count: 4
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: AllowOnlyRestArgument, UseAnonymousForwarding, RedundantRestArgumentNames, RedundantKeywordRestArgumentNames, RedundantBlockArgumentNames.
+# RedundantRestArgumentNames: args, arguments
+# RedundantKeywordRestArgumentNames: kwargs, options, opts
+# RedundantBlockArgumentNames: blk, block, proc
+Style/ArgumentsForwarding:
+  Exclude:
+    - 'lib/site-inspector/endpoint.rb'
+    - 'lib/site-inspector/formatter.rb'
+
+# Offense count: 1
+# This cop supports unsafe autocorrection (--autocorrect-all).
+Style/CollectionQuerying:
+  Exclude:
+    - 'lib/site-inspector/endpoint/dns.rb'
+
+# Offense count: 2
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle.
+# SupportedStyles: braces, no_braces
+Style/HashAsLastArrayItem:
+  Exclude:
+    - 'spec/site_inspector/endpoint/hsts_spec.rb'
+
+# Offense count: 3
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: AllowedReceivers.
+# AllowedReceivers: Thread.current
+Style/HashEachMethods:
+  Exclude:
+    - 'lib/site-inspector/endpoint/content.rb'
+    - 'lib/site-inspector/endpoint/well_known.rb'
+
+# Offense count: 4
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: AllowedMethods.
+# AllowedMethods: infinite?, nonzero?
+Style/RedundantCondition:
+  Exclude:
+    - 'lib/site-inspector/endpoint.rb'
+    - 'lib/site-inspector/endpoint/accessibility.rb'
+    - 'lib/site-inspector/endpoint/content.rb'
+    - 'lib/site-inspector/endpoint/well_known.rb'
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+Style/RedundantLineContinuation:
+  Exclude:
+    - 'spec/site_inspector/endpoint/accessibility_spec.rb'
+
+# Offense count: 2
+# This cop supports unsafe autocorrection (--autocorrect-all).
+# Configuration parameters: AllowedMethods, AllowedPatterns.
+Style/ReturnNilInPredicateMethodDefinition:
+  Exclude:
+    - 'lib/site-inspector/endpoint/content.rb'
+
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: EnforcedStyle.
+# SupportedStyles: single_quotes, double_quotes
+Style/StringLiteralsInInterpolation:
+  Exclude:
+    - 'lib/site-inspector/formatter.rb'

data/.ruby-version

@@ -1 +1 @@
-2.6.6
+3.4.11

data/CHANGELOG.md

@@ -0,0 +1,71 @@
+# Changelog
+
+## 4.0.0
+
+First release since 3.2.0 (November 2020). It's a major version because several public APIs and output formats changed.
+
+### Breaking changes
+
+- **Ruby 3.2 or later is required.** The gemspec now declares `required_ruby_version >= 3.2`. 3.2.0 had no constraint. CI runs on Ruby 3.2, 3.3, and 3.4.
+- **The built-in cache classes are gone.** `SiteInspector::Cache`, `SiteInspector::DiskCache`, and `SiteInspector::RailsCache` were removed. `SiteInspector.cache` now returns a `Typhoeus::Cache::Rails` backed by an ActiveSupport cache store. Setting `CACHE=<dir>` still persists responses to disk (it now uses `ActiveSupport::Cache::FileStore`). Inside Rails, `Rails.cache` is used. Otherwise responses go to an in-memory `ActiveSupport::Cache::MemoryStore`. To supply your own store, use `SiteInspector.cache = Typhoeus::Cache::Rails.new(your_active_support_store)`. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- **Check files moved** from `lib/site-inspector/checks/` to `lib/site-inspector/endpoint/`. The class names did not change (for example, `SiteInspector::Endpoint::Hsts` is still `SiteInspector::Endpoint::Hsts`). Code that required the files directly needs its path updated, for example `require 'site-inspector/checks/hsts'` becomes `require 'site-inspector/endpoint/hsts'`. `require 'site-inspector'` works as before. Core classes are now autoloaded.
+- **`Endpoint#host` and `Domain#host` return `PublicSuffix::Domain` objects** instead of Strings. Call `#to_s` if you need a string. `Endpoint#host` also no longer strips a leading `www.`, so `Endpoint.new('https://www.example.com').host.to_s` is now `"www.example.com"`. `Domain#host` still strips it.
+- **The library no longer loads dotenv.** `dotenv` was removed as a dependency. The `site-inspector` CLI still loads a `.env` file when the `dotenv` gem happens to be installed. Library users who relied on `.env` loading should `require 'dotenv/load'` themselves. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- **`oj` was dropped** in favor of the standard library's `JSON`. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- **Cookies are parsed with `http-cookie`.** `Cookies#all` and `Cookies#[]` now return `HTTP::Cookie` objects (use `#name`, `#value`, `#secure?`, `#httponly?`) instead of `CGI::Cookie` hashes. `Cookies#secure?` is now true only when a single cookie sets both `Secure` and `HttpOnly`. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- **Headers check API and output changed.** `Headers#to_h` is now keyed by raw header name (`'strict-transport-security'`, `'content-security-policy'`, `'x-frame-options'`, `'server'`, `'x-xss-protection'`) and also includes any other `x-` headers the site sends. It used to be keyed by `:strict_transport_security`, `:click_jacking_protection`, and so on. `click_jacking_protection` / `click_jacking_protection?` were replaced by `frame_options` / `frame_options?`.
+- **The Wappalyzer check uses the local `wappalyzer` CLI** (the npm package) instead of the hosted Wappalyzer API. `WAPPALYZER_API_KEY` is no longer used, and the check is disabled unless a `wappalyzer` binary is found on the `PATH`, in `./bin`, or in `./node_modules/.bin`. Category keys in its output are now snake_case symbols (for example `:web_servers`).
+- **DNS queries no longer use `ANY`.** `Dns#records` queries A, AAAA, CNAME, MX, and DNSKEY explicitly through the Dnsruby resolver, and `Dns#query` now defaults to `'A'` instead of `'ANY'`. `Dns#ip` and `Dns#hostname` (PTR) are resolved through the same resolver instead of `Resolv`. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- **The User-Agent is set with `Typhoeus::Config.user_agent`.** `SiteInspector.typhoeus_defaults` no longer includes a `:headers` key.
+- **pa11y is looked up as `pa11y`** on the `PATH`, in `./bin`, or in `./node_modules/.bin`, instead of `pa11y.js` under the gem's own `node_modules`.
+- **Several checks return `{}` for endpoints that are down or redirect.** This applies to content, cookies, sniffer, wappalyzer, accessibility, and well-known. The headers check returns `{}` for redirects.
+- **Removed the Sniffer check and the `sniffles` dependency; use the Wappalyzer check for CMS/technology detection.** `SiteInspector::Endpoint::Sniffer`, the `--sniffer` CLI flag, and the `sniffer` output key are gone. ([#119](https://github.com/benbalter/site-inspector/pull/119))
+- **`Domain#downgrades_https?` flags any HTTPS endpoint that redirects to HTTP**, including redirects to another host. Before, it only checked the canonical endpoint. ([#106](https://github.com/benbalter/site-inspector/pull/106))
+
+### Added
+
+- `SiteInspector::Endpoint::WellKnown` check reports which `/.well-known/` URIs (listed in `lib/data/well-known.yml`) exist on an endpoint.
+- The content check also looks for `security.txt` (at the root or under `/.well-known/`), a `vulnerability-disclosure-policy` page, and `data.json`.
+- The HSTS check reports `preload_list_status` from the hstspreload.org API. This adds an outbound request.
+- `SiteInspector::Formatter` renders inspection hashes as HTML tables.
+- `SiteInspector::DomainParser` parses domains with `naughty_or_nice`.
+- `Domain#to_h` includes `tld`, `sld`, and `trd`. `Endpoint#to_h` includes `resolves_to`.
+- `Endpoint.build(domain, https:, www:)`, `Endpoint#build_request`, and `Endpoint#join`. Endpoints compare equal when their URIs match.
+- The headers check exposes custom `x-` headers.
+- `SiteInspector.logger`. `VERBOSE=1` logs each request and whether it hit the cache.
+
+### Changed
+
+- `Domain#to_h`'s `host` is now the canonical endpoint's host.
+- Domain and endpoint hosts are parsed with PublicSuffix / `naughty_or_nice`, and `www` is stripped with `PublicSuffix::Domain.new` instead of regexes.
+- `proper_404s?` requires three random paths (bare, `.html`, and `.json`) to return exactly 404. Content paths are only reported when the site returns proper 404s.
+- The content check follows redirects when it fetches the page body.
+- HSTS handles responses with multiple `Strict-Transport-Security` headers.
+- Checks within an endpoint run sequentially instead of in four threads, and `Endpoint#to_h` is memoized.
+- The WHOIS and Wappalyzer checks handle timeouts instead of raising.
+- The CLI emits JSON with `JSON.pretty_generate`.
+- The gemspec has a new summary and metadata (`homepage_uri`, `source_code_uri`, `bug_tracker_uri`, `changelog_uri`, `rubygems_mfa_required`). ([#113](https://github.com/benbalter/site-inspector/pull/113))
+
+### Fixed
+
+- `Endpoint#up?` had an operator precedence bug and crashed when there was no response. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- Redirect `Location` headers are resolved per RFC 3986 with `Addressable::URI#join`, so protocol-relative, query-only, and dot-segment locations work. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- `Dns#localhost?` uses `IPAddr#loopback?`, so it detects every loopback address (all of `127.0.0.0/8` and `::1`), not just `127.0.0.1`. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- `Content#security_txt?` checks the correct `.well-known/security.txt` path. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- The Wappalyzer check no longer raises `NameError` when the CLI output isn't JSON. It raises `SiteInspector::Endpoint::Wappalyzer::WappalyzerError` with the command output instead. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- `Cliver::Dependency#version` is memoized as intended. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- A `RailsCache` autoload that pointed to a missing file was removed. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+
+### Dependencies
+
+- Added: `activesupport` (>= 7.0), `csv` (~> 3.0), `http-cookie` (~> 1.0), `naughty_or_nice` (~> 2.0).
+- Removed: `dotenv`, `oj`, `sniffles` ([#119](https://github.com/benbalter/site-inspector/pull/119)).
+- `gman`: `~> 7.0, >= 7.0.4` became `>= 7.0.4, < 9`, which allows gman 8. ([#109](https://github.com/benbalter/site-inspector/pull/109))
+- `nokogiri`: `~> 1.0` became `~> 1.10`.
+- `public_suffix`: `~> 4.0` became `>= 4, < 6`. ([#92](https://github.com/benbalter/site-inspector/pull/92))
+- Development: `rubocop-rspec` `~> 2.0` became `~> 3.0`.
+- npm: added `wappalyzer` (now `^6.10.66`) alongside `pa11y`. ([#91](https://github.com/benbalter/site-inspector/pull/91), [#112](https://github.com/benbalter/site-inspector/pull/112))
+
+### Contributors
+
+[@benbalter](https://github.com/benbalter) wrote most of this release. The Copilot coding agent opened [#106](https://github.com/benbalter/site-inspector/pull/106), and Dependabot sent the dependency bumps. No outside human contributors this time.

data/Gemfile

@@ -2,6 +2,4 @@
 
 source 'https://rubygems.org'
 
-gem 'sniffles', github: 'wa0x6e/sniffles'
-
 gemspec

data/README.md

@@ -2,11 +2,7 @@
 
 A Ruby Gem to sniff information about a domain's technology and capabilities.
 
-[![Gem Version](https://badge.fury.io/rb/site-inspector.svg)](http://badge.fury.io/rb/site-inspector) [![Build Status](https://travis-ci.org/benbalter/site-inspector.svg)](https://travis-ci.org/benbalter/site-inspector)
-
-## Demo
-
-[site-inspector.herokuapp.com](https://site-inspector.herokuapp.com) ([source](https://github.com/benbalter/site-inspector-demo))
+[![Gem Version](https://img.shields.io/gem/v/site-inspector)](https://rubygems.org/gems/site-inspector) [![CI](https://github.com/benbalter/site-inspector/actions/workflows/ci.yml/badge.svg)](https://github.com/benbalter/site-inspector/actions/workflows/ci.yml)
 
 ## Concepts
 
@@ -30,8 +26,8 @@ domain.www?
 #  =>  true
 domain.canonical_endpoint.to_s
 #  => "https://www.whitehouse.gov"
-domain.canonical_endpoint.sniffer.cms
-#  =>  { :drupal  =>  {}}
+domain.canonical_endpoint.wappalyzer.to_h
+#  =>  { :cms => ["Drupal"], ... }
 ```
 
 ### Command line usage
@@ -46,7 +42,6 @@ Usage:
 Options:
         -j, --json         JSON encode the output
         -a, --all          return results for all endpoints (defaults to only the canonical endpoint)
-            --sniffer      return results for the sniffer check (defaults to all checks unless one or more checks are specified)
             --https        return results for the https check (defaults to all checks unless one or more checks are specified)
             --hsts         return results for the hsts check (defaults to all checks unless one or more checks are specified)
             --headers      return results for the headers check (defaults to all checks unless one or more checks are specified)
@@ -136,16 +131,15 @@ Uses the `pa11y` CLI to run automated accessibility tests. Requires `node`. To i
 * `valid` - if the HTTPS response is valid
 * `return_code` - the HTTPS error, if any
 
-#### Sniffer
+#### Wappalyzer
+
+Detects the endpoint's CMS and other technologies (analytics, JavaScript libraries, advertising, web servers, and so on) with the [`wappalyzer`](https://www.npmjs.com/package/wappalyzer) CLI. Requires `node`. The check is only enabled when a `wappalyzer` binary is found on your `PATH`, in `./bin`, or in `./node_modules/.bin` (`npm install` in this repository installs it).
 
-* `cms` - the CMS used, if any
-* `analytics` - the analytics providers used, if any
-* `javascript` - the javascript libraries used, if any
-* `advertising` - the advertising providers used, if any
+Returns a hash of technology names keyed by category, such as `cms`, `analytics`, or `javascript_libraries`.
 
 ## Adding your own check
 
-[Checks](https://github.com/benbalter/site-inspector/tree/master/lib/site-inspector/checks) are special classes that are children of [`SiteInspector::Endpoint::Check`](https://github.com/benbalter/site-inspector/blob/master/lib/site-inspector/checks/check.rb). You can implement your own check like this:
+[Checks](https://github.com/benbalter/site-inspector/tree/main/lib/site-inspector/endpoint) are special classes that are children of [`SiteInspector::Endpoint::Check`](https://github.com/benbalter/site-inspector/blob/main/lib/site-inspector/endpoint/check.rb). You can implement your own check like this:
 
 ```ruby
 class SiteInspector

data/bin/site-inspector

@@ -2,20 +2,20 @@
 # frozen_string_literal: true
 
 require 'mercenary'
-require 'oj'
+require 'json'
 require 'yaml'
 require 'colorator'
-require_relative '../lib/site-inspector'
 
-def stringify_keys_deep!(hash)
-  hash.each_key do |k|
-    ks = k.respond_to?(:to_s) ? k.to_s : k
-    hash[ks] = hash.delete k # Preserve order even when k == ks
-    stringify_keys_deep! h[ks] if hash[ks].is_a? Hash
-  end
+# Load a .env file if dotenv happens to be installed. It is not a dependency.
+begin
+  require 'dotenv/load'
+rescue LoadError
+  nil
 end
 
-Mercenary.program(:"site-inspector") do |p|
+require_relative '../lib/site-inspector'
+
+Mercenary.program(:'site-inspector') do |p|
   p.version SiteInspector::VERSION
   p.description "Returns information about a domain's technology and capabilities"
   p.syntax 'site-inspector <command> <domain> [options]'
@@ -36,14 +36,14 @@ Mercenary.program(:"site-inspector") do |p|
       # Build our domain hash as requested
       domain = SiteInspector.inspect(args[0])
       hash = domain.to_h(options)
-      json = Oj.dump(hash, indent: 2, mode: :compat)
+      json = JSON.pretty_generate(hash)
 
       # Dump the JSON and run
       next puts json if options['json']
 
-      # This is a dirty, dirty hack, but it's a simple way to stringify keys recursively
-      # And format the output in a human-readable way
-      yaml = YAML.dump Oj.load(json)
+      # Round-trip through JSON so keys and non-primitive values (symbols,
+      # classes) become plain strings before formatting as YAML
+      yaml = YAML.dump JSON.parse(json)
 
       # Colorize bools
       yaml.gsub!(/: (true|ok)$/, ": #{'true'.green}")

data/lib/cliver/dependency_ext.rb

@@ -13,8 +13,8 @@ module Cliver
     def version
       return @version if defined? @version
 
-      version = installed_versions.find { |p, _v| p == path }
-      @detected_version = version.nil? ? nil : version[1]
+      detected = installed_versions.find { |p, _v| p == path }
+      @version = detected&.last
     end
 
     def major_version

data/lib/data/well-known.yml

@@ -0,0 +1,51 @@
+---
+- acme-challenge
+- amphtml
+- ashrae
+- assetlinks.json
+- brski
+- caldav
+- carddav
+- coap
+- core
+- csvm
+- dnt
+- dnt-policy.txt
+- dots
+- ecips
+- enterprise-transport-security
+- est
+- genid
+- gs1resolver
+- hoba
+- host-meta
+- host-meta.json
+- hosting-provider
+- http-opportunistic
+- idp-proxy
+- jmap
+- keybase.txt
+- looking-glass
+- matrix
+- mta-sts.txt
+- mud (deprecated)
+- nfv-oauth-server-configuration
+- ni
+- oauth-authorization-server
+- openid-configuration
+- openorg
+- pki-validation
+- posh
+- pvd
+- reload-config
+- repute-template
+- resourcesync
+- sshfp
+- stun-key
+- thread
+- time
+- timezone
+- tor-relay
+- uma2-configuration
+- void
+- webfinger