v3.5.1

What's Changed

New Features

• Add originalUrl to findings in findForUrl by @abdulahmad307 with @Copilot in #281

Fixes

• chore(deps-dev): Bump jekyll-feed from 0.17.0 to 0.18.0 in /sites/site-with-errors in the bundler-minor-and-patch group by @dependabot[bot] in #280

Full Changelog: v3.5.0...v3.5.1

v3.5.0

What's Changed

New Features

• Wait for per-URL selectors before accessibility scans by @mvanhorn with @Copilot and @abdulahmad307 in #273

Fixes

• Overhaul plugin docs by @JoyceZhu in #261
• Address feedback on previous plugins overhaul PR by @JoyceZhu in #262
• Change demo video link in README by @cehfisher in #263
• Add more on NPM plugin allowlist by @JoyceZhu in #265
• Pin GitHub Actions to commit SHAs by @github-security-bot in #270

New Contributors

• @github-security-bot made their first contribution in #270

Full Changelog: v3.4.1...v3.5.0

v3.4.1

What's Changed

Fixes

• Fix NPM plugin module resolution so packages installed from consumer workflows can be resolved and imported by the compiled Find action loader (#252).

This fixes loading the Alt Text Plugin from npm alongside Axe:

scans: |
  ["axe", {"name": "alt-text-scan", "package": "@github/accessibility-scanner-alt-text-plugin", "version": "1.1.0"}]

Full Changelog: v3.4.0...v3.4.1

v3.4.0

What's Changed

New features

• Load allowlisted first-party scanner plugins from NPM packages with object scans entries and optional version pinning by @kzhou314 in #242
• Add AccessLint as a built-in scan engine, with Axe comparison and engine-selection guidance by @kzhou314 in #241

Documentation and maintenance

• Document the first-party Alt Text Plugin and its NPM configuration by @kzhou314 in #247
• Update ruby/setup-ruby by @dependabot in #246 and #248
• Update actions/setup-node and patched brace-expansion by @dependabot in #248 and #249

Upgrade notes

This release is additive and backward-compatible. Existing workflows using github/accessibility-scanner@v3 do not need configuration changes, and Axe remains the default when scans is omitted.

To use the currently published Alt Text Plugin with an explicit version pin:

scans: |
  ["axe", {"name": "alt-text-scan", "package": "@github/accessibility-scanner-alt-text-plugin", "version": "1.0.0"}]

Only allowlisted first-party NPM plugins are loaded, and package lifecycle scripts are disabled during installation.

Full Changelog: v3.3.0...v3.4.0

v3.3.0

What's Changed

New Features

• Add group_by option to the accessibility scanner by @taarikashenafi in #239
• Add dry_run option to the accessibility scanner by @taarikashenafi in #232
• Distinguish wcag vs best practice by @kzhou314 in #233
• Match axe findings by rule and report all failing elements by @kzhou314 in #240
• Disable reopen wontfix by @kzhou314 in #234
• Update reflow-scan text to improve clarity and reference WCAG 2.2 by @taarikashenafi in #231

Dependency/documentation updates

• chore(deps): Bump ruby/setup-ruby from 1.307.0 to 1.308.0 in the github-actions group across 1 directory by @dependabot[bot] in #218
• chore(deps-dev): Bump the npm-minor-and-patch group across 5 directories with 3 updates by @dependabot[bot] in #219
• chore(deps): Bump ruby/setup-ruby from 1.308.0 to 1.310.0 in the github-actions group across 1 directory by @dependabot[bot] in #220
• chore(deps): Bump puma from 8.0.1 to 8.0.2 in /sites/site-with-errors in the bundler-minor-and-patch group by @dependabot[bot] in #221
• chore(deps): Bump ruby/setup-ruby from 1.310.0 to 1.311.0 in the github-actions group across 1 directory by @dependabot[bot] in #225
• chore(deps): Bump ruby/setup-ruby from 1.311.0 to 1.313.0 in the github-actions group across 1 directory by @dependabot[bot] in #227
• chore(deps-dev): Bump vite from 8.0.12 to 8.0.16 by @dependabot[bot] in #228
• chore(deps-dev): Bump @types/node from 25.9.0 to 26.0.0 by @dependabot[bot] in #236
• chore(deps-dev): Bump undici from 6.24.1 to 6.27.0 by @dependabot[bot] in #237
• chore(deps): Bump the github-actions group across 4 directories with 2 updates by @dependabot[bot] in #235
• chore(deps): Bump concurrent-ruby from 1.3.5 to 1.3.7 in /sites/site-with-errors by @dependabot[bot] in #238

New Contributors

• @taarikashenafi made their first contribution in #231
• @kzhou314 made their first contribution in #234

Full Changelog: v3.2.0...v3.3.0

v3.2.0

What's Changed

New Features

• Add url_configs input to skip CSS selectors per URL from Axe scan by @Copilot in #213

Dependency/documentation updates

• chore(deps): Bump puma from 8.0.0 to 8.0.1 in /sites/site-with-errors in the bundler-minor-and-patch group by @dependabot[bot] in #207
• chore(deps): Bump ruby/setup-ruby from 1.302.0 to 1.306.0 in the github-actions group across 1 directory by @dependabot[bot] in #208
• chore(deps): Bump the npm-minor-and-patch group across 5 directories with 3 updates by @dependabot[bot] in #209
• Update PLUGINS.md with workflow setup instructions by @lindseywild in #211
• chore(deps): Bump the npm-minor-and-patch group across 2 directories with 3 updates by @dependabot[bot] in #214
• chore(deps): Bump ruby/setup-ruby from 1.306.0 to 1.307.0 in the github-actions group across 1 directory by @dependabot[bot] in #215
• chore(deps): Bump the npm-minor-and-patch group across 5 directories with 4 updates by @dependabot[bot] in #216

Full Changelog: v3.1.0...v3.2.0

v3.1.0

What's Changed

New Features

• Support TypeScript plugins in find plugin manager via esbuild by @Copilot in #187

Dependency/documentation updates

• chore(deps): Bump ruby/setup-ruby from 1.300.0 to 1.301.0 in the github-actions group across 1 directory by @dependabot[bot] in #192
• chore(deps-dev): Bump typescript from 5.9.3 to 6.0.2 in /.github/actions/fix by @dependabot[bot] in #197
• chore(deps-dev): Bump typescript from 5.9.3 to 6.0.2 in /.github/actions/find by @dependabot[bot] in #196
• chore(deps-dev): Bump typescript from 5.9.3 to 6.0.2 in /.github/actions/file by @dependabot[bot] in #195
• chore(deps-dev): Bump typescript from 5.9.3 to 6.0.2 in /.github/actions/auth by @dependabot[bot] in #194
• chore(deps): Bump the npm-minor-and-patch group across 5 directories with 6 updates by @dependabot[bot] in #199
• chore(deps): Bump puma from 7.2.0 to 8.0.0 in /sites/site-with-errors by @dependabot[bot] in #191
• chore(deps): Bump ruby/setup-ruby from 1.301.0 to 1.302.0 in the github-actions group across 1 directory by @dependabot[bot] in #204
• chore(deps): Bump the npm-minor-and-patch group across 5 directories with 4 updates by @dependabot[bot] in #205

Full Changelog: v3.0.1...v3.1.0

v3.0.1

What's Changed

New features

• Add optional base_url input to support GitHub Enterprise Octokit endpoints by @Copilot in #176

Dependency/documentation updates

• Updates find, file, fix action READMEs to include changes to the inputs/outputs. by @lindseywild in #181
• chore(deps): Bump rack from 3.2.5 to 3.2.6 in /sites/site-with-errors by @dependabot[bot] in #183
• chore(deps): Bump ruby/setup-ruby from 1.299.0 to 1.300.0 in the github-actions group across 1 directory by @dependabot[bot] in #184
• chore(deps-dev): Bump vite from 7.3.1 to 7.3.2 by @dependabot[bot] in #185
• chore(deps): Bump addressable from 2.8.7 to 2.9.0 in /sites/site-with-errors by @dependabot[bot] in #186

Full Changelog: v3.0.0...v3.0.1

v3.0.0

What's Changed

Important

Reference the Accessibility Scanner action using:

uses: github/accessibility-scanner@v3

See the README for further details and examples.

BREAKING CHANGES

Warning

The Find action’s findings output was replaced with findings_file in v3.0.0. If you use the findings output, please migrate to the new findings_file output.

The File action’s findings and cached_filings inputs were replaced with findings_file and cached_filings_file. The filings output was replaced with filings_file in v3.0.0. If you use those inputs or outputs, please migrate to the new file action's inputs/output.

The Fix action’s issues input was replaced with issues_file. The fixings output was replaced with fixings_file in v3.0.0. If you use that input or output, please migrate to the new fix action's input/output.

Writing to and reading from file content instead of directly passing a findings string (which can be a large JSON object) prevents maximium system argument size errors.

• Replace github-script with file-based approach to avoid large JSON output max limit by @lindseywild in #177
• Replace JSON string I/O with file-based approach in find, file, fix actions by @lindseywild in #179

Full Changelog: v2.12.0...v3.0.0

v2.12.0

What's Changed

Features

• Adds reflow scan plugin by @lindseywild in #173

Full Changelog: v2.11.0...v2.12.0