v1.4.2

1.4.2 - 2026-07-29

Fixed

• Front-end framework detection (lazyload/run's first step) could stall for a very long time on sites with many third-party script tags (analytics, tag managers, ad SDKs, etc.). checkVueJS and checkReact (techDetect/) fetched every <script src>/<link rel="modulepreload"> URL referenced on the page — including third-party and data: URI ones — with no same-origin restriction, and each of those fetches could retry up to 10 times against an unreachable/slow host. Both checks now only fetch same-origin assets during detection, matching the intent already documented for this kind of check. (lazyload, run)

Added

• lazyload/run: added a --detection-timeout <seconds> flag (default 30, 0 disables) that bounds the front-end framework detection step. If it fires, detection falls back to the same "framework not detected" path used for a genuine no-match. (lazyload, run)
• run: added a --proxy-waf-fallback flag. When a proxy is configured (--proxy-config), it runs the same feasibility check as proxy --feasibility against each target before processing it, and automatically decides whether to use the proxy: skips it if no firewall/WAF is detected without a proxy, keeps using it if it bypasses a detected firewall, or skips the target (new exit code 29 in single-URL mode) if the proxy can't bypass it. (run, proxy)