v1.8.7 — Synchronized release downloads and Marketplace packages

This release keeps every public installation surface in sync.

• Rebuilds all Marketplace packages and release archives from the same v1.8.7 source commit.
• Publishes stable download aliases with matching SHA-256 checksum files.
• Restricts release automation to immutable semantic-version tags.
• Includes deterministic CycloneDX SBOMs and GitHub attestations for every install archive.

GitHub Actions usage runs in each user’s own repository and GitHub account. The optional Cloudflare discovery connector is designed for the free-plan deployment path and falls back safely when unavailable.

v1.8.6 — Guided page discovery and immediate GitHub Actions

This release makes the accessibility audit easier to start while preserving the existing audit workflow and output.

What changed

• Discover unique, same-origin pages from one website URL and choose audit targets from an accessible checkbox list.
• Leave optional routes such as jobs, categories, tags, search, account, and legal pages unselected by default.
• Keep the manual URL-entry path for users who already know exactly which pages to audit.
• Carry the selected URLs safely into the generated configuration with stale-selection protection.
• Let one CarlasHub GitHub App install a managed workflow in each user's repository and dispatch the audit immediately.
• Explain free-plan limits, who owns GitHub Actions usage, and when a user could incur charges.
• Synchronize the README, setup guide, public builder, Marketplace metadata, and Claude/Copilot packages.
• Generate deterministic CycloneDX 1.6 SBOMs with a standards-compliant UUIDv5 serial number so release attestations can be verified.

Safety and scope

Discovery is limited to unique URLs on the exact origin supplied by the user and is capped at 20 selected pages per audit. Automated checks find many accessibility issues, but they do not establish full WCAG conformance; manual testing remains necessary.

Verification

All release archives include SHA-256 checksum files. GitHub-hosted SLSA provenance and CycloneDX SBOM attestations are available for each archive and can be verified with gh attestation verify.

v1.8.4 — Accurate responsive link-name evidence

v1.8.4 — Accurate responsive link-name evidence

This patch release makes link-name diagnostics follow the rendered accessibility tree and clearly distinguishes valid nested link text from text hidden by responsive CSS.

What changed

• Visible text inside nested elements such as <a><span>Explore this location</span></a> is accepted as the link's accessible name.
• Text hidden with display:none, visibility:hidden, visibility:collapse, or aria-hidden="true" is excluded from ordinary name-from-content calculation.
• A failed link-name result now records the hidden text, its selector, and the computed reason it was excluded instead of showing source markup without the relevant rendered state.
• Remediation now covers responsive icon-only links: keep concise text exposed to the accessibility tree or provide an equivalent aria-label or valid aria-labelledby reference.

Independent implementation checks

The regression test verifies the same fixture three ways:

• the plugin's DOM evidence collector;
• Chromium's accessibility-tree snapshot; and
• the bundled official axe-core 4.13 link-name implementation.

All three accept visible nested <span> text and reject a link whose only text is hidden with display:none.

L'Oréal validation

The affected live page was scanned at desktop, mobile, and 320-pixel reflow sizes. The Explore this location link passes at desktop. At mobile and reflow sizes, the site's .callout__fake-button element computes to display:none, Chromium exposes the parent as an unnamed link, and axe-core reports link-name. The report now includes that breakpoint-specific cause.

This result follows the W3C Accessible Name and Description Computation 1.2 hidden-node rules and WCAG 2.2 Success Criterion 4.1.2. The product remains an evidence-backed pre-audit; automated results do not establish complete WCAG conformance.

v1.8.3 — Multi-page workflows and evidence-gated findings

v1.8.3 — Multi-page workflows and evidence-gated scanner findings

This patch release fixes setup persistence and multi-URL execution while tightening the evidence required before the scanner reports accessibility failures or review candidates.

What changed

• Landing-page setup drafts now retain repository choice, repository details, URL lists, and workflow fields across the new- and existing-repository paths.
• The GitHub Action and reusable workflow accept one URL per line or a JSON array and audit every authorized URL rather than using only the first value.
• Responsive clipping, 200% text-resize loss, table structure, and keyboard off-viewport checks now require complete, repeatable evidence before classification.
• Empty # links without an independently proven accessible-name or destination failure no longer become speculative review rows.
• Findings that represent the same root cause are consolidated while retaining all affected URLs, viewports, selectors, and evidence occurrences.
• HTML and XLSX output explain the evidence status and standards mapping without presenting automated output as conformance certification.

Classification migration

This release advances the Audit Quality Contract from 1.1.0 to 1.2.0. Existing consumers do not need to change configuration, but should expect lower review counts and more conservative classifications for heuristic visual, resize, table, and keyboard signals. Integrations that assert the canonical qualityContract.version must update their expected value to 1.2.0.

The supplied L'Oréal validation sample previously contained 102 review rows. Evidence replay and corrected classification retained 15 confirmed failures and 3 genuine review candidates, identified 1 execution blocker, and the corrected scan produced 4 additional confirmed findings. Repeated observations are consolidated in the final report, so raw candidate counts and final report-row counts are intentionally different.

Quality and conformance boundary

Contract 1.2.0 requires reproducibility, applicability, complete collector evidence, useful locators, known-exception handling, and root-cause consolidation before a result can be labelled a confirmed failure. The implementation is checked with unit, adversarial, browser, report-parity, built-CLI, packaged-Action, marketplace, and two-run live BuggyLand regression gates.

This product remains an evidence-backed accessibility pre-audit. It does not claim complete automated WCAG conformance, zero false positives, or legal certification. Criteria and states that require content judgment, physical-device testing, native assistive technology, or a complete-process assessment remain unresolved for a qualified accessibility professional.

Native VoiceOver/WebKit and NVDA/Firefox evidence can only be collected on their supported operating systems. A release run that does not execute one of those native environments must preserve the corresponding checks as manual or inconclusive rather than treating them as passes.

Accessibility Audit Plugin v1.8.2

Full Changelog: v1.8.1...v1.8.2

CarlasHub Accessibility Audit v1.8.1

Public metadata and discoverability release

This release gives every public surface one accurate product identity: CarlasHub Accessibility Audit, an evidence-backed accessibility pre-audit for GitHub Actions and AI coding assistants.

What changed

• Replaced stale and inconsistent names, descriptions, keywords, links, and installation copy across the GitHub Action, npm package, Claude, Cursor, Codex, GitHub Copilot, MCP, documentation, website metadata, and generated Marketplace packages.
• Added focused GitHub discovery topics, the canonical product homepage, and citation metadata.
• Added a CI metadata contract so inconsistent branding, versions, URLs, or unsupported claims fail verification before a future release.
• Made the Action and AI-assistant Marketplace packages reproducible from a clean checkout.
• Clarified the product boundary throughout: this is a review-ready automated pre-audit, not an automatic WCAG conformance certificate or substitute for qualified human and assistive-technology evaluation.

Verification

All v1.8.1 release gates passed: metadata and version validation, linting, type checks, Audit Quality Contract tests, unit tests, browser tests, built CLI and GitHub Action tests, Marketplace compatibility, package validation, dependency audit, and reproducible-build checks.

See the Audit Quality Contract.

Accessibility Audit Plugin v1.8.0

Audit-quality release

This release implements the repository Audit Quality Contract v1.1.0 (AQ1–AQ19) and strengthens the full audit pipeline from collection through reporting.

Improvements

• Evidence provenance and canonical-result integrity validation
• Failure isolation with no fabricated fallback findings
• Structured, configurable keyboard and task journeys
• Lossless finding consolidation and deterministic output
• HTML, workbook, CSV, JSON, and SARIF renderers derived from the validated canonical result
• Improved report presentation, severity treatment, and data integrity
• Complete accountability for every WCAG 2.2 Level A and AA success criterion

Verified release baseline

The tagged release passed linting, type checks, 36 Audit Quality Contract tests, unit tests, browser tests, built CLI and GitHub Action tests, marketplace validation, package validation, and two matching live BuggyLand audits.

BuggyLand baseline: 4 URLs across 3 viewports; 31 confirmed failures, 36 review candidates, 1 blocker, 68 total findings, and 485 evidence rows. Both release runs produced the same result.

Important scope boundary

This is a high-quality automated pre-audit and evidence workflow, not an automatic WCAG conformance certificate. Criteria that require human judgement or real assistive-technology evaluation remain explicitly unresolved until reviewed by a qualified person.

See the Audit Quality Contract.

Accessibility Audit Plugin v1.7.0

Audit-quality contract release

This release makes AUDIT_QUALITY_CONTRACT.md the normative product and release contract for the public accessibility audit plugin.

What changed

• Accounts for every WCAG 2.2 Level A and AA success criterion with explicit automated, guided, manual, not-applicable, or blocked status.
• Applies one central confidence gate before any issue can be labelled a confirmed failure; uncertainty remains a review candidate or coverage blocker.
• Strengthens contrast, overlap, visibility, applicability, repeatability, evidence, and deterministic deduplication checks to reduce false positives and inflated counts.
• Captures keyboard journeys, interactions, 320 px reflow, 200% text resize, WCAG text spacing, and native NVDA/VoiceOver evidence without presenting synthetic DOM inspection as screen-reader proof.
• Keeps canonical JSON, accessible HTML, validated XLSX, screenshots, and evidence records aligned.
• Adds executable contract, adversarial, fresh-consumer Action, package, native assistive-technology, and exact two-run BuggyLand release gates.

Verified baseline

The public BuggyLand regression was identical across two complete runs: 31 confirmed failures, 36 review candidates, 1 blocker, 68 consolidated findings, 55 A/AA manual procedures, and 485 evidence records.

Honest conformance boundary

This tool provides complete WCAG 2.2 A/AA accountability and evidence-led pre-audit support. It does not claim that automation alone certifies conformance. Criteria requiring human judgement remain unresolved until a qualified reviewer records evidence and a verdict.

See the Audit Quality Master Contract for the authoritative requirements and acceptance gates.

Accessibility Audit Plugin v1.6.2

What changed

• Responsive, 200% text-resize, and WCAG text-spacing checks now run even when a modal blocks underlying keyboard interaction.
• Responsive evidence records explicit completion, so the coverage matrix no longer claims a phase ran when evidence is incomplete.
• Generic transient Chromium resource-load messages are excluded from authored page-error evidence, while genuine JavaScript console and page errors remain visible.
• Regression tests cover the blocked-page execution contract and truthful incomplete-phase reporting.

Verification

• 146 unit checks passed, with 14 intentionally skipped platform-dependent checks.
• 14 real-browser integration checks passed.
• GitHub Action bundle and Claude/Copilot/Codex/Cursor plugin packages passed compatibility gates.
• Dependency audit reported zero known vulnerabilities.
• Two independent live BuggyLand audits matched exactly: 70 consolidated records (32 confirmed failures, 37 review items, 1 interaction blocker), all 55 WCAG 2.2 A/AA criterion procedures, and complete responsive evidence for all 12 viewport executions.
• The attached XLSX was structurally validated with 70 finding rows and 491 evidence rows.

This release provides complete WCAG 2.2 A/AA criterion accountability through automated, guided, and human-review procedures. It does not claim that automation alone can certify conformance.

Accessibility Audit Plugin v1.6.1

Reliable full-coverage audit workflow

This patch preserves a cancelled GitHub Action as a cancelled process even when SIGTERM arrives while summaries or outputs are being written.

It includes the v1.6.0 coverage work:

• all 55 active WCAG 2.2 A/AA success criteria accounted for through automated, guided, or human/assistive-technology procedures
• configurable isolated keyboard, forms, focus, interaction, URL, input-value, and live-region journeys
• separate 200% text-resize, 320 CSS-pixel reflow, and text-spacing checks
• native NVDA and VoiceOver evidence workflows
• professional HTML, validated XLSX, JSON, screenshots, and evidence ZIP outputs

Automated results are evidence, not a guarantee of legal or WCAG conformance; criteria requiring human judgment remain explicitly queued for review.