lintpage 0.5.2 → 0.5.4

package/README.md

@@ -123,6 +123,34 @@ Exit codes:
 - `1` — critical issues found (or warnings with `--fail-on-warning`)
 - `2` — runtime error
 
+## Upgrading from 0.5.3
+
+- `meta-render-blocking` counts only scripts the browser runs as classic
+  JavaScript: no `type`, an empty one, or exactly a JavaScript MIME type such
+  as `text/javascript`. Scripts parked by a consent manager
+  (`type="text/plain"`) or handed to Partytown (`type="text/partytown"`) are
+  no longer reported as blocking. Nor are scripts that browsers do not run at
+  all: a type with parameters (`text/javascript; charset=utf-8`), a
+  non-JavaScript `language` attribute, or an empty `src`. With
+  `--fail-on-warning`, a page that failed only on these scripts now passes.
+- `tracking` reads only the Content-Security-Policy fetch directives, such as
+  `script-src`, `connect-src` and `default-src`. An analytics host named only
+  in `report-uri`, `frame-ancestors` or `form-action` no longer counts as
+  analytics on the page.
+
+## Upgrading from 0.5.2
+
+- `tracking` reports a page with no visible analytics as INFO instead of
+  WARNING: analytics loaded from a JavaScript bundle leave no trace in the
+  HTML, so their absence cannot be shown. An analytics host named in a
+  `preconnect`, `dns-prefetch`, `preload` or `modulepreload` link, or in a
+  Content-Security-Policy header or meta tag, now counts as found. With
+  `--fail-on-warning`, a page that failed only on this rule now passes; to
+  keep the warning, set `"tracking": { "enabled": true, "severity": "WARNING" }`
+  under `rules` in your config.
+- `meta-render-blocking` no longer counts a `<script nomodule>`, such as the
+  Next.js polyfills, as blocking: browsers that run modules never load it.
+
 ## Upgrading from 0.5.1
 
 - A page that redirects to another host now fails with `redirected-off-site`
@@ -161,11 +189,11 @@ LintPage checks **60 rules** out of the box across five categories:
 | `x-robots-tag`     | CRITICAL | X-Robots-Tag HTTP header noindex/nofollow             |
 | `robots-txt-check` | WARNING  | robots.txt presence and validity                      |
 | `sitemap-presence` | WARNING  | sitemap.xml presence and validity                     |
-| `tracking`         | WARNING  | Google Analytics, GTM, or Facebook Pixel              |
 | `mixed-content`    | WARNING  | HTTP resources loaded on HTTPS page                   |
 | `https-links`      | WARNING  | Internal links use HTTPS instead of HTTP              |
 | `cors-policy`      | WARNING  | Overly permissive CORS configuration                  |
 | `security-headers` | INFO     | CSP, HSTS, X-Content-Type-Options, Permissions-Policy |
+| `tracking`         | INFO     | Analytics in scripts, resource hints or the CSP (bundled analytics cannot be seen) |
 
 ### SEO
 
@@ -216,7 +244,7 @@ LintPage checks **60 rules** out of the box across five categories:
 | Rule                   | Severity | What it checks                                            |
 | ---------------------- | -------- | --------------------------------------------------------- |
 | `ttfb`                 | WARNING  | Server response time (Time to First Byte)                 |
-| `meta-render-blocking` | WARNING  | Render-blocking stylesheets and synchronous scripts       |
+| `meta-render-blocking` | WARNING  | Render-blocking stylesheets and synchronous JavaScript (`nomodule` and non-JS types excepted) |
 | `lazy-load-lcp`        | WARNING  | Above-the-fold images not lazy-loaded                     |
 | `performance`          | INFO     | Lazy loading, inline styles, and script count             |
 | `image-dimensions`     | INFO     | Images have explicit width/height to prevent layout shift |