4 releases 18 tags

RSS feed

• 0.141.0 0e48b19f19

  Compare

  0.141.0 Stable

  damian-buho released this 2026-10-09 03:57:35 +00:00 | 66 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  54 commits, 1 contributor, 3 days since 0.140.0.

  Features

  • well-known: check /auth.md (f7d9483)
  • live: add the info rule live/webmcp (29569a0)
  • dns: name the servers in name server findings (45eea1b)
  • rules: report long-cached files at URLs without a version (3c720f3)
  • fold: report a defect several groups share as one finding (f01ea50)
  • browser: download a missing browser before the crawl (178c722)
  • action: pass any audit flag through the args input (3141f61)
  • server: serve the scan site for an S-tier self-audit (6e3bd4d)
  • server: compress with zstd and brotli beside gzip (03bba39)
  • forge: declare and publish to GitHub (0f2be3e)
  • server: download Chromium once when a worker starts (4662d73)
  • image: download the browser on first use instead of baking it in (bda1585)
  • forge: declare and publish to Codeberg (e922fa0)

  Bug fixes

  • deps: bump @opentelemetry/sdk-trace-node 2.12.0, @opentelemetry/sdk-metrics 2.12.0, @opentelemetry/resources 2.12.0 (07f1f52)
  • deps: bump @opentelemetry/exporter-trace-otlp-http 0.223.0, @opentelemetry/exporter-metrics-otlp-http 0.223.0 (c7a9574)
  • html-validate: accept ids the HTML standard allows (532f2d0)
  • crawl: accept every dns.lookup overload in the swapped lookup (7be87ac)
  • i18n: translate the DNS and auth.md rule messages into es and uk (07e4c8b)
  • rules: declare hint for the agent rules scored below one (02075ee)
  • rules: judge CSP and document headers on documents only (95e51c2)
  • browser: read declarations from the served HTML (7b71b71)
  • feeds: read an XSLT-styled feed as served in browser mode (276b449)
  • deps: bump caniuse-lite 1.0.30001815 (1cfe747)
  • deps: bump tldts 7.4.18 (40f68c9)
  • deps: bump @hono/node-server 2.1.4 (9b4cd37)
  • tls-probe: keep the scan when the early-data check gets no answer (5cb1a07)
  • css: log missing browser targets at info (281eebe)
  • cli: keep every help item description on whole lines at 80 columns (57776d0)
  • action: render SARIF and the summary with show-report (45edf9e)
  • security: suppress advisories in the base image’s bundled npm (b2c5622)
  • security: take npm-bundled GHSA suppressions from the shared fragment (e23fb7d)

  Performance

  • container: declare M6E_VERSION next to the user stage (8e1ebe0)

  Dependencies

  • 1 dependency update

  Installation

  Pull from DockerHub — linux/amd64

  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws damianbuho/spiderlint:0.141.0 spiderlint'
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/damian-buho/spiderlint:0.141.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws kiota.ch/damian-buho/spiderlint:0.141.0 spiderlint'
  

  Then run it as if it were installed — the alias runs every example as written against the current directory:

  spiderlint --help
  

  Usage

  Run it as a step in a GitHub Actions workflow:

  - uses: damian-buho/spiderlint@0.141.0
  

  The action takes these inputs:

  Input	Default	Description
  urls		Newline-separated seed URLs. Empty takes the targets from the config file.
  config_file		Projectfile or plain YAML carrying the org.spiderlint subtree, relative to the workspace.
  site		One org.spiderlint.sites name to audit; a config declaring several needs one step per site.
  rules		Comma-separated rulesets replacing every group’s rules (e.g. recommended,axe).
  args		More audit flags, one per line with its value after a space (e.g. --max-pages 200).
  fail_on	error	Severity that fails the job: error | warning | info | never
  upload_sarif	false	Upload the SARIF report to code scanning; needs the security-events: write permission.
  cache	true	Keep the crawl store in the forge cache, so an unchanged site is re-audited with 304s.
  version		Image tag to pull (e.g. latest, 1.2.3). Empty follows the action’s own version tag, else latest.
  image		Full image reference. Takes precedence over version.

  spiderlint

  $ spiderlint --help
  spiderlint
  Site-wide linter for SEO tags, security headers, TLS and links
  https://dbuho.me/project/spiderlint/
  
  Usage: spiderlint <command> [domain…] [options]
  A domain is example.com or a URL to start from; without a scheme, https:// is
  assumed.
  
  Check a site:
    audit [domain…]                 crawl a site, then lint it
    crawl [domain…]                 fetch pages into the store, lint nothing
    lint [domain…]                  lint the stored pages, with no network
    show-report [domain…]           print the stored report again, in any format
  
  Inspect:
    show-facts <url>                fetch one page and print its facts
    export-facts [domain…]          print every stored page’s facts, no network
    list-groups [domain…]           count the pages in each URL group
  
  Rules:
    list-rules [ruleset|id…]        list rules at the severity this config gives
    list-presets                    list the shipped rulesets and their groups
    explain-rule <rule>             show a rule’s facts, expectation and fix
  
  Cache:
    show-cache [domain…]            show the entries, bytes and age of each bucket
    purge-cache [bucket] [domain…]  delete a site’s cached entries
    warm-cache [domain…]            fetch robots.txt and sitemaps without crawling
  
  Commands:
    help [command]                  show a command’s options and examples
  
  Options:
    --config <path>                 settings file
                                    (default: projectfile.yaml)
                                    (env: SPIDERLINT_CONFIG)
    --site <names>                  only these org.spiderlint.sites, repeatable
                                    (default: all)
    --[no-]color                    force or disable color
                                    (default: auto, env: NO_COLOR, FORCE_COLOR)
    --[no-]progress                 status line on an interactive stderr
                                    (default: auto)
    --log-level <level>             trace, debug, info, warn, error or silent
                                    (default: warn, env: SPIDERLINT_LOG_LEVEL)
    -V, --version                   show the version
    -h, --help                      show this screen, or a command’s
  
  Run spiderlint <command> --help for a command’s options and examples.
  
  Exit codes:
    0  clean
    1  findings at or above --fail-on
    2  usage or config error
    3  nothing fetched, or an --offline cache miss
    4  the run failed
  

  Examples and every command’s help are in Usage.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  docker pull kiota.ch/damian-buho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  

  Platform	Digest	Size
  linux/amd64	sha256:7ab8f579be995c6a31722fde5060e596d0bf5ee02a8e8c2544698ded995b3b37	424.4 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/damian-buho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/damian-buho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads