v2.1.0

2.1.0

Feature

• Feature: expose canonical file diagnostics without composing pages, allowing editor and CLI integrations to avoid unnecessary page analysis when route context is not needed.

v2.0.3

2.0.3

Performance

• Performance: defer TypeScript compiler loading during standalone analysis to reduce memory use while preserving module and configuration handling.

v2.0.2

2.0.2

Bugfix

• Bugfix: ignore directive-looking text in HTML raw-text elements and attribute values so it cannot suppress real findings.

• Bugfix: recognize directly referenced hidden labels without treating hidden descendants of visible labels as accessible names.

• Bugfix: accept grandfathered language tags and reject repeated language extension singletons when validating document language attributes.

v2.0.1

2.0.1

Security

• Security: restrict CLI custom-rule entry files to the project's custom-rules directory, blocking symlink escapes while accepting equivalent filesystem path aliases.
• Security: provide verifiable Sigstore signatures for GitHub release downloads.
• Security: prevent crafted script URLs and component import paths from causing excessive processing during framework detection and component resolution.

Docs

• Docs: add contribution guidance, community conduct and private security reporting policies, bug and feature request forms, and a pull request checklist.

v2.0.0

2.0.0

Breaking

• Breaking: require Node.js 22.17 or newer for built-in file discovery.

Security

• Security: remove the runtime glob dependency chain from CLI and cross-component discovery, and update vulnerable development dependencies.

v1.4.4

1.4.4

Bugfix

• Bugfix: ignore imported stylesheets and other non-code assets during cross-component dependency analysis instead of reporting parser errors for them.

Docs

• Docs: remove private project-board links from the public integration contract.

v1.4.3

1.4.3

Chore

• Chore: verify packed and published package metadata against the tracked MIT license during Core release.
• Chore: remove the unused esbuild declaration and obsolete Jest configuration from the development toolchain.
• Chore: standardize the package on the tracked MIT license and owner-approved copyright notice.

v1.4.2

1.4.2

Bugfix

• Bugfix: restore the npm repository link to the public Core source and publish from that mirror with OIDC provenance.

v1.4.1

1.4.1

Chore

• Chore: point the npm repository link at the monorepo so OIDC trusted publishing matches the publisher-bound repository.

v1.3.21

1.3.21

Bugfix

• Bugfix: include TypeScript as a runtime dependency so clean package installs can load project and dependency analysis without a missing-module error.
• Bugfix: reduce real-world false positives by preserving HTML ancestry across void and mismatched elements; distinguishing native JSX tags from custom components; accepting valid ARIA shorthand, title-based names, prop and Vue attribute forwarding, composed root list items, conditional Vue IDs, hidden decorative images, and intentional icon markup; and recognizing Next.js metadata and deferred page landmarks.
• Bugfix: accept explicitly named icon-only links and buttons without requiring a redundant accessible name on their child SVG.
• Bugfix: report exact HTML element and attribute locations, expose absolute diagnostic offsets, and rebase Vue template findings to full-document positions so repeated violations and quick fixes target the correct source.
• Bugfix: support valid implicit form labels and avoid label false positives for hidden inputs, named image inputs, and named submit, reset, and button inputs.
• Bugfix: allow heading rank decreases that close subsections in both local and cross-component heading-order analysis.
• Bugfix: isolate component resolution, tsconfig aliases, and caches per project root so multiple workspace roots cannot contaminate one another.
• Bugfix: recognize non-empty nested inline content, require document titles to appear inside <head>, report every extra <main>, detect JSX/TSX tabIndex, and anchor JSX attribute diagnostics to the exact attribute.

Feature

• Feature: run duplicate-H1, main-landmark, heading-order, section-heading, and duplicate-ID rules across resolved React and Vue page composition; preserve component-instance provenance; suppress conditional or unresolved ambiguity; and add the opt-in advisory requirePageH1 rule (ZMD022).
• Feature: add canonical zemdomu check --format pretty|json|sarif output with deterministic JSON, documented exit codes, and SARIF 2.1.0 related-location and semantic-context mapping.
• Feature: add page-aware canonical diagnostics with uniquely resolved page and component paths, composition-related locations, conservative suggestions and preferred edit locations, plus reusable readable terminal formatting.
• Feature: add a versioned page/document model with configured and opt-in React/Vue filesystem route adapters, nested component trees, and ordered heading, landmark, section, navigation, and document-ID facts with source/component provenance.
• Feature: infer single, unconditional React and Vue component outputs such as <header>, <nav>, <main>, and <button> with source-backed evidence paths and explicit inferred or unknown confidence states.
• Feature: expose a versioned, framework-neutral semantic graph contract for files, components, native rendered elements, imports, composition, semantic facts, page roots, provenance, and explicit unknown analysis boundaries.
• Feature: add deterministic ProjectLinter.buildSemanticGraph() output for supported React and Vue component projects, including source-backed imports and composition plus conservative alias, conditional, cycle, unresolved, dynamic, and depth-limit states.
• Feature: expose a versioned canonical diagnostic contract and JSON serializer with stable rule codes, severity, source locations, related context, suggestions, and semantic provenance metadata while preserving the existing lint result API.
• Feature: support zemdomu-disable-next, zemdomu-disable, and zemdomu-enable directives in HTML, JSX, TSX, and Vue ProjectLinter analysis.
• Feature: export advisory and house-style rule classification metadata and default singleH1, requireTableCaption, requireSectionHeading, and requireNavLinks to warning severity.

Docs

• Docs: align the Core README and npm description with the approved semantic
  accessibility static-analysis positioning, public product names, supported
  cross-component scope, and layered-testing limits.
• Docs: publish the completed ZD-20 diagnostic-accuracy study with a pinned 10-repository HTML, React, and Vue corpus, 407 adjudicated findings, seeded-recall evidence, and rendered axe-core comparisons.
• Docs: approve canonical ZemDomu positioning, public product names, fair comparison principles, and separate Core capability and VS Code Extension 1.0 milestones.
• Docs: define the supported zemdomu package-root API for file and project analysis, including subpath deprecation and integration ownership boundaries.

Security

• Security: update dependency overrides and the lockfile to patched js-yaml, brace-expansion, and related transitive versions.