sitespeed.io release feed

sitespeed.io 41.3.3

Sitespeed.io — Tue, 09 Jun 2026 00:00:00 GMT

Fixed
- Release chain: dispatch building-docker-release.yml, building-docker-autobuild.yml and netlify.yml explicitly from release.yml instead of relying on the tag and main-branch pushes to fire them #4786.
- Docker release images are now signed with cosign and ship with a SLSA provenance attestation and an SPDX SBOM attached as separate OCI artefacts in the same Docker Hub repository. Users can verify an image was built and pushed by this repository's release workflow with

cosign verify --certificate-identity-regexp 'https://github\.com/sitespeedio/sitespeed\.io/\.github/workflows/building-docker-release\.yml@refs/tags/v .*' --certificate-oidc-issuer https://token.actions.githubusercontent.com sitespeedio/sitespeed.io:

, and inspect the SBOM or provenance with docker buildx imagetools inspect sitespeedio/sitespeed.io: --format '{{ json .SBOM }}'. The -slim and -plus1 variants are signed the same way. Signing is keyless via Sigstore OIDC so there's no long-lived signing key to manage #4783.
- Bump step-security/harden-runner from v2.14.2 to v2.19.4 across every workflow #4782.

sitespeed.io 41.3.1

Sitespeed.io — Tue, 09 Jun 2026 00:00:00 GMT

Fixed
- npm releases now ship a Sigstore provenance attestation and SPDX + CycloneDX SBOMs as GitHub Release assets. Releases run from a new .github/workflows/release.yml (triggered with ./release.sh patch|minor|major), publish to npm via OIDC Trusted Publishing, and only push the version commit and tag after the publish succeeds — so a failed publish can't leave an orphan tag firing the Docker release for a never-published version. Users can verify what they install with npm audit signatures a#4780.
- SECURITY.md: a written security policy with a documented channel (GitHub private vulnerability reporting, with email fallback). The file requires reporters to spell out an exploitation chain rather than just citing a finding, and takes an explicit stance on transitive-dependency CVEs that don't have a reachable code path in sitespeed.io's actual usage #4778.
- publiccode.yml: machine-readable metadata so sitespeed.io can be listed in EU public-sector software catalogues. release.sh's replacement workflow keeps softwareVersion and releaseDate fresh automatically on every release #4779.
- Slim Docker image build experiment #4777.

sitespeed.io 41.3.0

Sitespeed.io — Sun, 07 Jun 2026 00:00:00 GMT

Added
- Docker base image bumped browsers to chrome-149.0-firefox-151.0-edge-149.0 #4774, #4775.

Fixed
- Browsertime 27.5.0 #4776.

browsertime 27.5.0

Sitespeed.io — Sun, 07 Jun 2026 00:00:00 GMT

Added
- Bumped chromedriver and edgedriver to 149 #2487.
- Updated the Docker image to Chrome 149 / Firefox 151 / Edge 149 #2486 #2488.

Fixed
- Navigation-script failures now include the URL being tested and the iteration number in the error message, so failure logs and markAsFailure output point at the offending page without cross-referencing the surrounding log lines #2489.

sitespeed.io 41.2.1

Sitespeed.io — Sun, 31 May 2026 00:00:00 GMT

Fixed
- Unblock the arm64 Docker release build by bumping the QEMU binfmt emulator to a 9.2 build that handles modern systemd, and pinning APT so only the Firefox package is pulled from Debian unstable #4771.
- Move the slim Docker image to Debian trixie (the new stable) and drop the APT pin from #4771, which was too strict to let Firefox's libc6 / libnss3 dependencies upgrade from unstable #4772.
- CI: allow Docker Hub's CloudFront CDN (production.cloudfront.docker.com) through the Linux workflow's Harden-Runner egress allowlist, so the test job stops flaking when DNS routes the runner to CloudFront instead of Cloudflare #4773.

sitespeed.io 41.2.0

Sitespeed.io — Tue, 26 May 2026 00:00:00 GMT

Added
- JS/CSS coverage in the report. Browsertime 27.4.0 collects per-iteration coverage when you pass --chrome.coverage, and the HTML report now surfaces it as a Coverage section in the per-URL view: median JS/CSS total/unused/percent KPIs, first-party vs third-party split, top-25 worst-offender tables, and a methodology + recommendations panel. --chrome.coverage is declared in sitespeed.io's own CLI so it shows up in --help and the config reference, and the --enableProfileRun path now collects coverage on the profile run and merges it into the main result #4769, #4767.

Fixed
- Visual-change lines (_firstVisualChange / _lastVisualChange / _visualComplete85) are back on the waterfall when the HAR is gzipped on disk (the default). The renderer's user-timing injection was parsing the raw gzip bytes as JSON and silently falling back to the unannotated HAR; it now sniffs the gzip magic bytes and inflates via DecompressionStream first #4758.
- Per-request detail panel on the waterfall now shows real data again. The panel was reading HAR-shape fields (req.response.content.size, req.response.headers, req.response.status, req.timings, …) but waterfall-tools' click payload is its own flat internal Request object, so Response body always showed 0 B, Status was blank, MIME type and Protocol were —, and the response-headers and timing tabs were empty. Look up the matching HAR entry by index and read the rich HAR shape from it, falling back to the waterfall-tools shape only when the HAR is missing.
- Folder path aliases now accept Unicode letters and digits, so non-ASCII URLs no longer collapse to - in result paths (issue #3880) #4759.
- scp plugin: retry the initial SFTP handshake up to 3× with linear backoff. ssh2-sftp-client v12 removed its built-in connect retries, so a single "Connection lost before handshake" blip was failing the whole upload #4760.
- Graphite: retry the post-run annotation POST up to 3× on network errors and 5xx responses. 4xx still fails fast #4761.ß
- waterfall-tools bumped to the first proper npm release, 0.3.0 — no more pinning to a GitHub tarball, and the bundling script drops to ~30 fewer lines now that the published browser bundle has the platform aliases baked in #4764.
- Browsertime 27.4.0 #4767.
- Docker base image rev'd to chrome-148.0-firefox-150.0-edge-147.0-d #4762.
- Slim Docker image cleanup #4757.
- Drop now-unused npm overrides from package.json #4756.
- CI: PR Docker workflow now builds and exercises the image on arm64 in addition to amd64, so arch-specific breakage surfaces pre-merge instead of at release-tag time. Edge step is skipped on arm64 (Linux Edge is amd64-only) #4766.
- CI: pin the Safari workflow to macos-14 #4765.
- Drop an unnecessary \. escape inside a character class in pathToFolder that was tripping eslint's no-useless-escape and failing lint on every PR #4763.
- Docs: remove unused CSS #4768.

browsertime 27.4.1

Sitespeed.io — Mon, 25 May 2026 00:00:00 GMT

Fixed
- --chrome.coverage no longer reports "0 B unused" for functions that executed at least once. The JS used-bytes calculation took the union of every V8 range with count > 0, but V8 returns nested ranges — an outer range over the whole function body and inner ranges over sub-blocks. If a function ran at all, its outer range already covered the whole body and the inner count == 0 ranges (the actual dead branches) got absorbed into the union and contributed nothing. On modern bundles where module-evaluation top-level code runs for almost every function, the per-script unused-% collapsed to roughly zero across the board, leaving sitespeed.io rendering a "0 B unused" column on pages that obviously ship plenty of dead code. The calculation now walks the ranges as nested intervals, painting the innermost range's count at every byte (the same definition Chrome DevTools' Coverage panel uses), so dead branches inside executed functions show up correctly. CSS rule-usage tracking returns flat, non-overlapping ranges and is unchanged #2484.

browsertime 27.4.0

Sitespeed.io — Sun, 24 May 2026 00:00:00 GMT

Added
- JS/CSS coverage collection for Chrome. --chrome.coverage turns it on for every iteration for users who want the data and accept that detailed V8 coverage deoptimizes scripts and will skew their timing metrics. --enableProfileRun also turns coverage on for Chrome alongside the existing trace, so users who want coverage without affecting their timings can lean on the same extra-iteration pattern they already use for tracing — the result is merged back into the main browsertime.json so consumers like sitespeed.io see the data in the same place they read every other metric. Each entry has a per-file breakdown (url, totalBytes, usedBytes, unusedBytes, unusedPercent) #2480.

Fixed
- HAR post-processing no longer throws when a page has no matching entries. Occasionally a HAR contains a page whose pageref has no entries — typically a navigation that didn't produce any requests, or an extension-injected page. getDocumentRequests and getFinalURL dereferenced shift() / pop() without a guard, and getMainDocumentTimings wrapped its entire per-page loop in a single try/catch so one bad page wiped out the main-document timings for every other page in the same HAR. Downstream this surfaced as a noisy triplet of warnings followed by an empty coach-data payload in sitespeed.io. The three crash points are now guarded and unresolvable pages are skipped #2483.
- Bumped geckodriver to a version with native ARM-64 support #2482.

onlinetest 4.0.1

Sitespeed.io — Fri, 22 May 2026 00:00:00 GMT

Fixed
- Compare page now renders screenshots, the filmstrip and the run video when the HAR points at a different sitespeed.io result server (e.g. wikiperformance comparing HARs that live on wikimedia.sitespeed.io). The helmet CSP only allowed 'self' for images and — via the inherited default-src — for video, so the cross-origin URLs the HAR carries in _meta.screenshot / _meta.filmstrip[].file / _meta.video were blocked and the slots came up empty. img-src now also allows any https: origin and a new media-src does the same for video #269.

sitespeed.io 41.1.0

Sitespeed.io — Wed, 20 May 2026 00:00:00 GMT

Added
- New rsync plugin for result uploads. The existing scp plugin walks files one at a time over a single SFTP channel, which is the worst case for a result directory of thousands of small files. The new plugin shells out to rsync over ssh, pipelines the wire protocol and reuses the channel — the same upload finishes in a small fraction of the time on a typical Linux host. Exposed as --rsync.host / --rsync.username / --rsync.privateKey / --rsync.destinationPath etc., sitting alongside scp, s3 and gcs; existing scp users keep their exact behaviour and opt in to rsync only when they want it #4739.
- Upload performance on the existing scp plugin: swapped node-scp (serial uploads, stuck on 0.0.25) for ssh2-sftp-client, which fans out 16 concurrent uploads on the same ssh2 transport. Same auth, same options, same CLI surface — just faster on result directories with many small files #4738.

Fixed
- Bring back the visual-change markers on the waterfall. The renderer that replaced PerfCascade in #4614 only drew vertical lines for a fixed set of page-event names, so the _firstVisualChange / _lastVisualChange / _visualComplete85 lines silently disappeared with the swap. They're now hoisted into the user-timing-marks bag the renderer does draw, the "Marks & visual metrics" toggle is on by default, and the hover tooltip identifies which metric or user mark the cursor is on #4755.
- Browsertime 27.3.0 #4754.
- coach-core bumped to 9.2.1 #4750.
- Bump @sitespeed.io/log and the bundled plugin to latest #4746.
- Crawler rewrite: simplecrawler (unmaintained since 2020, ~1000 lines of transitive code) is replaced by an in-tree node:fetch-based crawler in ~285 lines with no new dependency. Same BFS semantics, same depth/maxPages/include/exclude/content-type/skip-extension rules, same robots.txt handling (--crawler.ignoreRobotsTxt still opts out), same cookies/basicAuth/userAgent passthrough. Parity verified across four real-site runs at different depths and page caps; natural completion is ~6× faster on the sample runs #4745.
- Dependency pruning, no behaviour change for users: lodash.get, lodash.set and lodash.merge are replaced by small in-tree helpers in lib/support/objectPath.js, with the merge replacement verified byte-for-byte against lodash.merge across 23 edge cases and an A/B parseCommandLine() run. dayjs (plus the utc plugin) is replaced by an ~80-line lib/support/time.js, with every .format() pattern actually used in the codebase pinned in a new test. ora is replaced by a ~60-line blinking-dot spinner used only by --api.add / --api.addAndGetResult. The lodash subtree is now gone entirely [#4737, #4741, #4742, #4744, #4740].
- The markdown template helper exposed to pug templates is removed. It was added in 2018 (#2161) but no shipped .pug template has ever called it, and the underlying markdown@0.5.0 package has been unmaintained for over a decade with an open ReDoS advisory. Anyone with a custom pug template that calls markdown(...) will need to import their own renderer #4743.
- Slimmer main Docker image: apt-get install --no-install-recommends + /var/lib/apt/lists cleanup, npm ci (lockfile-strict) instead of npm install, and the selenium-webdriver/bin cleanup folded into the install layer so the deleted bytes no longer ship in an earlier layer #4753.
- Docker: use --omit=dev instead of the deprecated --production, and fix the skip edgedriver typo #4752.
- Release tooling: bump feed to 5.2.1 and marked to 18.0.3 (used only by release/feed.js when refreshing documentation RSS feeds). API usage unchanged, regenerated feeds are content-identical #4751.
- Dev tooling: align with eslint 10 and unicorn 64, drop the dead legacy .eslintrc.json and the stale eslint-check script, minor bumps to prettier/sass/esbuild #4747.

browsertime 27.3.0

Sitespeed.io — Wed, 20 May 2026 00:00:00 GMT

Added
- browsertime --help is now navigable by topic. The default view shows a short curated list of common options plus the available topic names. browsertime --help shows just that topic, and browsertime --help-all reproduces the historical full dump for scripts and power users. The old single-screen dump of every option from all 13 topic groups was overwhelming for new users and slow to skim; the topic-filtered view follows the curl/ffmpeg pattern #2467.

Fixed
- TypeScript types and IntelliSense for navigation scripts are tightened across the script-facing surface. A new BrowsertimeScript type alias lets scripts annotate their default export and get both context and commands typed in one line. The high-level command helpers (navigate, find, getText, fill, hover, press, getTitle, waitForUrl, …) now surface their JSDoc parameter and return types in IntelliSense instead of being typed as Function, and commands.find resolves to a real WebElement so chained calls get completion from selenium-webdriver #2476. context.options, context.result, and context.taskData are typed as Record so editors offer completion on context.options. etc. #2478. commands.mouse is now a proper shape (selector typed as string, singleClick's options surface waitForNavigation) instead of an anonymous object literal, and measure.stop / measure.clickAndMeasure / measure.stopAsError return types are explicit (Promise / Promise) instead of Promise #2479.
- How Browsertime publishes its TypeScript types is now safer. scripting.d.ts moved to the repo root next to package.json so it can't be clobbered by a future tsc outDir change, the types condition comes first under exports to match TypeScript's documented resolution rules, and publint runs as part of prepublishOnly so common package.json mistakes fail before a release goes out #2477.
- Replaced the direct lodash.merge dependency with a small in-tree merge() helper in lib/support/util.js. The helper matches lodash's actual semantics for the cases Browsertime relies on — arrays merged by index, undefined source values skipped unless the key is missing on the target, Date/RegExp/class instances passed by reference, prototype-pollution keys rejected — which finishes the lodash unbundling the same way sitespeed.io did #2468.
- Bumped dependencies: chrome-har 1.3.1 #2469, chrome-remote-interface and selenium-webdriver #2475, @sitespeed.io/log 2.0 #2471, chromedriver / edgedriver / geckodriver #2472.

chrome-har 1.3.1

Sitespeed.io — Tue, 19 May 2026 00:00:00 GMT

sitespeed.io 41.0.1

Sitespeed.io — Sat, 16 May 2026 00:00:00 GMT

Fixed
- Drop unused fast-crc32c dependency #4735
- Fix visual-progress curve and scrubber to match the data's semantics

sitespeed.io 41.0.0

Sitespeed.io — Fri, 15 May 2026 00:00:00 GMT

Fixed
- HTTP/3 / HTTP/3.0 connections are now classified as h3 instead of falling through to h1, so the HTTP-version breakdown is correct on HTTP/3 traffic.
- Cache-Control is parsed case-insensitively (RFC 7234), so Max-Age=42 is read as 42 instead of 0 and No-Cache / No-Store are honoured — caching advice and expireStats no longer over-report problems on origins that capitalise the directive.
- missingCompression no longer flags already-gzipped assets (the encoding check was comparing a flattened header array against a string), accepts compound encodings like br, gzip, and recognises zstd. xml is now also considered for compression reporting.
- The Domain= cookie attribute is matched case-insensitively (RFC 6265), so third-party cookies set with lowercase domain= are detected.
- getMainDomain recognises common two-label public suffixes (.co.jp, .com.br, .com.au, …), so the auto-generated first-party regex stops misclassifying same-site requests on non-.co.uk country domains.
- defaultContentTypes now includes favicon, so every page has a consistent shape in the content-type breakdown.
- getDocumentRequests returns an empty array for pages with no matching entries instead of throwing.

Changed
- coach-core bumped to 9.1.0, which pulls in pagexray 5.0.0 #4731.

onlinetest 4.0.0

Sitespeed.io — Fri, 15 May 2026 00:00:00 GMT

Added
- New failed_reason TEXT and finished_date TIMESTAMP columns on sitespeed_io_test_runs. failed_reason is populated from three paths the DB previously knew nothing about: Bull's global:failed event (the testrunner threw), the queue-down submit path in add-test.js (Redis unreachable when the test was queued), and the result-queue path when sitespeed.io itself exits non-zero (testrunner now sends Test runner exited with code N: , capped at 500 chars). finished_date is stamped on every terminal transition, so end-to-end duration can be derived as finished_date - added_date and run duration as finished_date - run_date (which is the browsertime start timestamp, not finish) #264.
- server/database/migrations/ directory establishes the convention for schema changes against existing deployments — setup.sql only runs on a fresh Postgres data dir, so live databases need ALTERs applied separately. Each migration ships with a .sh helper (check / backup / dry-run / apply / verify / rollback) that runs psql inside the compose Postgres container, plus a README documenting the manual path. Existing deployments must run 001-add-failure-fields.sh apply before rolling the server forward #264.

onlinetest 3.8.0

Sitespeed.io — Fri, 15 May 2026 00:00:00 GMT

Added
- Default sitespeed.io Docker image bumped from 40 to 41 in .env.example. The README "Update sitespeed.io version" snippets now reference 41 / 42 as the current and next-major tags.
- Vendored compare bundle rolled to pagexray 5.0.0 (HTTP/3 detection, case-insensitive Cache-Control directives, missingCompression over-count fix). The bundle shrinks from ~28 KB to ~17 KB thanks to pagexray's switch from uglify-es to terser #262.

Fixed
- /admin "failed" pill is now a real health signal: it counts failed test runs in the last 24 h from Postgres instead of Bull's getJobCounts(), which was capped by removeOnFail and only decayed on a successful retry — so the pill accumulated weeks of stale failures and shouted "13 failed" next to activity cards that correctly showed 0 in 24 h #261.
- Compare cookie list no longer renders domains like .example.com\nUIDR=... when a HAR concatenates multiple Set-Cookie response headers into one newline-joined value — the next cookie's name was leaking into the previous cookie's Domain= attribute. Picked up via the pagexray bump #262.

sitespeed.io 40.5.0

Sitespeed.io — Thu, 14 May 2026 00:00:00 GMT

Added
- Scripts are now auto-detected on the command line, so --multi is no longer required to run them. Any positional argument that looks like a script — .js / .cjs / .mjs, or any file whose first non-empty line doesn't start with http — flips multi mode on automatically, and mixed inputs like login.js https://example.com logout.js just work. --multi is kept as an explicit override for the one case auto-detection can't cover: sharing a single browser session across a list of plain URLs. All existing invocations behave exactly as before #4725.

Fixed
- Gzipped HAR files are now written by piping JSON through createGzip straight to disk instead of materialising the JSON string, a Buffer copy of it, and the full gzipped Buffer all at once. For a 200 MB HAR that removes several hundred MB of avoidable peak RSS, multiplied when multiple pages finish around the same time. The storage layer now accepts a Readable in addition to strings and Buffers; existing callers are unaffected #4728.
- Gzipped JSON result files (Chrome traces, console logs, etc.) are read by streaming through createGunzip and collecting utf-8 chunks rather than buffering the whole gzipped payload, gunzipping it into another Buffer, then stringifying. The parsed object still has to fit in memory, but the throwaway gzipped and unzipped buffer copies are gone — meaningful on 50+ MB traces #4726.
- The sustainable plugin and the S3 plugin pick up the same streaming treatment: the sustainable plugin now uses the shared streaming gzipped-JSON helper instead of its own buffer-everything copy, and the S3 plugin streams uploads via createReadStream with an explicit ContentLength instead of loading each file fully into memory before PutObject. With 20 concurrent S3 uploads, RSS no longer spikes to ~20× the size of the largest file in the result bundle #4727.

pagexray 5.0.0

Sitespeed.io — Thu, 14 May 2026 00:00:00 GMT

Added
- CLI can now read a HAR from stdin: pagexray - or piping into pagexray with no path argument #131.
- CLI prints a friendly error to stderr and exits 1 when the file is missing or the input isn't valid JSON (previously threw a raw Node stack trace) #131.
- README updated to drop the long-removed cookieStats example block and document fields added across 3.x / 4.x (fullyLoaded, afterOnLoad, afterOnContentLoad, renderBlocking, googleWebVitals, cpu, firstPartyRegEx) #130.

Fixed
- Classify HTTP/3 / HTTP/3.0 connections as h3 (previously only the lowercase h3 / h3-29 shorthand was recognised — the canonical form fell through to h1) #128.
- Parse Cache-Control directives case-insensitively (RFC 7234 §5.2). Max-Age=42 is now read as 42 instead of 0, and No-Cache / No-Store are honoured #128.
- Replace the deprecated url.parse (Node DEP0169) with the WHATWG URL parser in getHostname #128.
- Stop throwing in getDocumentRequests when a page has no matching entries — return an empty array instead #128.
- missingCompression was flagging every large text asset, including gzipped ones, because headers.flatten wraps values in arrays and the encoding check compared the array to a string. Unwrap before comparing, accept compound codings (br, gzip), and recognise zstd #129.
- Match the Domain= cookie attribute case-insensitively (RFC 6265 §5.2) so third-party cookies set with lowercase domain= are detected #129.
- Recognise common two-label public suffixes (.co.jp, .com.br, .com.au, ...) in getMainDomain so the auto-generated first-party regex isn't wrong for non-.co.uk country domains #129.
- defaultContentTypes now includes favicon so every page has a consistent shape (matches the example in the README) #129.
- xml is now considered for missingCompression reporting #129.
- engines.node bumped from >=8.9.0 to >=22.0.0 (the current Node.js LTS), and the GitHub Actions matrix now runs on Node 22 + 24 #132, #133.
- Test runner switched from Mocha + Chai to AVA, matching the rest of the sitespeed.io / browsertime ecosystem. Test helpers no longer depend on bluebird or lodash #133.
- ESLint upgraded from 8 to 9 with the new flat config (eslint.config.js replaces .eslintrc.json and .eslintignore) #133.
- All devDependencies bumped to current major versions: prettier 3, browserify 17, browserify-banner 2, @babel/core + preset-env 7.29, jsdoc 4. The abandoned uglify-es is replaced by terser, and mkdirp is dropped in favour of native fs.mkdirSync({recursive:true}) in the browserify script #133.

Changed
- Node.js 22 is minumium.

sitespeed.io 40.4.1

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Fixed
- Stop parsing scripting files as URL-alias lists in getAliases #4724.

onlinetest 3.7.0

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Added
- Per-queue 24 h sparkline on each /admin queue row, independently scaled so low- and high-traffic queues both show shape #256.
- Subtle motion on /admin: one-time staggered bar-chart entrance, refresh-indicator pulse, and tweened number rollups when totals change. All honour prefers-reduced-motion #256.

Fixed
- Queue defaults bumped to removeOnComplete: 50 / removeOnFail: 100 / attempts: 2; code-level fallbacks aligned with the yaml #255.
- Internal queues (testrunners, result) no longer listed on /admin — they had no failures, no sparkline, and an inert Empty button #258.
- Refresh indicator on /admin now sits in a fixed-width column so the version pill can't shift sideways each tick #258.
- Testrunner setup duplicated on restart — registration was concatenating old + new instead of deduping #257.
- Multi-type setups on one location (e.g. desktop + emulatedMobile) collapsed into the last entry after a restart; dedupe now keys on full setup identity, not just queue name #259.

onlinetest 3.6.0

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Added
- Activity stats on /admin: totals for the last 24 hours and 7 days plus a stacked bar chart of tests per hour over the last 24 h (completed / failed / other). Pure server-rendered SVG, cached for 60 s so the auto-refresh doesn't beat on Postgres #252.

Fixed
- Hide the Failed count for the internal testrunners and result queues — the number was unactionable because the queues don't appear in Recent failures #251.
- Age labels in Recent failures now graduate to d/mo past 48 h instead of shouting 12608h ago #251.
- Long URLs no longer push the /search/ results table past its container and shove the page off-centre. URL cells now wrap at any character; the form has overflow-x: auto as a safety net #253.

onlinetest 3.5.0

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Added
- Health banner on /admin: Redis up/down, Postgres up/down, connected testrunners, totals for pending/running/failed jobs #247.
- "Currently running" table on /admin — every active job with URL/script, queue, runner, and elapsed time. Runs over 10 minutes are highlighted #247.
- "Recent failures" table on /admin with the error message and a one-click Retry button #248.
- Active and Failed counts on the queue table, plus a red "no worker" badge when a queue has pending jobs but no testrunner serving it #246.
- /admin auto-refreshes every 15 seconds. Pauses in background tabs #249.
- Opt-in auto-refresh toggle on /search/, 60 seconds. Off by default. Pauses while any test is ticked, so Compare selections aren't lost. State remembered in localStorage #250.
- /admin mobile layout reworked for the new tables — rows stack into name → counts → action on narrow screens #246 #247 #248.

onlinetest 3.4.0

Sitespeed.io — Wed, 13 May 2026 00:00:00 GMT

Added
- Connected testrunners table on /admin showing hostname, location, the setup each machine serves, and a fresh / stale "last seen" badge. Each testrunner publishes a heartbeat on the existing testrunners Bull queue every 30 s; the server tracks lastSeenAt per runner and prunes anything quiet for >120 s, so crashed runners (OOM, host reboot, docker kill) drop off the admin page within ~2 minutes instead of haunting the metrics gauge forever. When two runners pick the same LOCATION_NAME + deviceId, the server logs a clear Testrunner queue collision: hostA and hostB both claim queue X. Change LOCATION_NAME (or deviceId) on one of them. — the registration still goes through so existing deployments don't break, but the collision is no longer silent #244.
- deploy/PRODUCTION.md gets an "Adding a third (or Nth) testrunner" section with three concrete troubleshooting cases: not registering, stale row, queue collision #244.
- Compare workflow on /search/: the column over the per-row checkbox is now its own Compare header (split out from the generic "Actions"), a one-line helper below the table explains the affordance, and each checkbox carries an aria-label / title of "Select this run to compare with another". The Compare button itself starts disabled, gates submission until exactly two completed runs are ticked (a third tick is refused — the unchecked boxes go disabled when the limit is hit), and shows a transient inline message on a premature click ("Select 1 more test to enable Compare." / "Select 2 completed tests above first.") via aria-disabled + a polite aria-live region #240.
- deploy/update.sh — a single operator command that pulls the latest images, restarts services with up -d --remove-orphans, prints docker compose ps, and tails logs for 10 seconds so first-boot errors land in the same terminal. --mode {all-in-one|server|testrunner} picks the right production compose file; --version X.Y.Z rewrites SITESPEED_IO_SERVER_VERSION / SITESPEED_IO_TESTRUNNER_VERSION in .env atomically before pulling. PRODUCTION.md is updated to call the helper in every place it used to spell out the compose invocation by hand.
- .env.example is now the single source of truth for every variable any compose file reads (dev or production). New header walks through the three deployment shapes, and the previously-undocumented DOMAIN variable (used by the Caddy single-server compose for automatic HTTPS) is included. PRODUCTION.md drops its inline env-var snippets and points at .env.example so the two can't drift.

Fixed
- SIGTERM / SIGINT now actually drain in-flight HTTP requests before the process exits. The previous shutdown chain ended at this.app.close() on the Express app object (no such method exists), so the HTTP server was never told to stop — it just disappeared when process.exit(0) fired a few lines later, killing in-flight requests mid-response. The web server now keeps the real http.Server reference and calls close() on it; a configurable server.shutdown.timeoutMs (default 30 s) caps the drain and falls back to closeAllConnections() after the deadline. A second signal during shutdown short-circuits to immediate exit for operators who'd rather not wait #243.
- Custom hero / navbar logo overrides now use whatever dimensions the operator sets in html.logo.*. Two hardcoded aspect-ratio: 90.488 / 19.543 / aspect-ratio: 123 / 25.375 CSS rules were forcing every logo back to the bundled SVG's proportions #239.
- The analyze button on the Extras tab no longer sits a few pixels lower than on the other tabs. #extras .control was applying padding: 4px 0 to the submit button's wrapper as well as to the intended checkbox rows; scoped to .extras-fieldset .control so only the diagnostics checkboxes get the extra spacing #239.
- Footer spacing: removed the duplicate before "version" and added one between the trailing dash and "AGPLv3", so the footer now reads "©sitespeed.io 2026 - version X.Y.Z - AGPLv3" with consistent spacing #239.
- Search help panel: tighter copy. "You can combine your search commands. To find a test for a URL, date and browser you can search like this" is now "Combine commands to narrow your search. Example". The "Find tests by …" preamble that repeated on every line is gone — each command now leads with its field name and (where applicable) the allowed values #239.

Security
- Stop logging and echoing back invalid API keys. validateKey used to write the rejected value to the server log and return it in the 403 response body, so typos and stale secrets piled up in log aggregation. The log line is now Invalid API key supplied (no value, no length) and the response carries a single "Invalid API key." message in every locale #242.
- Close two XSS vectors that the recent UI work uncovered:
- Enforce a defense-in-depth CSP (default-src 'self'; script-src / style-src allow 'unsafe-inline' transitionally because pug templates still ship inline blocks; frame-ancestors 'none', object-src 'none', base-uri 'self', form-action 'self') and re-enable HSTS. Both were disabled previously #242.
- Block sensitive sitespeed.io flags from the GUI's "Command line args" tab. The user-supplied extras textarea used to forward arbitrary flags to the testrunner with only --verbose filtered. A GUI submission could load plugin / JS code (--plugins.add, --browsertime.preScript), run any binary as the browser (--browsertime.chrome.binaryPath), redirect HARs and metrics to an attacker-controlled destination (whole --graphite.* / --s3.* / --gcs.* / --scp.* / --slack.* / --matrix.* / --datadog.* / --influxdb.* namespaces), or read arbitrary files via --config. A denylist now drops these tokens (and their value arguments) before they reach sitespeed.io, and /sitespeed-help.json filters the same set so the CLI picker stops suggesting them (277 → 187 entries). API submissions (which pass a userConfig object, not extras) are deliberately untouched #241.

browsertime 27.2.0