bfsg-scanner 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -6,6 +6,20 @@ follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-19
+
+### Fixed
+
+- The default `wcagTags` left out `wcag21a`, the Level A criteria WCAG 2.1
+  added, so a default run never checked SC 2.5.3 *Label in Name* (EN 301 549
+  clause 9.2.5.3, rule `label-content-name-mismatch`, enabled since axe-core
+  4.14). The default is now `wcag2a`, `wcag2aa`, `wcag21a`, `wcag21aa`. See
+  ADR 0013. ([#65](https://github.com/MihaelaAghirculesei/bfsg-scanner/issues/65))
+
+  **This can fail a CI gate that passed on 0.3.0:** a default run can now
+  report SC 2.5.3 violations it did not report before. To keep the old rule
+  set for now, list `wcag2a`, `wcag2aa`, `wcag21aa` in `wcagTags`.
+
 ## [0.3.0] - 2026-10-17
 
 ### Added
@@ -106,7 +120,8 @@ First release.
 - Distributable package: a `bfsg-scanner` bin and a `dist` build that
   excludes tests.
 
-[Unreleased]: https://github.com/MihaelaAghirculesei/bfsg-scanner/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/MihaelaAghirculesei/bfsg-scanner/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/MihaelaAghirculesei/bfsg-scanner/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/MihaelaAghirculesei/bfsg-scanner/compare/v0.2.2...v0.3.0
 [0.2.2]: https://github.com/MihaelaAghirculesei/bfsg-scanner/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/MihaelaAghirculesei/bfsg-scanner/compare/v0.2.0...v0.2.1

package/README.md

@@ -134,6 +134,7 @@ settleMs: 0                       # pause after load before the scan (see below)
 wcagTags:                         # axe rule sets to run
   - wcag2a
   - wcag2aa
+  - wcag21a
   - wcag21aa
 excludePaths: []                  # URL-path globs to skip while crawling
 outputDir: reports                # where the report files are written

package/dist/config/schema.js

@@ -17,7 +17,7 @@ export const configSchema = z.strictObject({
     sitemapOrigin: originSchema.optional(),
     maxPages: z.number().int().positive().max(1000).default(50),
     settleMs: z.number().int().min(0).max(60_000).default(0),
-    wcagTags: z.array(wcagTagSchema).min(1).default(['wcag2a', 'wcag2aa', 'wcag21aa']),
+    wcagTags: z.array(wcagTagSchema).min(1).default(['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa']),
     excludePaths: z.array(z.string()).default([]),
     outputDir: z.string().min(1).default('reports'),
     failOn: failOnSchema.default('serious'),

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAElE;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CACjC,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;AACtE,CAAC,EACD,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAC9F,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAChB,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAClF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC/C,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC;IAClD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;CACnF,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAElE;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CACjC,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;AACtE,CAAC,EACD,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAC9F,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE;IAChB,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC7F,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC/C,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC;IAClD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;CACnF,CAAC,CAAC"}

package/dist/report/clauses.js

@@ -2,8 +2,8 @@
  * A WCAG SC tag: `wcag` followed by the digits of the criterion number with
  * the dots removed — `wcag143` is SC 1.4.3, `wcag1410` is SC 1.4.10. The
  * first two digits are always the principle and guideline; whatever follows
- * is the criterion. Level tags (`wcag2a`, `wcag2aa`, `wcag21aa`) carry
- * letters after `wcag` and so never match.
+ * is the criterion. Level tags (`wcag2a`, `wcag2aa`, `wcag21a`, `wcag21aa`)
+ * carry letters after `wcag` and so never match.
  */
 const WCAG_SC_TAG = /^wcag(\d)(\d)(\d+)$/;
 /**

package/docs/adr/0013-default-wcag-rule-set.md

@@ -0,0 +1,53 @@
+# 13. Default WCAG rule set
+
+Date: 2026-10-19
+
+## Status
+
+Accepted
+
+## Context
+
+axe-core selects rules by tag. A WCAG version and level is one tag, and
+each tag holds only the criteria that version added at that level:
+`wcag2a` and `wcag2aa` are WCAG 2.0, `wcag21a` and `wcag21aa` are what
+WCAG 2.1 added. A WCAG 2.1 AA check needs all four.
+
+The default `wcagTags` were `wcag2a`, `wcag2aa`, `wcag21aa`. No decision
+left out `wcag21a`; it was an oversight. Up to axe-core 4.13 it cost
+nothing, because the one rule tagged `wcag21a` and not also tagged by the
+others, `label-content-name-mismatch` (SC 2.5.3 *Label in Name*), was
+`experimental` and did not run. axe-core 4.14, which 0.3.0 ships, enables
+it, so a default run that the README and the report call WCAG 2.1 AA
+skipped a criterion EN 301 549 clause 9.2.5.3 requires (#65).
+
+## Decision
+
+**The default rule set is the WCAG 2.1 Level A and AA tags, all four:**
+`wcag2a`, `wcag2aa`, `wcag21a`, `wcag21aa`.
+
+That is the level EN 301 549 V3.2.1 chapter 9 references, and with it the
+BFSG presumption of conformity (ADR 0004). The default follows the standard,
+not the tags that happen to have rules today, so a rule axe-core adds under
+any of the four runs without a change here.
+
+Not in the default:
+
+- **`wcag2aaa`**: Level AAA is not required by EN 301 549.
+- **`wcag22a` / `wcag22aa`**: WCAG 2.2 is not yet what EN 301 549
+  references. A later EN 301 549 that moves to WCAG 2.2 calls for a new
+  decision and a minor release.
+- **`best-practice`, `experimental`**: not WCAG criteria, so their findings
+  could not cite a clause and would blur what a failing gate means.
+
+A config can still narrow the set; `wcagTagSchema` accepts any subset.
+
+## Consequences
+
+- A default run can report findings that 0.3.0 did not, so a CI gate that
+  passed on 0.3.0 can fail on the same site. The change ships in a minor
+  release with a CHANGELOG note.
+- Any later change to the default rule set changes what a gate checks and
+  is released the same way: a minor, never a patch.
+- The golden fixture site covers SC 2.5.3 (`fixtures/site/label-in-name.html`),
+  so dropping `wcag21a` again fails the test suite.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bfsg-scanner",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "WCAG 2.1 AA / BFSG compliance scanner built on Playwright and axe-core",
   "keywords": [
     "accessibility",