Sitemap Cohort Auditor v0.2.2

What's Changed

• chore: share repository review ownership by @KRISHNAMMurarka in #6
• ci: add static analysis and dependency review by @KRISHNAMMurarka in #7
• Fix sitemap XML scalar and preamble parsing by @KRISHNAMMurarka in #8
• Release v0.2.2 by @KRISHNAMMurarka in #9

Full Changelog: v0.2.1...v0.2.2

Sitemap Cohort Auditor v0.2.1

What's Changed

• Prepare the verified v0.2.1 flagship release by @KRISHNAMMurarka in #5

Full Changelog: v0.2.0...v0.2.1

Sitemap Cohort Auditor v0.2.0

Sitemap Cohort Auditor v0.2.0

This release adds an opt-in, deterministic sitemap policy gate for CI and release checks while preserving existing behavior when no policy is supplied.

Highlights

• Validate exact host and scheme allowlists.
• Enforce minimum unique URL and image counts.
• Cap duplicate URLs, invalid dates, fragments, invalid URLs, missing locations, and removed URLs.
• Receive stable structured findings and exit code 3 when a completed audit violates policy.
• Load policy only from a bounded local UTF-8 JSON file.

Verification

• 39 automated tests pass.
• GitHub Actions passes on Node.js 20 and 24.
• The packaged archive is accompanied by a SHA-256 checksum file.

See the changelog and strict policy example.

Sitemap Cohort Auditor v0.1.1

Security and reliability release

v0.1.1 is the recommended release. Users of v0.1.0 should upgrade before auditing untrusted sitemap input.

Fixed

• Remote child sitemaps and redirects are restricted to credential-free, same-origin HTTPS URLs.
• Redirects are handled manually, loop-checked, limited to five hops, and rejected before an unsafe target is requested.
• Local sitemap indexes cannot initiate remote requests.
• Transfer and decompressed XML sizes are enforced while streaming, including bounded GZip handling.
• Text, JSON, usage errors, and runtime errors escape terminal control and bidirectional formatting characters while preserving ordinary Unicode.
• CI actions are pinned to exact commits from the current official releases.

Verification

• 27/27 tests passed on Node.js 20 and Node.js 24.
• The public CI matrix passed on the exact release commit.
• Local and live Edilec sitemap audits both reported 4,086 unique URLs, 8,364 image entries, zero duplicate URLs, and zero invalid last-modified values.
• The downloadable package contains the seven intended files. A SHA-256 checksum is attached alongside it.

Operational boundaries

The 50 MiB byte limits are per sitemap document, so very large graphs can still require substantial aggregate work. Do not expose the CLI as an unauthenticated hosted service without private-network and DNS-rebinding controls. Review untrusted local indexes before running them in a privileged environment because local child paths may traverse directories or resolve through symlinks.

Methodology: Sitemap partitioning for large-site coverage diagnostics.

Sitemap Cohort Auditor v0.1.0

Security notice: Do not use v0.1.0 with untrusted remote sitemaps. Upgrade to the hardened v0.1.1 release.

Initial public release of the dependency-free sitemap cohort auditor. It follows nested sitemap indexes, supports XML and GZip input, compares URL cohorts, and reports URL, image, host, lastmod, fragment, and duplicate evidence in deterministic JSON.

Methodology: Sitemap partitioning for large-site coverage diagnostics.