# Changelog of SiteVerdict — Vendor Terms & Privacy Policy Change Monitor (`siteverdict/siteverdict-vendor-terms-monitor`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-vendor-terms-monitor/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-vendor-terms-monitor.md

## Changelog

### 1.1.0 — 2 Nov 2026

- Fix: a run whose max total charge is used up exactly by the last document is no longer reported as "Stopped at the max total charge… remaining documents were not checked". The stop flag is now set only when a document is actually refused for lack of budget.
- Fix: the per-document budget check now uses the live remaining budget (which material-change and AI-summary charges also consume) minus in-flight reservations, so a document is not fetched once the money is gone.
- A page check that completes but cannot be charged (budget consumed by another event in flight) is now logged as a warning.
- Documents not checked because the max total charge was reached now get a dataset row with status `skipped_budget` (not fetched, never charged, snapshot untouched). They appear in REPORT and CHANGES.csv, are counted in SUMMARY (`byStatus.skipped_budget`, `notCheckedMaxCharge: { count, urls }`, `documentsChecked`), and the run status says "N not checked (max total charge reached)". They are not counted as checked. The status message's existing count now reads "not checked (error/blocked/robots/gone)".
- Contact address in the user agent changed to hello@webrevenuescan.com.
- Security: follow-redirects 1.16.1 → 1.16.2 (high, GHSA-mrwp-f3q8-3g9p) and ip-address 10.7.3 → 10.7.5 (moderate, GHSA-rxp7-6hxx-x8q5), lockfile-only patch updates of apify-client's transitive dependencies (Apify API calls only; document fetching does not use them). New tests cover redirects, redirect limit, timeout and SSRF blocking of private/loopback/link-local/metadata redirect targets on every hop.
- Security: undici 6.29.0 → 6.29.1 (direct) and cheerio's undici 7.30.0 → 7.30.1 (package.json override). This fixes high-severity advisories GHSA-2m5v-pch6-74hx (TLS validation bypass), GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c, GHSA-4w7w-5xrc-9h26 and moderate ones. No other dependency changed.

### 1.0.0 — 11 Oct 2026

- First release.
- Monitors up to 200 public vendor documents per run (terms, privacy, DPA, AUP, SLA, pricing) with snapshots in a named key-value store.
- Paragraph + sentence diff, 14-category material-clause taxonomy with high/medium/low severity and «highlighted» terms.
- Cosmetic-change filtering (whitespace, punctuation, quotes, "last updated" date-only); explicit price-token diff; document-removed (404/410) detection; redirect reporting.
- HTML diff page per changed document, HTML run report, CHANGES.csv, agent-ready SUMMARY JSON.
- Slack / webhook digest alerts (HTTPS only, secrets masked) with a minimum-severity threshold.
- Optional AI "what changed and why it matters" summary on the user's own Anthropic or OpenAI key.
- Polite fetching: honest user agent, robots.txt, per-host spacing, retries with backoff; SSRF guard on every hop; no bot-protection bypass.
- Sample mode with bundled fictional fixtures (free).
- Pay-per-event: `page-checked`, `material-change`, `ai-summary`; respects the run's max total charge.