# Changelog of NF Accessibility Scanner — All-in-One WCAG Audit (`nativefoundation-inc/accessibility-scan-actor`) Actor

- **URL**: https://apify.com/nativefoundation-inc/accessibility-scan-actor/changelog.md
- **Full Actor documentation**: https://apify.com/nativefoundation-inc/accessibility-scan-actor.md

## Changelog

All notable changes to this actor are documented here.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
The scan report has its own schema version (`meta.reportVersion`, currently
`1.0.0`) — a breaking change to the report shape bumps that independently of
the actor version.

### \[Unreleased]

#### Known issues

- `npm audit` reports 17 moderate-severity findings, all the same advisory
  ([GHSA-8988-4f7v-96qf](https://github.com/advisories/GHSA-8988-4f7v-96qf),
  unbounded memory allocation in W3C Baggage propagation) in
  `@opentelemetry/core <2.8.0`, pulled in transitively via `lighthouse` →
  `@sentry/node@9.47.1`. No compatible fix exists upstream yet: Lighthouse's
  latest release still pins `@sentry/node@^9.28.1`, and that line hasn't
  picked up the `@opentelemetry/core` bump (only Sentry's v10 line has).
  Not exploitable here — Lighthouse only calls `Sentry.init()` when
  `flags.enableErrorReporting` is set, which `runRenderAudit` never passes, so
  the vulnerable code path is imported but never initialized. Re-check with
  `npm audit` after bumping `lighthouse`.

#### Added

- Detection-level e2e coverage: live runs against the W3C WAI "Before and
  After Demonstration" page (a stable, deliberately inaccessible public
  fixture) assert that `wcag-audit` reports real WCAG violations and that
  `html-structure` finds the fixture's known failures (missing `<html lang>`,
  images without `alt`) — previously the e2e tier only validated output shape.
- E2e tests for SARIF output (`OUTPUT.sarif` is valid SARIF 2.1.0 with a 1:1
  rule/result mapping to report findings), KV-vs-dataset parity, the
  `failOnSeverity` CI gate (run fails *after* persisting the report), and the
  SSRF guard (scans of non-public targets are refused).

#### Changed

- Per-engine e2e tests now assert the engine actually reached
  `status: 'completed'` on the live platform, surfacing the engine's own error
  detail on failure; a single retry absorbs transient live-platform flakiness.
- The e2e suite runs its live actor runs concurrently (capped at 4 in flight),
  cutting the post-deploy verify stage's wall time roughly in half.

### \[0.1.0] — 2026-07-03

Initial release.

#### Added

- Six accessibility engines in a single run: `wcag-audit` (full WCAG 2.x
  ruleset violations), `render-audit` (rendered-page accessibility score),
  `keyboard-nav` (focus order and focus-trap testing) — browser-based via
  bundled Chromium — plus three native, browserless engines: `html-structure`
  (lang, alt text, form labels, heading hierarchy, title, duplicate ids, empty
  interactive elements), `media-captions`, and `viewport-a11y`.
- Normalized, deduplicated findings with severity, p0–p3 priority, WCAG
  criterion/level, and an overall 0–100 score with an A–F grade.
- Report written to the `OUTPUT` key-value record and pushed to the default
  dataset; optional SARIF 2.1.0 output (`outputFormat: sarif`/`both`) for code
  scanning.
- CI gating via `failOnGrade` / `failOnSeverity` (non-zero exit after the
  report is persisted).
- Authenticated scanning via custom request headers / session cookie
  (same-origin only) and optional proxy routing with graceful direct-connection
  fallback.
- SSRF guard: refuses to scan private or non-public targets.
- Pay-per-event billing (`scan-completed`), charged only when at least one
  engine completed.
- Three-tier test suite (unit, local integration via `apify run` in Docker,
  live e2e) and a GitLab CI pipeline: check → deploy → verify.