a11ign@0.10.18

Patch Changes

• Updated dependencies [4181ec2]
  • @a11ign/scorer@0.3.8
  • @a11ign/judge@0.5.10

a11ign@0.10.17

Patch Changes

• Updated dependencies [4ff45b8]
  • @a11ign/judge@0.5.9

Promoted to latest: 2026-10-25T15:03:31Z (qualification read on 543c9b4)

@a11ign/scorer@0.3.8

Patch Changes

• 4181ec2: The scorer's Python runtime now pins transformers==5.20.1 and huggingface-hub==2.3.0, where it pinned 4.57.6 and 0.36.2 (A11-262). Reinstall from requirements.txt to pick them up. The hub pin moves because transformers 5.20.1 requires huggingface-hub>=1.31.0,<3.0, so 0.36.2 can no longer be installed beside it. Scores do not change: on one annotated capture, score.py's whole output (49 scores) was identical under the old and new pins on the ONNX path and on the torch fallback, and the embeddings of seven test strings were bit-identical on both paths. export-encoder-onnx.py, the offline tool that rebuilds the ONNX encoder, had stopped working under transformers 5 ("got multiple values for argument 'use_cache'") and works again. Its export now has one output, last_hidden_state, the same as the ONNX encoder the scorer fetches.

@a11ign/judge@0.5.9

Patch Changes

• 4ff45b8: The optional @anthropic-ai/sdk peer is now >=0.106.0, where it was >=0.106.0 <0.134.0 (A11-252). The upper bound was a snapshot of the last release somebody checked by hand, so every later SDK minor produced an unmet-peer warning until the range was widened again. If you use the Anthropic backend you may now install any SDK from 0.106.0 up without that warning. No version that was supported is dropped, and @anthropic-ai/sdk stays optional: Codex and OpenAI-compatible users never need it. Compatibility with a newer SDK is shown by this repository's own suite running on the bumped SDK in Dependabot's pull request, not by a hand-written ceiling; calls to the live API are not exercised.

Promoted to latest: 2026-10-25T15:03:31Z (qualification read on 543c9b4)

@a11ign/judge@0.5.10

Patch Changes

• Updated dependencies [4181ec2]
  • @a11ign/scorer@0.3.8

a11ign@0.10.16

Patch Changes

• 6401503: The sign-in loop's mark now carries, on each branch, how many times the acted-on screen was seen again and the screen as it last showed, so a real sign-in's trail records them (#5690, under #5689 and #5564).

Promoted to latest: 2026-10-25T12:01:48Z (qualification read on 241a3f8)

a11ign@0.10.15

Patch Changes

• 3c10a02: The sign-in trail now records, on the branch the loop acted on, how many times that screen was seen again and the screen as it last showed, so a wrong code whose alert never appeared reads as a loop that did not look (#5689, under #5564).

Promoted to latest: 2026-10-17T05:30:51Z (qualification read on 6ad4152)

a11ign@0.10.14

Patch Changes

• c50d176: The sign-in trail now records the alert a rejected one-time code raises. The loop acts on a screen once and then skips it while it stays the same screen, so the page that comes back after a wrong code was never written; it is now recorded as an observed branch whenever its alerts or controls change, by role and accessible name and never a value (#5683, under #5564).

Promoted to latest: 2026-10-17T05:02:06Z (qualification read on c4338aa)

a11ign@0.10.13

Patch Changes

• 84017dc: The sign-in trail named by A11Y_AUTH_TRAIL_FILE now records, for each loop branch, the alerts and controls its screen showed, by role and accessible name and never a value, so a rejected code is visible as the page said it (#5674, under #5510).
• b0147e1: --probe-forms and the Action's probe-forms input now say, in every place they are documented, that they are for a seeded test organisation or account. The CLI's usage text, which --help prints, carries the same sentence, and docs/try-it.md no longer calls probe-forms the Action's default (#5656).

Promoted to latest: 2026-10-17T02:34:03Z (qualification read on 4b4c9ee)

a11ign@0.10.12

Patch Changes

• 774002c: The left-origin message no longer says an identity-provider redirect is SSO, which v1 does not do. A redirect to a provider the flow does not declare still ends the run, and the message now names idp-origins: in the flows file as the way to declare one (#4088). SSO beyond that is still not supported: the message keeps the route to a dedicated test account without MFA or SSO. The worker the lockfile installs is @a11ign/screenreader-worker 0.13.5, which carries the same sentence, so the CLI's parity test holds (#5644, under #5648).

Promoted to latest: 2026-10-16T21:01:45Z (qualification read on defb1dc)