lintpage 0.5.1 → 0.5.3

package/README.md

@@ -55,6 +55,53 @@ In a pre-commit hook:
 npx lintpage localhost:3000 --quiet
 ```
 
+### Redirects to another site
+
+If the page redirects to a different host, the audit would only see that
+other site, so the CLI reports a CRITICAL `redirected-off-site` finding and
+exits `1`. Adding or removing `www.`, switching from http to https, and a
+different path on the same host do not count; a move to a subdomain or to
+another country domain does. This holds whether the other site answers or
+fails; a redirect the CLI refuses to follow at all, such as one to a private
+address, is reported as `target-unreachable` instead. If the redirect is
+intended, audit the final URL instead, or set the rule to `false` or a lower
+severity in your config. With `--ai-only`, which does not fetch the page
+itself, the same check runs on where the AI bot probes ended up.
+
+### Vercel deployments
+
+A deployment behind Vercel Deployment Protection redirects to the Vercel login
+page. Without access, LintPage reports that as `redirected-off-site` and
+names the cause. To audit the deployment itself, create a Protection Bypass
+for Automation secret in Vercel (Project Settings, Deployment Protection),
+then pass it in the environment together with the deployment it is for:
+
+```bash
+VERCEL_AUTOMATION_BYPASS_SECRET=... \
+LINTPAGE_BYPASS_ORIGINS=https://my-app-git-feature-team.vercel.app \
+npx lintpage https://my-app-git-feature-team.vercel.app
+```
+
+The secret is read from the environment only, never from a flag, and is never
+printed. It is sent as the `x-vercel-protection-bypass` header only when the
+target is an https `*.vercel.app` URL whose origin is listed in
+`LINTPAGE_BYPASS_ORIGINS` (comma or space separated), and then only to that
+exact origin: not to any other site the audit contacts, and not along a
+redirect to another host. `*.vercel.app` alone is not enough, because it
+covers every Vercel customer's deployments. The CLI says on stderr whether
+and where the secret was sent. Like any request header, it is visible to
+tools that observe the process's HTTP traffic, such as an APM agent or a
+TLS-intercepting proxy.
+
+Vercel also sends `X-Robots-Tag: noindex` on its deployment URLs, so previews
+stay out of search results. On an https `*.vercel.app` target, that noindex
+finding is therefore reported as INFO rather than CRITICAL, and the output
+says so. A `nofollow` in the same header, or a `noindex` in the page's robots
+meta tag, keeps its severity. If your production site itself is served from
+`*.vercel.app`, set a severity for `x-robots-tag` in your config (for example
+`{ "enabled": true, "severity": "CRITICAL" }`) to restore the check; a
+severity you configure is always used.
+
 ### Output
 
 ```
@@ -76,6 +123,32 @@ Exit codes:
 - `1` — critical issues found (or warnings with `--fail-on-warning`)
 - `2` — runtime error
 
+## Upgrading from 0.5.2
+
+- `tracking` reports a page with no visible analytics as INFO instead of
+  WARNING: analytics loaded from a JavaScript bundle leave no trace in the
+  HTML, so their absence cannot be shown. An analytics host named in a
+  `preconnect`, `dns-prefetch` or `preload` link, or in the
+  Content-Security-Policy, now counts as found. With `--fail-on-warning`, a
+  page that failed only on this rule now passes; to keep the warning, set
+  `"tracking": { "enabled": true, "severity": "WARNING" }` under `rules` in
+  your config.
+- `meta-render-blocking` no longer counts a `<script nomodule>`, such as the
+  Next.js polyfills, as blocking: browsers that run modules never load it.
+
+## Upgrading from 0.5.1
+
+- A page that redirects to another host now fails with `redirected-off-site`
+  (exit `1`). Before, the audit quietly checked the other site. This includes
+  moves to a subdomain or another country domain; see above for how to accept
+  an intended redirect.
+- On an https `*.vercel.app` target, Vercel's `X-Robots-Tag: noindex` is
+  reported as INFO instead of CRITICAL (see above).
+- `--quiet` now applies to `--format github`, and with `--format github` a URL
+  whose audit cannot run gets an error annotation.
+- GitHub annotation text no longer shows `%3A` and `%2C` in place of `:` and
+  `,`, and the job summary is new.
+
 ## Options
 
 | Flag                | Description                                        |
@@ -85,7 +158,7 @@ Exit codes:
 | `--fail-on-warning` | Exit 1 on warnings, not just criticals            |
 | `--ai-only`         | Run only the AI Visibility module (LP-050–LP-060) |
 | `--skip-ai`         | Skip the AI Visibility module                     |
-| `--quiet`           | Minimal output (counts only)                      |
+| `--quiet`           | Minimal output: counts only; with `--format github`, the verdict and notices plus critical annotations (and warnings with `--fail-on-warning`) |
 
 ## Rules
 
@@ -96,15 +169,16 @@ LintPage checks **60 rules** out of the box across five categories:
 | Rule               | Severity | What it checks                                        |
 | ------------------ | -------- | ----------------------------------------------------- |
 | `robots-noindex`   | CRITICAL | Robots noindex/nofollow directives                    |
+| `redirected-off-site` | CRITICAL | The page redirected to another host (CLI only)     |
 | `ssl`              | CRITICAL | Site served over HTTPS                                |
 | `x-robots-tag`     | CRITICAL | X-Robots-Tag HTTP header noindex/nofollow             |
 | `robots-txt-check` | WARNING  | robots.txt presence and validity                      |
 | `sitemap-presence` | WARNING  | sitemap.xml presence and validity                     |
-| `tracking`         | WARNING  | Google Analytics, GTM, or Facebook Pixel              |
 | `mixed-content`    | WARNING  | HTTP resources loaded on HTTPS page                   |
 | `https-links`      | WARNING  | Internal links use HTTPS instead of HTTP              |
 | `cors-policy`      | WARNING  | Overly permissive CORS configuration                  |
 | `security-headers` | INFO     | CSP, HSTS, X-Content-Type-Options, Permissions-Policy |
+| `tracking`         | INFO     | Analytics in scripts, resource hints or the CSP (bundled analytics cannot be seen) |
 
 ### SEO
 
@@ -155,7 +229,7 @@ LintPage checks **60 rules** out of the box across five categories:
 | Rule                   | Severity | What it checks                                            |
 | ---------------------- | -------- | --------------------------------------------------------- |
 | `ttfb`                 | WARNING  | Server response time (Time to First Byte)                 |
-| `meta-render-blocking` | WARNING  | Render-blocking stylesheets and synchronous scripts       |
+| `meta-render-blocking` | WARNING  | Render-blocking stylesheets and synchronous scripts (`nomodule` ones excepted) |
 | `lazy-load-lcp`        | WARNING  | Above-the-fold images not lazy-loaded                     |
 | `performance`          | INFO     | Lazy loading, inline styles, and script count             |
 | `image-dimensions`     | INFO     | Images have explicit width/height to prevent layout shift |
@@ -235,7 +309,9 @@ Use the `github` format for native annotations:
   run: npx lintpage https://your-site.com --format github --fail-on-warning
 ```
 
-This outputs GitHub-compatible annotations that show up directly on your PR.
+This outputs GitHub-compatible annotations that show up on your PR's checks. The verdict comes first, and each finding's annotation names the page it is about; a URL whose audit cannot run gets an error annotation. When `GITHUB_STEP_SUMMARY` is set, as it is in GitHub Actions, the CLI also adds a section per URL to the job summary: verdict, score, counts and the top findings.
+
+For preview deployments, the [LintPage GitHub Action](https://github.com/marketplace/actions/lintpage-seo-check) runs this for you on each `deployment_status` event.
 
 ## License