v0.7.1

Fixed:

• Learn constant-target and stable prefix-rewrite redirect catchalls from independent Location controls.
• Scope redirect fingerprints conservatively while preserving unique redirects and exact directory redirects.

Verified:

• Full locked test suite and optimized release build pass.
• Loopback fixtures retain unique redirects and recursive directory children while suppressing confirmed 3xx catchalls.

v0.7.0

Fixed

• Dynamic JSON 401/403 catchalls normalize only recognized per-request metadata while preserving semantic authentication responses.
• Scoped authentication fingerprints suppress matching descendants without hiding the protected root directory.

Verified

• The locked 240-test suite and optimized release build passed.
• Repeated loopback scans preserved the real protected child and stopped recursive authentication-wall expansion.

v0.6.17

Added:

• Recursively extract bounded same-scope endpoints from inline and external JavaScript, JSON responses, OpenAPI paths, manifests, and source maps.
• Tag findings with crawl-js, crawl-inline-js, and crawl-json provenance.

Fixed:

• Preserve query strings through crawl-frontier scheduling while dropping browser-only fragments.

Verified:

• cargo test --locked: 233 passed.
• cargo build --release --locked completed successfully.
• A loopback chain traversed HTML to JavaScript to JSON and source-map endpoints with wire-level query preservation.

v0.6.16

Fixed:

• Detect dynamic Nginx status catchalls whose short counters change on every response.
• Bound and expire idle HTTP pool connections during large multi-host scans.

Verified:

• cargo test --locked: 228 passed.
• cargo build --release --locked completed successfully.
• Dynamic Nginx loopback catchall emitted zero false findings.
• Multi-host backup discovery completed under a 96-descriptor process limit.

v0.6.15

Added:

• Automatic startup updates install newer published releases without confirmation and resume the original command.
• Per-target active scan budgets are available through --host-timeout and --target-timeout.
• README includes a Bash-safe deep fuzzing example with proxy rotation.

Fixed:

• Explicit updater handoff uses the correct -U flag and no longer prompts repeatedly.
• Expired targets stop independently while streamed findings and other targets continue.

Verified:

• cargo test --locked: 226 passed.
• cargo build --release --locked completed successfully.

v0.6.14

v0.6.14: suppress blanket auth wildcards

v0.6.13

v0.6.13: add live URL-only probe output

v0.6.12

Changed:

• Replace separate live host and word fields with the exact combined active request URL.
• Preserve both the target prefix and appended path tail when long URLs are shortened.
• Apply the same display across initial wordlist, recursive, and crawl probes.
• Update README, changelog, package metadata, and lockfile for v0.6.12.

Verified:

• cargo test --locked (210 passed)
• cargo build --release --locked
• A loopback pseudo-terminal scan advanced combined request URLs and completed at 100%.

v0.6.11

Added:

• Show the newest active host and dictionary path in the live fuzz progress line.
• Report concurrent in-flight request and host counts across wordlist, recursion, and crawl probes.

Changed:

• Bound progress labels and neutralize terminal control characters.
• Update README, changelog, package metadata, and lockfile for v0.6.11.

Verified:

• cargo test --locked (210 passed)
• cargo build --release --locked
• Loopback pseudo-terminal scans advanced live host/path labels and completed at 100%.

v0.6.10

Fixed:

• Detect prefix-wide path-to-trailing-slash normalization before it can fill the recursion directory cap.
• Confirm redirect catchalls with two bounded concurrent random siblings.
• Preserve real directory redirects whose response fingerprint differs from the learned catchall.

Changed:

• Share one single-flight redirect check per parent with no new CLI flags.
• Update README, changelog, package metadata, and lockfile for v0.6.10.

Verified:

• cargo test --locked (207 passed)
• cargo build --release --locked
• A controlled concurrent fixture suppressed generic redirect roots and still found the distinct nested real child.