Release Notes

New and Improved

• A live Visual Scanner Progress. The panel used to show a still snapshot after each page loaded. It now shows a live view of the scanning browser, updating up to eight times a second as pages load and scroll, with a LIVE badge while the feed is running. When the view is narrower than the panel, such as a phone, a soft blurred copy fills the space either side. It runs only while the panel is open, never adds lines to the activity log and returns after you reload the interface or open a second window.
• Local LLM Review. An optional feature, off by default, that asks an LLM you run on your own computer or local network for a second opinion on axe-core findings, and suggests issues axe-core can't detect in a new LLM Review section, each with a screenshot and ticket. With a vision model it also reviews screenshots. Only local models are supported, and day to day Octopus Scanner still uses no AI. The Activity Log says for each page and rule whether the model confirmed an issue, flagged a likely false alarm or suggested a new one, and ends with a summary.
• What Local LLM Review looks for. Under Categories, choose what it checks. Page Content covers text alternatives, link and button text, headings and labels, forms, page titles, language, sensory instructions, reading order, consistency and captions. Visual checks text over images, use of colour, images of text and non-text contrast from screenshots. Both are on by default.
• Focus Visible and Form Errors. Two Interaction categories, on by default. Focus Visible presses Tab through each reviewed page to find focus stops with no visible focus indicator, and never presses Enter or Space. Form Errors checks that form errors are identified and explained, without typing, submitting or sending anything. Both make the review take longer.
• Find your LLM server. Find Servers looks for LLM servers on this computer, and Search Local Network, after asking you first, looks on other devices on your local network. Select Use to fill in the server, Base URL and models. Your API key is never sent while searching.
• Your LLM API key is protected. The key is saved in a file only your account can read, used only with the server it was saved for and never stored in saved configurations. Forget Saved Key removes it, and the pre-scan warning is acknowledged separately for each LLM server.
• Monthly component updates. Octopus Scanner is now maintained every month through updates to the components it runs on, including Node.js and the axe-core engine, which you install from inside the app. Component Update Notifications are on by default, and the app itself is only updated when a fix or feature can't come through component updates.
• Review licences before updating components. Before you install updated dependencies, a newer Node.js runtime or a new axe-core engine, Octopus Scanner now lists each component with its licence and a link to view it, and asks you to accept the licences before anything is downloaded.
• Safer waiting periods. Dependency and Node.js updates are only offered once they have been public for at least 14 days, the recommended default, with 7 and 30 days also available. axe-core engine updates are offered as soon as they are released. Each update is verified before it is installed, dependency updates are also checked for known malware and you can revert at any time.
• Updating no longer marks Octopus Scanner as unsupported. Installing component updates is now the normal, recommended way to stay current. The Unsupported label is gone from the app and reports, and Report Bug and Export Bug Data are always available.
• Clearer update screens. The update screens explain the safety checks, note that antivirus software may briefly scan new components while they install and the out-of-date reminder now only appears when component updates are turned off.
• Updates download inside the app (Mac and Windows). Download Update now downloads the new version with progress and a Cancel button, checks it against signed release information and its checksum, then opens the installer or disk image. If the release information can't be verified, the Mac app opens the download page and the Windows app shows Couldn't check for the update, with Try Again and Continue.
• Unverified updates are never opened (Mac and Windows). A download that is cut off, the wrong size or fails its check is deleted, and the app offers Try Again and Product Page, which opens the download page.
• Octopus Scanner now uses OctopusScanner.com. The update check, Download buttons, help, privacy, terms, licence and release notes links, report footer links and the Support fallback now go to OctopusScanner.com instead of itch.io. If the website can't be reached, the legacy itch.io page is only used to show the latest version number, and updates are never offered from it.
• Donations now go to Buy Me a Coffee. The Donate dialog now opens the project's Buy Me a Coffee page, and its button reads Open Buy Me a Coffee.
• New support email address. Report Bug and the other contact links now use support@octopusscanner.com.
• Record Journey asks before replacing steps. Starting a recording used to delete the journey steps already entered. It now asks first, and Cancel keeps your steps.
• Deleting a report can also delete its CSV. Companion CSVs now share their report's name. Deleting a report from Past Reports asks whether to delete its CSV too, and Remove Reports clears companions with their reports.
• Fuller Axe rule list. The rule list now includes 25 missing rules, among them Target Size, Region and ARIA Prohibited Attribute. Rule search also matches rule IDs and US spellings.
• Newer device presets. There are new presets for the iPhone 17 range and iPhone Air. The iPhone 16 and Google Pixel 9 presets now scan at their real sizes instead of quietly using desktop size, and an unknown device shows a warning. Android presets now identify as the Chrome version the scanner uses, as a real Android phone does.
• Easier-to-read text. The app and its reports now use Atkinson Hyperlegible Next, the typeface on OctopusScanner.com, designed by the Braille Institute for readers with low vision. It is built in, so it also works offline and in shared reports, and each report's footer credits the font and its licence.
• Always Show Descriptions (Mac and Windows). A new setting under Theme, in Preferences and Getting Started, shows each setting's description all the time instead of when you hover over or select it. Off by default.
• Dates in your format. Report dates, and the dates in the list of past reports, now follow your computer's region settings. On a Mac set to the UK, they were shown in US format.
• A steady title. The scanning interface title no longer changes language every minute. It always reads Octopus Scanner, and is no longer a button.
• Richer PDF checks. Check PDFs now runs thirteen checks on each PDF, from tags and title to image alternative text, headings, form fields, links and bookmarks. Each PDF appears as a card in the renamed PDF Checks section. Each issue shows its WCAG criterion and how to fix it, opens as a PDF Ticket and appears in CSV and JSON reports. PDFs that download instead of opening are checked too.
• Skipped pages by category. Each skipped page now has a category, such as Bot protection, HTTP error, Sign-in required or Caps and duplicates, and buttons in Skipped Pages show one category at a time. CSV reports now list skipped pages, and JSON reports and Export Coverage include each category.
• Restart Scanner (Mac and Windows). If the scanner stops, Restart Scanner starts it again without quitting the app. On Mac it appears in place of Open Interface, beside System Activity and on the startup screen and as File > Restart Scanner (⌘R). On Windows it appears next to Open Interface and in the tray icon's menu, and Alt+R selects it.
• Idle Screen and other apps (Mac). Two new Idle Screen settings: Don't Show Over Full-Screen Apps, on by default, and Don't Show While Apps Keep the Display Awake, off by default.
• Notes on unavailable settings. Greyed-out settings now show a short note explaining why they can't be used, and what to change where there is a choice.
• Security fixes are clearly marked. Dependency updates that fix a high or critical security advisory for the installed version are now marked Security fix, name the advisory and are counted in the update notice. Octopus Scanner checks the new version against osv.dev to confirm the fix. Node.js updates that include a security release say so too.
• Allowlist Header. A new optional setting under Advanced Options adds a header with a secret value of your choosing to every request to the website you're scanning, so its team can let the scan through their firewall or bot protection. It is never sent to other websites, even after a redirect, and the value isn't saved with your settings or shown in logs and reports.

Privacy and Security

• More secrets hidden from logs and reports. Sign-in tokens, signatures and session IDs in more forms of web address are now hidden in the Activity Log, reports and exported settings, including addresses recorded in a User Journey.
• The scanner can't be taken over by other programs (Mac and Windows). Another program on your computer could ask the scanner's Node.js process to open a debugging connection. The scanner now refuses, and settings that change how Node.js loads are kept out of every process the apps start.
• Reports from elsewhere open in a safe mode. A report file that Octopus Scanner did not create, for example one copied into the Reports folder, now opens in a restricted mode where it can't reach the scanner or your settings. Reports made by the app work as before.
• Updated Node.js is checked at every start (Mac and Windows). An updated Node.js runtime is now checked for the Node.js signature each time the scanner starts, not only when it is installed. If the check fails, the bundled runtime is used.
• Stronger app protection (Mac). The app now uses the macOS hardened runtime, and the bundled Node.js keeps its own Node.js signature. Settings in your environment that change how Node.js or system libraries load are no longer passed to the scanner.
• Interface window hardening (Windows). The interface window now refuses camera, microphone and location requests, only loads frames and downloads from Octopus Scanner itself and limits how many browser tabs or windows a page can open at once.
• Private network protection works with your proxy. When you set a proxy, scans of public websites still check every connection, including robots.txt, sitemap and PDF requests, against private network addresses before it reaches the proxy, so a site can't use it to reach your network. The username and password in the proxy address are now used for page traffic too. If the check can't start, the scan stops.
• Proxy shown before a scan. If a proxy server is set, for example by an imported configuration, the warning before a scan now shows it.
• Private data folder (Mac). The Octopus Scanner data folder is now readable only by your user account.
• Organisation check only on request (Windows). The Windows app read the computer's work or school organisation ID at every launch, even if you had never asked for the check. It now reads it only after you start the check yourself and accept the screen that explains it.
• Deep Scan could click destructive buttons and submit forms. On a signed-in scan, Deep Scan could press buttons such as Log out, Delete account or Place order, or submit forms, changing data on the site. It now skips any control that suggests logging out, deleting, paying, buying or submitting, and never presses a form's submit or reset button.
• Pop-up dismissal could click risky buttons. When closing cookie banners and pop-ups, Octopus could click buttons such as Close account or Accept invitation. It now only selects buttons inside pop-ups and banners, finds banners built as web components and skips the same risky buttons as Deep Scan, such as Send and Sign up.
• Passwords and sign-in details in logs. Proxy passwords, values a journey stores between its own steps and sign-in tokens after the # in addresses could appear in the activity log or reports. These are now hidden.
• Passwords and sign-in details in configurations. Passwords and sign-in tokens written into addresses, such as the Proxy Server URL, Website URL, Login URL, Sitemap XML URL or Go to URL steps, were kept in exported configurations, and running Setup again could save Sensitive Values. These are now removed, and steps that type into password fields are treated as sensitive automatically.
• Reports showed local folder paths. HTML reports, their JSON exports and Interactive Mode JSON reports listed screenshots by their full path, including your user folder. Only file names are now included.
• Handle Trusted Types could not be fully turned off. The setting only affected some pages. It now applies to every page Octopus opens, including journeys, the login page and Interactive Mode.
• Sign-in details in report addresses. Usernames, passwords and sign-in tokens in page addresses could appear in HTML, CSV and JSON reports, PDF results, error messages and skip reasons. They are now hidden everywhere.
• Safer report pages. Reports opened from the app now carry extra security settings that stop them sending forms or loading plug-ins.
• Websites could make the scanner read PDFs on your computer. With Check PDFs on, a website that linked to a PDF on your computer made the scanner open it and show its title in the report. Web scans now never open files on your computer.
• Links in reports could run scripts. A link with an unsafe address, for example one found during a local file scan, could run script when clicked in a report. Report links now only open web addresses and local files.
• Pages could add files to reports. A scanned page could make the report include a file from your computer as a screenshot. Screenshots, including those copied beside a report or zipped, now only come from the scanner's own folders.
• Component security fixes. body-parser and zod are updated to the versions that fix their reported denial-of-service issues.
• Local network names are blocked on public scans. Single-word names and names ending in .local, .lan or .internal are now treated as local addresses, including when you use your own proxy.
• WebRTC can't reach your network. On scans that start on a public website, the scanning browser can no longer send WebRTC traffic directly to devices on your network.
• Proxy passwords stay out of sight. A username and password in a proxy address are no longer put on Chrome's command line, where other programs could see them, or written into the report's settings.
• Local file scans stay in their folder. A shortcut or link inside a local site folder can no longer point the scan at files outside it.
• Scanned pages can't imitate the apps' messages. Text from a scanned site can no longer show in the status line, trigger the low-memory notice or count towards achievements.
• Scanned pages can't hide fake app messages in hidden characters. Text from a scanned site can no longer use invisible control codes to slip messages past Octopus Scanner, so it can't end a scan early, start the shutdown countdown or reopen the interface.
• Sign-in cookies and redirected PDFs. When a PDF redirected to another website, the scanned site's cookies could be sent along with it. They are now kept to the original site.

Scanning

• Pages checked in light mode. On a computer set to dark mode, pages were scanned in their dark theme, so issues that only appear in light mode could be missed. Pages are now always scanned in light mode first, and Scan Dark Mode still checks the dark theme separately.
• robots.txt errors are respected. If a site's server fails when asked for robots.txt, or robots.txt can't be reached after a second try, the site is now treated as off-limits, as the robots.txt rules require, and the Activity Log explains how to scan it anyway. A very large robots.txt is read up to 512 KB, with a warning.
• Pages past the crawl limit are listed. Pages found after the scan reached Max Crawl Size, or when the list of pages waiting to be scanned was full, now appear under Skipped Pages as Crawl limit reached, instead of disappearing.
• Fewer duplicate and merged pages. Tracking parameters in any letter case no longer cause a page to be scanned twice, and pages that differ by parameters such as next or ref are no longer merged into one.
• Exclude patterns can't freeze a scan. Some regular expressions in Exclude URL Patterns, including ones with several wildcards, could take so long to check on long addresses that the scanner stopped responding. Risky ones are now matched as plain text, and regular expressions are only tested against the start of each address.
• A rule in the Axe rule list broke every scan. Choosing "Video Description", which the bundled Axe no longer has, made every page fail. It has been removed, and Octopus now ignores any rule the current Axe version does not recognise. If every chosen rule is unknown, your selected rule sets are used instead of every rule.
• Pause, Cancel and Finish Early now work as described. In parallel scans and URL lists, Pause carried on scanning, cancelled scans still wrote a report and long pauses could resume on their own. Scans now stop at the next page, stay paused until resumed and stop without a report when cancelled. Finish Early & Scan works for URL lists, builds the report from pages already scanned and still retries pages that were being scanned when you selected it.
• Exclude patterns did not match. /admin/* did not exclude /admin/users, ? acted as a wildcard, and /admin/ excluded any address containing "admin". Patterns now match anywhere in the address, and * is the only wildcard.
• Max Crawl Size counts only scanned pages. Excluded, out-of-scope and duplicate pages, error pages, files and pages retried after a crash could count towards Max Crawl Size and the pagination and section limits, and pages linked twice, such as /about and /about/, were scanned twice. Only scanned pages now count, each page is queued once and a scan reaches the number of pages you set.
• www and http redirects. A redirect to www could stop the crawl after one page, and robots.txt on the other address was ignored. www and non-www, and http and https, are now treated as one site, each following its own robots.txt.
• Scope could spread to other sites. shop.example.co.uk was treated as related to any other .co.uk site, and sitemaps could pull in unrelated websites. Only the site being scanned and its subdomains now count.
• Sitemap fixes. Addresses with more than one parameter now load correctly. Sitemaps on a separate address no longer drop every page, very large sitemaps no longer fail and a second plain text sitemap is now read.
• Addresses changed before loading. Octopus removed some parameters and trailing slashes, so some pages loaded the wrong content. Addresses now load as written apart from tracking parameters such as utm_source, and /About and /about are treated as different pages.
• Real pages skipped as errors. Pages with words such as 404 or oops in their title, or numbers like 14045 in a redirected address, could be skipped. Only clear not-found pages are now skipped, the site's first error page is scanned so its design is checked and pages you list, sitemap pages and the start page are always scanned.
• Pages with a canonical address. A page pointing to a canonical version could be skipped even when that version was never scanned, including after a tab crash or with Parallel Processing off, and meta refresh pages in parallel scans could be left out. A page is now only skipped once the version it points to has been scanned.
• Parallel scans lost pages. Slow pages timed out without a retry, scans ended after 30 minutes however much was left and Scan Specific URLs also scanned sitemap pages. Pages now get time for each viewport and are retried, scans only end if nothing finishes for 30 minutes and only listed URLs are scanned. Parallel scans also apply the same download and network protections as other scans.
• Delays and timeouts not applied. Adaptive Networking delays and longer timeouts after a timeout were logged but never used, and Crawl-delay could come from another crawler's rules. These now apply as described, with Crawl-delay capped at 30 seconds and Wait for Time at two minutes.
• Scans stopped too early. Scans over an hour old with no window watching were stopped, and sites addressed by IP number, intranet names or a VPN paused with "Connection lost". Scans now only stop after an hour without activity, and these sites scan normally.
• Scans that hit an error lost their results. An error part-way through produced no HTML report, and failed CSV and JSON scans said they were complete. Octopus now builds a report from the pages scanned and notes the error.
• Issues shown under the wrong severity. When an issue was confirmed in one page state but only needed review in another, real failures could appear as Needs Review. Confirmed failures now take priority.
• Tagged PDFs reported as untagged. Many properly tagged PDFs were reported as untagged. Octopus now reads compressed PDF structure, and the 10 MB size limit applies consistently.
• Web components. Screenshots of elements inside web components could show the wrong element, and Deep Scan could not open controls inside them. Both now work.
• Journeys and sign-in. Journeys through a single sign-on page failed on replay, recorded clicks could land on the wrong element and scanning several viewports reloaded the page and lost what the journey had opened. These now work.
• Interactive Mode fixes. Interactive Mode now uses your chosen device and viewport, its panel works on sites with strict security policies and no longer disappears when the page changes and Cancel closes its browser.
• Other scanning fixes. Attempt to Dismiss Overlays finds icon-only close buttons. Disable GPU Acceleration applies to the recording and Interactive Mode windows. Closed accordions are checked whether or not screenshots are on. If the part of the page set to be scanned can't be found, the whole page is scanned.
• Cancel and Finish Early during sitemap discovery. While sitemaps were still being read, Cancel Scan and Finish Early & Scan were ignored. They now stop the scan straight away.
• Two scans at once. A new scan could start while the previous one was still building its report. Start Scan now waits until the report is finished.
• Pages that never finish loading. A page that never finished loading could stall a scan for several minutes, and its other viewports could fail. Octopus now moves on after a short wait and scans every viewport.
• Pages that ask before you leave. Pages that show a "Leave site?" prompt could only be scanned in one viewport and could block the next page. They are now scanned in every viewport.
• Pages blocked by robots.txt. Pages found while crawling that robots.txt asks scanners to avoid were left out without a mention. They are now listed under Skipped Pages with the reason.
• Faster Per Instance screenshots. A page with thousands of issues could take over 18 minutes with no sign of progress. Per Instance screenshots are now limited to 50 per issue type on each page, the report notes where this applies and the Activity Log shows progress while screenshots are captured.
• Very large pages. Pages with tens of thousands of elements and no frames scanned slowly and reported a false frame error. They now scan quickly.
• Sitemap Timeout and Request Timeout. These settings had no effect. They now apply.
• Folders entered as the address. Entering a folder instead of a file scanned the folder listing. Octopus now asks for the path to an HTML file.
• Redirects to other websites. Links that redirected to another website were scanned and reported as part of your site. They are now listed under Skipped Pages with the address they redirect to.
• Closing pop-ups clicked links. When closing cookie banners and pop-ups, Octopus could click an ordinary link whose label mentioned "close", and report the wrong page. It now only clicks real close buttons and returns to the page if anything navigates away.
• Sites with huge sitemaps. Small scans of sites with millions of sitemap addresses could spend minutes reading sitemaps and use several gigabytes of memory. Octopus now stops reading once it has enough addresses, and a single sitemap over 20 MB is left out with a message.
• Scans that froze on some sites. Some sites with very large scripts made the browser stop responding, and a crashed browser tab could hold up a scan for up to 10 minutes. Scans now move on within seconds, and the affected page is scanned again or listed as an error.
• Scans that stopped unexpectedly. An occasional slow response from the browser could end the scan with no report. The scan now carries on.
• Script addresses listed as skipped pages. Addresses of scripts on other websites, such as video players, were listed under Skipped Pages. They are now ignored.
• Browser tab crashes. A crashed tab could hold up a scan for several minutes, double a page's issue counts and CSV rows when it was retried or leave a retried page skipped as already scanned or listed as an error. The page is now retried straight away, saved once and listed as an error only if it fails again.
• Pages wrongly reported as bot protection. Short 404 pages, server errors, 401 and every 403 response were reported as bot protection, and sign-in pages with reCAPTCHA or titles such as "Security check-up" could be skipped. They now show their HTTP error, a plain 403 shows as Access denied (HTTP 403) and only real challenge pages are reported as blocked. When a site blocks every page, the result says so.
• Pagination cap skipped real pages. Any address with a query string counted towards the pagination cap of 3 per path, so sites that use addresses such as ?p=12 or ?id=12 for their pages lost most of them. Only pagination, filter and sort parameters now count, and an address with a single number is scanned as its own page.
• More natural Stealth Mode. Stealth Mode now presents each scan as an ordinary copy of Chrome on your computer, with a user agent, browser hints, language and screen size that agree and stay the same on every page. It varies the pause between pages, sends the linking page and visits the home page first so the site can set its cookies. It no longer alters canvas drawings, audio or the time zone.
• Waiting when a website asks. When a website says it's too busy, the scanner waits as long as it asks, up to 30 seconds, and tries again, or tries the page later in the scan if it asks for longer. Pages still refused are listed as rate limited with the requested wait, instead of as bot protection.
• Bot protection checks. When a page shows a bot protection check, such as Just a moment…, the scanner now gives it up to 15 seconds to finish and then scans the real page, instead of auditing the check page. If checks keep failing on a website, it stops waiting for them and lists those pages as skipped.
• Needs Review kept apart from confirmed issues. Needs Review items and confirmed issues for the same rule were combined, so whichever page was read first decided how the whole rule was shown and counted, and one confirmed failure on a page hid that page's other Needs Review items for the rule. They are now listed separately.
• Pages with similar addresses. Pages whose addresses differed only by a hidden value, such as ?state=, were merged into one in reports, and pages that differed only by values such as ?v=, ?release= or ?variant= were treated as one page. Each is now scanned and listed separately, and print, AMP and preview versions such as ?print=1 are scanned as the normal page.
• Sections skipped as files. Pages under paths such as /video/, /apps/, /model/ and /v2/ were skipped as if they were files. They are now scanned.
• Sections treated as languages. Sections with two-letter names, such as /hr/ or /it/, were capped at 5 pages as if they were translations, and with Parallel Processing the site's main language could be capped if another language loaded first. Only real language folders are capped now, and the main language is taken from the start page.
• Redirects to other subdomains. One link that redirected to another subdomain, such as a help centre, added that whole subdomain to the scan, and its robots.txt could set the delay for the whole scan. Only the same website is added now, unless the start address itself redirects to the other subdomain.
• Coverage caps. Sitemap pages were trimmed with the default section and address-pattern limits even when you raised them, and pages retried after a browser problem could be skipped by a cap they had already passed. Both now follow your settings.
• Pages beyond capped lists. Pages linked only from later pages of a list, such as page 3 of a blog, were never found. Links on list pages over the pagination cap are now followed without scanning those pages.
• Faded text. Text faded on purpose, for example to half opacity, was shown at full strength before checking, which hid real contrast failures. Only content caught part-way through an animation is made fully visible now, and animations finish instantly instead of jumping back to their start.
• Block Analytics Trackers. Scanning the website of an analytics company, such as hotjar.com, blocked every page. Trackers are now matched by their own addresses, the website you're scanning is never blocked, more trackers are covered and services that show visible content are no longer blocked.
• The scanner always uses its own accessibility engine. On some pages the scanner used a copy of axe-core shipped by the website, or couldn't load its own because of the page's security policy. It now always loads its own copy.
• Obsolete duplicate ID rules. Two duplicate ID rules, which WCAG 2.2 marks as obsolete, were always switched on. They no longer run unless you choose them.
• Invalid excluded selectors. An excluded element selector that wasn't valid CSS made every page fail. It is now ignored with a warning.
• robots.txt and Crawl-delay. robots.txt rules written for OctopusScanner were ignored, and with Parallel Processing each worker waited the Crawl-delay separately. Both now work, and the workers share one delay.
• Finish Early and PDFs. Finish Early didn't stop the PDF checks, and with a crawl delay set it skipped every PDF after the first. If you finish early while pages are being scanned, every PDF already found is now checked. If you finish early during the PDF checks, the rest are skipped and listed as not checked.
• PDF checks. PDFs could wrongly fail with no text layer, and PDFs re-saved in an editor could be read as their old version. Both are read correctly now. PDFs from other websites are no longer checked, a scan checks up to 500 with the crawl delay between them, PDFs behind a sign-in are checked while signed in and downloads stop at 10 MB.
• Pop-up windows forced open. Hidden modal windows from some website frameworks were forced open while revealing hidden content, covering the page in results and screenshots. Dialogs are now left closed.
• Blocked mobile retries. When a viewport was blocked and retried, the block page could be scanned and reported as that viewport's results. It is now listed as an error instead.
• Dark themes found more reliably. Scan Dark Mode now finds a dark theme from the page's style sheets as well as by comparing colours, so themes applied to other parts of the page are scanned.
• User Journey playback. Steps waited a fixed 1 to 2 seconds, and a Go to URL step after a click reloaded the page, which could cut off a slow sign-in. Steps now wait until the page settles, the reload is skipped, "Are you sure?" pop-ups are accepted, a step that has run is never repeated and only a tab opened by the step is followed.
• Journeys after a Scan Page step. After scanning a mobile viewport, the rest of a journey ran as a phone, and content revealed for the scan stayed open, which could block later clicks. The window size, browser identity and hidden content are now restored after each Scan Page step.
• Journey recording. "Are you sure?" pop-ups were cancelled automatically while recording. They now appear for you to answer, sign-in return addresses are no longer recorded as steps and a slow start page no longer ends the recording.
• Sign-in kept after a browser restart. If the browser restarted during a signed-in scan, for example after a crash, the rest of the scan ran signed out. The sign-in now carries over, and a slow sign-in page no longer ends the scan.
• Interactive Mode. Iframes from the same website weren't scanned, closing the Chrome window on a Mac left the session open and a slow first page closed the session. All three are fixed, and issues inside iframes now point to the right element in screenshots and selectors.
• User Journeys and overlays. Attempt to Dismiss Overlays could close a dialog the journey had just opened, or reload the page and lose the journey's progress. It is no longer used during User Journeys, and content the scanner shows for a scan step is put back before the next step.
• Scan Specific URLs ignored the crawl delay. Without Parallel Processing, a list of Specific URLs was loaded back to back and the page count stayed at 0. It now waits for Crawl Delay between pages and shows its progress.
• Language versions. On sites where every page has a language prefix, such as /en/ and /de/, a sitemap could make the wrong language the main one, which limited pages in the site's own language. The main language now comes from the scan address.
• Pop-up windows. A page that kept opening new windows could fill memory until the scan failed. New windows that open without a click are now blocked, and the number of open windows is limited.
• Very large sitemaps. Sitemap indexes could load hundreds of sitemaps at once and run out of memory. Sitemaps are now read four at a time with a size limit, and only the first 50 sitemaps listed in robots.txt are used.
• Freezes on unusual files. Some unusual PDFs and very large pages whose links were collected without a full scan could freeze the app for minutes. These are now handled quickly. A PDF that never finished downloading could also stop the scan finishing or being cancelled. It now times out after 45 seconds.
• Pop-up windows during crawls. Windows opened by pages, for example after a Deep Scan click, stayed open and kept running for the rest of the scan. They are now closed straight away, except during User Journeys and sign-in.
• Timeout messages. When robots.txt, a sitemap or a PDF took too long to arrive, the message said the request was refused. It now says it timed out.
• Memory running low. After memory ran low, PDFs were still downloaded and checked, which could use up the rest. They are now skipped and listed as not checked.
• Damaged PDFs. A damaged PDF could make Octopus Scanner stop responding for over 30 seconds or count the wrong number of pages, giving false results such as missing bookmarks. It now gives up within a few seconds and reports that the PDF couldn't be checked.
• Interactive Mode counted issues twice. Scanning the same page again in Interactive Mode doubled its issue counts and repeated its rows. A repeat scan now only adds elements that weren't found before, and a screenshot from one page no longer replaces another page's.
• PDFs listed in sitemaps. With Check PDFs on, PDFs listed only in a sitemap weren't checked. They are now.
• Large PDFs reported as untagged. A PDF too large or complex to finish checking was reported as not tagged. It now says the check couldn't be finished.
• Closing the recording window (Mac). Closing the recording window blocked new recordings for up to 30 minutes. It is now noticed straight away.
• Timeouts through a proxy. With a proxy set, a slow robots.txt, sitemap or PDF was reported as a proxy failure. It now says the request timed out.
• Browser crash during PDF checks. A browser crash while PDFs were being checked turned the whole scan into a critical error. The scan now finishes, and the remaining PDFs are listed as not checked.
• Very large custom devices. Custom Device width and height are now limited to 8,000 pixels.
• Cancelling a finished scan. Selecting Cancel just as a scan finished could mark the finished scan as cancelled. It no longer does.
• Scans can't open your local network by also listing an internal address. A public site whose name points to both a public and an internal address no longer switches off the local-network block. Only a start address that points entirely to your own computer or local network turns it off.
• Server Port already in use. If another program is already using the Server Port, the scanner now stops with a message saying so, instead of starting anyway.
• Page text can't imitate the app's own messages. A scanned page's text in the log can no longer copy the message the app uses to open the interface.
• Pause can't land after a cancel. A pause that finished after the scan had been cancelled no longer reports success.
• Internal sites can't be swapped mid-scan. When a scan starts on an internal site by name, the scanning browser now stays on the address that name had at the start, so a site that changes its address can't reach the rest of your local network.
• Interactive Mode and journey recording stay out of your local network. The browser for Interactive Mode and for Record Journey now goes through the same address check as a normal scan when it starts on a public website, including connections the earlier check missed.
• Blocked-address warnings are limited. A site that tries hundreds of internal addresses no longer floods the activity log with warnings.
• Hostile robots.txt files and link floods can't stall a scan. robots.txt is read up to 512 KB, each page adds at most 5,000 links and very long addresses are ignored, so a site can't freeze the engine or run it out of memory.
• Pages you list are always scanned. With Parallel Processing off, addresses you list are no longer skipped as duplicates, crawler traps or error-page patterns, matching the parallel scan.
• Interactive Mode keeps the report link. If the connection drops while the report is being built, reconnecting still shows the link.
• Hostile robots.txt files can't slow a scan down. Overly complex robots.txt rules are ignored and each address is only checked once, so a site can't stall the scanner.
• Pages skipped after signing in. With Persistent Session on, a page the browser had already saved could be skipped with "HTTP Error 304" on the next scan, so nothing was scanned. Those pages are now scanned normally.
• Clearer message when robots.txt blocks a scan. When the address you entered is blocked by the site's robots.txt, the results now say so and explain how to scan it if you have permission, instead of only saying no pages could be loaded.
• PDF checks on websites. Linked PDFs could all be reported as untagged because the browser's PDF viewer was checked instead of the file. The PDF itself is now checked.
• Deep Scan counted issues twice. Issues already found on a page were counted again after each click. Each issue is now counted once, and accordions no longer cause a false aria-hidden-focus failure.
• More scanning fixes. Scan Specific URLs no longer scans error pages or PDFs as web pages, redirects into excluded or robots.txt-blocked pages are skipped, sitemaps using prefixed tags are read, scans with Persistent Session keep you signed in on every page and Deep Scan respects Pause and Cancel.
• Deep Scan and User Journeys. Deep Scan is no longer used during User Journeys, because clicking could undo steps the journey has completed. A note explains this in Scan Behaviour.
• Sites on localhost. robots.txt, sitemaps and PDFs on sites served from localhost could be ignored. They are now read.

Reports

• Clearer ticket descriptions. A ticket's Issue Description now says what was found and what is required, for example "It has been identified that 12 buttons on 6 pages have no name that a screen reader can announce. Buttons must have discernible text, such as a visible label or an aria-label." It no longer repeats the ticket title.
• A clearer report summary. The summary now reads as three paragraphs. The first describes what was scanned: the website, the viewport sizes, how many pages were scanned and against which rules, linked PDFs and Local LLM Review when used, and any pages that were skipped. The second describes what was found: unique issue types by severity, total instances, the share of issue types of major severity and the number of checks that passed on every page. The third names the most critical issues and the most common issue by instance count.
• Searching by WCAG number. Searching a report for a success criterion such as 1.4.3 now finds the matching issues.
• Very large reports open reliably. On scans that find hundreds of thousands of pages, the report listed every skipped page, which could make it too large to open and leave a blank window. It now lists up to 500 skipped pages in each category, with the total and a pointer to the companion CSV, which still lists every page. The loading screen also appears straight away instead of after a long blank wait.
• Complete CSV exports. When a report is open from Octopus Scanner, Export as CSV and Download Instance List (CSV) now include every instance, even for rules where the report keeps only a sample, and keep any severity you changed. A report opened straight from its folder in a browser still lists the sample and says where the full list is.
• Issues inside embedded content. When an issue is inside content embedded from another website, such as a YouTube video, the screenshot now outlines the whole embed instead of showing no highlight.
• Bug data lists viewports. Export Bug Data now records which viewports were scanned.
• Top 5 lists no longer stretch. When a report opened, the numbers in the Top 5 lists stretched across the row before snapping back. They now fade in where they belong.
• Clearer mobile screenshots. On mobile screenshots the information label could cover the element it described, and some were zoomed out unnecessarily. The label now always sits in its own band below the page.
• Report keyboard and screen reader fixes. Severity groups that can be dragged now also have Move up and Move down buttons, screenshot links in tickets open with Space, filter changes are announced, tab names read clearly, for example "Critical, 3", and headings follow a clear order for screen readers.
• Smaller reports. Reports with tickets turned on no longer store each issue's details twice, so they are smaller and open faster. Reports with many screenshots also use much less memory once open.
• Printing. Printed reports now include the issue details and open sections, and the dark theme prints as dark text on white.
• Editing mode. Enable Editing now makes only the report's content editable, so buttons and links keep working and you can turn editing off with the keyboard. The button says whether editing is on.
• Narrow windows. Additional Information no longer squeezes its values into a thin column on narrow screens or when zoomed in.
• Focus and contrast. Footer links have enough contrast in the light theme, and the sticky issue toolbar no longer covers the control that has focus. Filter chips, the Move To list and decorative icons are announced correctly, and copy confirmations are read out reliably.
• Screenshots of hidden elements. Screenshots of skip links and other hidden elements could show no highlight, or a highlight in the wrong place. Hidden skip links are now shown as they appear when focused, a visible instance is chosen where there is one and otherwise the element's container is highlighted with a note saying so.
• Issues without a screenshot. Issues whose elements aren't visible, or that are in the page's code, such as the viewport setting, repeated "(Screenshot N/A)" for every instance. Each issue now shows one line explaining why there is no screenshot.
• Page counts. Severity groups and Affected Pages could count only the first 50 pages of an issue, and issues on more than 2,050 pages were still under-counted. They now count every page, and Affected Pages says how many are listed, for example "50 of 320".
• Instance examples. Issues found on many pages could keep examples from only the first few pages, or from only one viewport. Examples are now spread across pages and viewports, the example with the screenshot is always kept and screenshots no example uses are no longer saved in the report.
• Skipped Pages layout. The breakdown listed every reason, including ones with unique web addresses, above the category buttons. Similar reasons are now grouped, the most common are shown with the rest totalled and the breakdown is in a Breakdown by Reason dropdown below the category buttons.
• Instance lists in tickets. For pages whose instances weren't kept in the HTML report, Download Instance List (CSV) said only that the details weren't retained. It now points to the companion CSV report, which lists every instance, and the file starts with the same confidentiality and disclaimer lines as other CSV reports.
• Crawl errors on phones. Long error messages made the report scroll sideways and hid the Hide button. Messages now wrap and no longer repeat the page address.
• Report wording. Large numbers now have thousands separators, raw tags such as "WCAG 412" are no longer shown next to the success criterion, screenshot labels no longer use nested brackets and the Skip button no longer appears for a single error. Severity groups, Crawl Errors and Skipped Pages are easier to navigate with a screen reader.
• CSV reports could be empty. The companion CSV, and the CSV made when a large report falls back from HTML, could come out empty or incomplete. Reports are now only saved once complete.
• Your edits did not reach exports and saved copies. Moving, approving, hiding or removing issues did not update tickets, CSV and JSON exports, Quick View, Issue Overview or saved copies, and changing filters brought hidden issues back. Your changes now carry through everywhere.
• Tickets fixed. The first manual ticket stayed on "Loading steps", manual tickets showed the previous ticket's screenshots and View Ticket could open several times. These are fixed.
• Keyboard and focus in reports. Tab could get stuck in the ticket window, Escape in a screenshot also closed the ticket and removing a filter removed two. After you hide, approve, move or remove an issue or remove a filter, focus now moves to the next issue and the change is announced.
• Screen reader fixes in reports. Quick View and filter names were read with codes such as "ampersand quot", ticket messages were often not announced and Passed Checks was announced as collapsed when open. These are fixed.
• Summary and Passed Checks accuracy. Passed Checks could list rules that also failed, and the most common problem was based on only five issues. Both are fixed, and the heading now reads "Top 5 Issues by Severity and Instance Count".
• Evidence screenshots overwrote each other. Screenshots from different pages could share a file name and replace each other. File names are now unique.
• Other report fixes. All instances of an item can now be shown when there are more than 24. The large report warning now appears. Light mode focus styles are corrected. Closing search clears its filters. Go to full details works for manual issues, and the Environment section shows newer macOS versions.
• Clearer focus in reports. The focus outline is now black in light mode and white in dark mode on every control. Skipped Pages, Passed Checks and Affected Elements & Instances had no visible outline, and outlines on Top Issues & Pages, View Ticket and Move To were partly cut off.
• Counts after editing. Group headings kept their original counts after Hide, Move To or Approve, and the Accessibility Issues Found heading showed no count. Both now stay up to date.
• Saving while searching. Save & Download HTML with a search or filter active saved the filtered counts. The saved copy now always contains the full report.
• Contrast ratio in tickets. Tickets for contrast issues showed the required ratio instead of the measured one. They now show the actual contrast ratio.
• Hidden manual issues in JSON exports. Manual issues you had hidden were still included in Export as JSON. They are now left out.
• Screenshots of embedded content. Screenshots of issues inside embedded frames, such as video players, were saved without the issue overlay. They now include it.
• Reports with no scanned pages. When no pages could be scanned, the report said the site had no accessibility issues. It now says no pages could be scanned and points to Skipped Pages.
• Empty Needs Review tab. After every Needs Review or LLM Review item was approved or removed, an empty Needs Review tab could come back when changing tabs. It now stays hidden.
• Reports when the disk is full. If the HTML report could not be saved, the scan ended with an error even though the CSV report was saved. It now finishes with the CSV report.
• Screenshot file names. Page titles starting with a dot or containing hidden characters could give invalid or hidden screenshot files. They are now named safely.
• Code snippets showed the scanner's own changes. HTML snippets could include styles and attributes added by Octopus during the scan. They now show the page as published.
• Missing reports folder. If the reports folder was deleted during a scan, the report was lost. It is now recreated and the report saved.
• Pages that could not be saved. If some page results could not be saved, the scan still said it was complete. It now says how many pages are missing.
• Report structure. Fixed a layout error in the report header and the structure of the Affected Pages list in tickets.
• Selected severity tab. The selected severity tab now has a clear outline, which also shows in high contrast modes.
• Screenshot buttons and voice control. Screenshot buttons now work with voice control by their visible names.
• Text cut off in narrow windows. The Top Issues and Pages lists and the severity headings no longer cut off text in narrow windows.
• Saved copy titles. Saved copies of a report now keep the site name in their title.
• Move To. Moving an issue to another severity didn't update the severity on its card, and on Windows the arrow keys moved it straight away. The card now updates, and with the keyboard the move happens when you press Enter or leave the list.
• Export as CSV. It kept only the first 200 skipped pages and left out manual issues and How to Fix. It now includes everything, uses the same columns as the companion CSV and notes any rules whose matches were sampled. The companion CSV now includes manual issues too.
• Highlights in dialogs. Issues inside dialogs and pop-ups had no visible highlight or issue panel in their screenshots. Both now appear on top.
• Pages left as they were. Taking a screenshot could leave the page scrolled or focused differently, which could change later screenshots. Both are restored after each one, and Per Issue Type screenshots try the next element if the first can't be captured.
• Screenshots in a separate folder. Screenshots saved beside the report didn't show if the page title contained # or %, and reports switched to a separate folder at about half the intended number of screenshots. Both are fixed.
• Issues listed twice. An element could appear both as a confirmed issue and in Needs Review after a pop-up was dismissed, and Deep Scan could list collapsed-state issues again after every interaction. Each element is now listed once.
• Needs Review screenshots. A Needs Review screenshot taken in a second viewport didn't show, and its download name didn't match the file. Both are fixed, and Needs Review items are no longer counted in the scan's issue total.
• Review priority instead of a percentage. Needs Review items showed a percentage labelled as the chance the issue was real, but it only reflected how serious the issue would be. They now show a High, Medium or Low review priority, and tickets show Review Priority only for Needs Review items.
• Approving a Needs Review item. Approving an item for a rule that already had a confirmed issue counted the rule twice, in the heading, summary and Top 5 Issues by Severity and Instance Count. The approved item now sits beside the confirmed one, marked as approved from Needs Review, the rule is counted once everywhere and Top 5 Pages with Most Issue Types no longer counts Needs Review items.
• Best practice and WCAG links. Best practice issues are now labelled as such, and issues under 1.4.6, 2.2.4 and 2.4.9 now link to their Understanding document.
• Saved copies. The integrity hash in a copy saved with Save & Download HTML is now labelled Original SHA-256, because it describes the report the copy was made from.
• Saved copies work wherever they were saved. A report saved with Save & Download HTML while it was open in the app could not run its buttons or dropdowns when opened later. Saved copies now work in any browser.
• Screenshots inside frames. If a frame hadn't loaded, a screenshot could show a matching element from the main page instead. The screenshot is now left out.
• Scans that stopped early. When a scan stopped early, because the app was closed, memory was nearly full, the browser couldn't be restarted, no page finished for 30 minutes or an error stopped the crawl, the report could be labelled complete or say it was stopped manually. HTML, CSV and JSON reports now say Scan stopped early with the real reason.
• PDFs checked count. The report header counted PDFs that couldn't be read as checked. It now counts only the ones that were checked.
• Screenshot size check. A screenshot reused across many pages was counted once per page, which could wrongly move screenshots to a separate folder. Each file is now counted once.
• Report and completion messages. The message after a scan no longer mentions a CSV report that wasn't made. The CSV fallback message no longer promises a change in future scans, and the no-screenshot note no longer always blames hidden elements.
• Skipped PDFs after a browser crash. Excluded PDFs and PDFs over the limit were labelled as stopped by the browser crash. They now keep their own reason.
• Hostile pages can't break a report. A scanned page could stop the whole report from building or fill your disk. Results from scanned pages are now checked and limited.
• One failed page no longer hides Passed checks. If axe-core couldn't finish on one page, the whole Passed checks section disappeared from the report. That page is now left out of the passed checks instead.
• Deep Scan viewport names are tidy. Viewport names for Deep Scan results no longer end in a stray space in CSV and JSON reports.
• Passed checks are accurate. A rule with Needs Review items is no longer also listed as passed on every page.
• CSV reports include errors. Pages that weren't fully scanned and PDFs that couldn't be checked now appear in CSV reports, as they already did in HTML and JSON.
• Large HTML reports keep their screenshots. Instances with screenshots are kept when long issue lists are trimmed, so the Download All Screenshots count matches the report.
• PDF notes are correct after a browser problem. PDFs left unchecked because the browser stopped now say so, instead of saying they were sent for checking.
• Cancel doesn't hide a real error. Cancelling after a scan has already failed no longer replaces the error with Cancelled.
• Screenshots download after a recovered scan. When a scan stops with an error and the report is built from the pages already scanned, Download All Screenshots now counts the screenshots correctly.
• Copying tickets. Copy Ticket Content and Copy Steps in reports dropped every lowercase "s". They now copy the text exactly.
• Saved copies with manual issues. Saving a report that had manual issues could lose their severity groups in the saved copy. They are now kept.
• Hidden skipped pages. Skipped pages you hide are now left out of Export as CSV, and the filter counts update straight away.

Interface

• Calmer progress. The live view now fades smoothly between frames instead of flickering, skips blank frames while pages load and says when PDFs are being checked, Local LLM Review is running or the report is being built. The progress bar shows just the percentage, such as 45%, and only when you point at it or move keyboard focus to it, while screen readers still hear the progress.
• More time to sign in. A Login URL scan now waits up to 20 hours for Confirm Login is Complete, so take as long as you need. Closing the sign-in window, or finishing early while waiting, is noticed straight away and the message gives the right reason.
• Progress is announced. Screen readers now hear scan progress every 10% or every minute, wherever focus is.
• Keyboard and screen reader fixes. Buttons and expandable sections are announced by their visible names, scan results are announced once, long dialog text can be scrolled with the keyboard and the Folders menu closes when focus leaves it. Scan start errors are announced, the welcome heading is a real heading, focus moves to Cancel when a parallel scan starts and dimmed settings and the address placeholder meet WCAG contrast.
• Zoom and motion. The Persistent Session note no longer cuts off text on narrow screens, and a Pause animation button next to the progress bar stops its moving stripes and remembers your choice.
• Smoother during scans. The interface does less work on each progress update and log line.
• Failed scans did not say why. The reason was only announced to screen readers. It now appears in the activity log, the progress label reads Error, Cancelled or 100% and failed scans no longer show a Scan Complete notification.
• Scan blocked by a hidden error. A problem with a setting only shown in Show All Settings stopped the scan with no message. Show All Settings now opens so the error can be seen.
• Scan controls could get stuck. Cancel could leave the screen waiting, Finish Early and Confirm Login could not be retried after an error and Continue could start two scans. These controls now behave correctly, and Clear Session and Record Journey are unavailable during a scan.
• Recordings could lose the journey. Starting a recording cleared the journey too early, a failed Finish could not be retried and recordings over 30 minutes were discarded. Recorded steps are now kept, Finish can be retried and recording errors give the real reason.
• Keyboard focus. Focus is no longer lost when starting a scan, confirming a login, moving journey steps, turning off User Journey, deleting a report or loading a configuration. Enter now works on Setup's buttons and no longer finishes Setup from one of its choices.
• Screen reader announcements. Pause, Resume, lost connections, Clear Session and rule search results are now announced, the memory warning only when it changes and journey steps are read with their step number. Buttons such as Finish Early & Scan and Cancel Scan announce their state clearly.
• High contrast and zoom. Focus outlines now show in Windows high contrast themes, the selected option in switch-style settings such as Screenshot Mode now has a clear outline that also shows in high contrast modes and dialogs now scroll at high zoom instead of cutting off their buttons.
• Report list and journey failure screenshots. Searching the report list now matches the names and dates it shows. When a journey fails, the app now says where its screenshots are saved.
• Wording fixes. Setup, the Sitemap XML URL hint and several messages and labels have been corrected so they describe what the app actually does.
• Connection Lost broke the progress bar. After a lost connection, the progress text stopped updating until the interface was reloaded. It now recovers.
• Missed screen reader announcements. Status messages were not announced when no scan was showing. They are now announced at any time.
• Scan start errors. If a scan could not start, the reason only appeared in the activity log. It now appears by the scan buttons, and focus returns to Start Scan.
• Imported journey steps. Some imported user journey steps showed [object Object] or undefined in their fields. They now show the saved values.
• No Pages Could Be Scanned shown by mistake. Interactive Mode sessions that produced a report, and scans of PDFs only, ended with No Pages Could Be Scanned. They now end with Scan Complete, and an Interactive Mode session with nothing scanned says No Pages Were Scanned.
• Pause while the report is being built. Pause could be selected while the report was being built, but had no effect. It is now unavailable during that stage and says why.
• Pause and Resume. Reloading the interface during a paused scan showed Pause instead of Resume, and Pause came back after Finish Early. Both are fixed.
• Journey step addresses. Adding a journey step with an empty address locked its field. It now stays editable until a valid address is entered.
• Configurations with Interactive Mode. Loading or importing a configuration with Interactive Mode on left the journey controls and Record Journey enabled. They are now disabled.
• More focus and announcement fixes. Focus is no longer lost after Finish Early, starting a recording, the manual login prompt or a lost connection, and configuration messages are announced when the settings panel is closed.
• Cancel while the report is being built. Cancelling while the report was being built still saved the report. Like Pause, Cancel is now unavailable at that stage and says why.
• Reloading during report building. Reloading the interface or opening a second window while the report was being built made Pause and Cancel available again. They now stay unavailable.
• Clearer borders in dark mode. Text boxes, lists and tick boxes now have clearer borders in dark mode.
• Progress bar easier to see. The scan progress bar now uses a stronger blue in dark mode and is easier to see in high contrast modes.
• Crawl Options with sitemaps and URL lists. Crawl Options were greyed out when scanning a sitemap or Scan Specific URLs, although most of them still applied. Now only Max Crawl Depth and Advanced Link Discovery are greyed out. Parallel Processing is unavailable with a Login URL, User Journey or Persistent Session, because those scans run one page at a time.
• Clearer messages. Messages about settings, journey steps and saved configurations now say what to enter, such as "Enter a Login URL starting with http:// or https://, or leave it blank.", and number settings are checked before the scan starts. When the scanner doesn't respond, messages now point to Restart Scanner.
• Why no pages were scanned. When no pages could be scanned, the result now says when the site needs a sign-in or refused access.
• Progress stuck at 0%. The progress bar stayed at 0% during User Journeys and scans of fewer than five pages, and never showed Paused. It now moves and shows when the scan is paused.
• Lost connections. With Parallel Processing, the message suggested resuming with a button that wasn't available, focus was lost when the connection came back, it was announced as resumed when it hadn't and reloading the interface lost the paused state. These are fixed.
• A recording left open. If a recording was still open, for example after reloading the interface, a new recording was refused. Finish Recording now appears so you can collect its steps.
• Crawl Page Timeout. Values under 1 second were quietly replaced with the default. The field now asks for at least 1,000 milliseconds.
• Progress jumped around. On the first page of a crawl, and on small sites, the progress bar could jump to about 86% and then drop back. It now moves forward steadily.
• Pause, Resume and lost connections. Resuming during a lost connection left the paused message on screen, parallel scans showed a Resume button that didn't work and pausing could move focus while you were elsewhere on the page. These are fixed.
• Reloading the interface. After a reload, Finish Early and Pause could be offered again after Finish Early had been requested, progress while the report was being built showed too low and a scan paused by a lost connection showed Pause. These are fixed.
• Smaller interface fixes. Pause now says when the scan hasn't started yet, and its unavailable message mentions the Local LLM Review. Focus returns to Start Scan after cancelling while the previous scan stops. Memory warnings no longer repeat or mention CSV for CSV and JSON scans, the CSV fallback is announced and screen readers no longer hear a failed scan as 100% complete. Single-page and local file scans now count the page as crawled in the live stats, and saving a configuration without a valid name moves focus to the name box.
• Progress from the first page. Single-page scans, a single Specific URL and Interactive Mode showed 0% until the report was being built. Progress now moves from the start of every scan.
• Interactive Mode with journey steps. Interactive Mode could refuse to start because of User Journey steps it doesn't use. They are now ignored.
• Importing a file that isn't a configuration. Importing any other JSON file reset every setting and said it had worked. It is now refused and nothing changes.
• More message fixes. Errors such as choosing a folder instead of a file were wrapped in technical wording, and the robots.txt warning appeared for local file scans. A lost connection was announced twice and Resume was offered after Finish Early. Start Scan disappeared after signing in and failed pauses weren't announced. These are fixed, and an empty report list now says there are no reports yet.
• Waiting for the previous scan. The interface now says when it is waiting for the previous scan to stop, keeps waiting beyond 30 seconds instead of showing a rate limit error and returns to 0% afterwards. Cancel during the wait no longer shows an error or starts a scan only to cancel it.
• More announcements. Screen readers now hear when Resume, Finish Early, Cancel or the sign-in confirmation fails. They also hear when a report is deleted and when a reattached scan is paused by a lost connection. Messages for an engine restart or too many requests are clearer, and "failed" no longer appears twice.
• When the engine doesn't respond. Pause, Resume, Finish Early & Scan and Cancel Scan now say clearly that the engine didn't respond, and a blocked cancel is announced.
• Cancel can't be sent twice. Cancel is now unavailable while a cancel request is being sent.
• Engine errors give their reason. When cancelling a scan or signing in fails, the message now shows the reason the engine gave.
• Pause and Resume stay correct after a scan ends. A late reply to Pause or Resume could change the buttons after the scan had ended, so the next scan started showing Resume. Late replies are now ignored, and a new scan always starts with Pause.
• Cancelling a scan the engine has already dropped is announced. The progress label now says Cancelled and screen readers hear it.
• Cancelled scans don't say Finished. Total Duration now says Cancelled or Stopped, and the report size says No report, when a scan didn't make a report.
• Reconnecting to your own scan is described correctly. After the connection drops, starting again now says it reconnected to the running scan instead of blaming another window.
• Pause errors are worded once. A failed pause no longer says "failed" twice.
• Focus returns after a failed action. Keyboard focus now goes back to Record Journey or Delete when they fail.
• Focus stays where you are when a scan ends. The report link is only focused if you weren't using another part of the interface.
• The progress label is easier to read. It now sits on its own background, so it keeps strong contrast as the bar fills.
• Reset really resets. Reset now loads the default settings instead of your saved default configuration.
• New risks bring back the pre-scan warning. After "Continue and don't show this again", the warning appears again if you turn on a setting it hasn't covered, such as Local LLM Review.
• Resume stays available after a failed Finish Early. If Finish Early fails on a paused scan, Resume is shown again instead of Pause.
• Calmer screen reader announcements. The progress bar has a fixed name with its state as its value, the activity log no longer reads every new line while focused, paused and resumed are announced once and setup hints are read once.
• Clearer journey and form controls. Adding a Scan Page step is announced and focuses the new step, the Axe Tags error is linked to its group and labels of option buttons move focus to the selected option.
• Pause and Resume errors. Errors now only show for the current scan, and the progress label no longer wraps out of view on narrow windows.
• Scan Behaviour with Parallel Processing and journeys. Scan Behaviour was switched off while Parallel Processing was on or a User Journey had steps, although those options still apply. It now stays available.

Settings

• Imported settings did not restore defaults. When a configuration was missing a setting, options such as Stealth Mode, Screenshot Mode and Navigation Timeout could end up wrong, and fields were filled with example text. Missing settings now return to the defaults of a fresh start.
• Settings saved as off by mistake. Saving, loading or running Setup while another option had temporarily turned settings off stored them as off, and switching the report format away from HTML and back left screenshots off. Your real settings are now kept.
• Settings checked before scanning. Device presets without a device, custom devices with an invalid size and Press Key steps without a key are now flagged before the scan starts.
• Other settings fixes. The viewport preset is saved with each report's settings, and Keep Display Awake now only appears with Idle Screen, which it needs to work. A Wait for Time of 0 no longer waits half a second.
• Settings saved as off with Parallel Processing. With Parallel Processing on, Adaptive Networking and Periodic Browser Restarts were saved and exported as off. Your real settings are now kept.
• Wait settings carried over. Loading a configuration kept the Wait Before Scan time or selector from the previous one. Each configuration now loads its own values.
• Clearer import errors. A configuration that could be read but not fully applied was reported as failing to parse. The message now says some settings could not be applied.
• Loading a configuration is reported truthfully. Load Selected now only says the configuration was loaded once every setting has been applied, and says so if it couldn't be. If the default configuration can't be loaded, a message now says so.
• Saved configurations keep every emulation setting. Saving or exporting a configuration now keeps the viewport preset, device preset and custom device values even when a different emulation mode is in use.
• Greyed-out settings. A Login URL, sitemap or list of addresses left in a greyed-out field could still affect a scan. Only settings that apply are now used.
• Starting a scan from the address field. Pressing Enter in Website URL now starts a scan, settings are checked before the Before you scan message appears, and focus is no longer lost in several more places.

Mac and Windows Apps

• Warnings shown as warnings (Mac and Windows). Engine warnings in System Activity now show as warnings instead of errors.
• Clearer log file name (Mac and Windows). Export Activity Logs now suggests the name Octopus Logs for the saved file.
• Developer link (Mac and Windows). The developer's name under Crafted from the deep by now opens the About the Maker page on OctopusScanner.com instead of LinkedIn.
• Local network help (Mac). If macOS blocks Octopus Scanner from your local network, Local LLM Review connection errors now explain how to allow it in System Settings > Privacy & Security > Local Network.
• Clearer focus in High Contrast (Windows). Switches that are on, selected options, primary buttons and selected log rows now show a visible focus outline in contrast themes.
• Badge contrast (Mac and Windows). The Security fix, update and advisory badges now have enough contrast in the light theme.
• Preferences double-clicks (Windows). Clicking quickly between Preferences pages could leave two pages showing or flip a switch on the new page. It no longer does.
• App updates close the app for Setup (Windows). After downloading an update, Octopus Scanner closes itself so Setup can replace it, unless a scan is running, and Setup no longer warns that the app is still running.
• Contrast (Mac). The Reset button in the dark theme now has enough contrast.
• Confirm dialogs (Mac). Reset and Quit confirmations now put focus on Cancel, Escape cancels and controls behind the dialog can't be reached.
• Achievements keep your place (Mac). After an achievement message closes, focus returns to the scanning interface, and the message says Escape dismisses it.
• Interface recovers from repeated crashes (Mac). If the interface stops working several times in a minute, the app asks before reloading it again.
• Smaller download (Mac). Files the app never uses are left out, making it about 25 MB smaller.
• Preferences navigation (Windows). Opening a Preferences page now moves focus to it, Back returns to where you were and the dialog is announced as Preferences.
• Visible focus (Windows). The activity log, menus, switches, segmented buttons and dialog buttons now show a clear focus outline, including in High Contrast. Scroll bars and progress bars follow High Contrast colours, and scroll bars are easier to see.
• Larger text (Windows). The Server Port box and download status text no longer cut off at larger text sizes.
• Button hover contrast (Windows). Primary buttons keep enough contrast when hovered in the dark theme.
• Interface focus (Windows). The interface window puts keyboard focus in the page when it opens.
• Mac installer window. The installer now shows an arrow from Octopus Scanner to the Applications folder, so it is clearer how to install the app.
• Scanner state after it stopped (Mac and Windows). If the scanner crashed or was stopped, the app still showed a scan in progress and kept Open Interface available. On Windows, the interface window also stopped working after a restart. These now reset, and the window reconnects.
• Component updates could break the scanner (Mac and Windows). Patching again, reverting or quitting during an install could remove files the scanner was using. The folder in use is now kept, Revert waits until an install finishes and quitting asks first. A broken Node runtime update is now correctly rolled back.
• Interface window failed to start (Windows). The app always blamed the WebView2 Runtime and offered no other way in. It now offers to open the interface in your web browser.
• Downloads could lose files (Mac). Replacing a file deleted it before the download began, and closing the interface window mid-download left a hidden partial file. Downloads now complete safely.
• Quit and restart (Mac and Windows). The quit confirmation could be hidden on Mac, Cancel on quit removed the tray icon on Windows and Restart could fail to reopen the app. These are fixed.
• Offline Mode (Mac and Windows). Offline Mode now clears update notices, and the offline screen appears when there is no connection.
• Shut Down After Scan and Idle Screen (Mac and Windows). The Idle Screen no longer hides the shutdown countdown, takes focus from your other apps or says a report is ready when the scan was cancelled, and on Windows it no longer covers full-screen presentations. It also uses less energy.
• Tray icon and Open At Login (Windows). Clicking the tray icon now brings the window forward, and right-clicking offers Show Octopus Scanner and Quit. Open At Login now starts the copy you are using.
• Windows display fixes. Text is now readable in contrast themes, the title bar follows light and dark mode, the window redraws sharply on another display and theme changes no longer close open screens.
• Windows screen reader fixes. Buttons and links are recognised correctly, activity log entries are read as their message and the Quit and Reset confirmations read their warning, with Reset starting on Cancel.
• Mac fixes. VoiceOver can no longer reach hidden Preferences, screen titles are headings, Escape closes the legal sheet and the status bar is easier to read. Export Activity Logs includes the whole session, including the earlier part of a long log, and File > New Window, which opened a second console, has been removed.
• Choosing files on Mac. Import File did nothing in the Mac app. It now opens the file window as expected.
• axe-core shown as out of date. Update Dependencies could report axe-core as out of date even after the accessibility engine update had installed the latest version. axe-core is now updated only through the accessibility engine update, and the messages on the patching screens are centred.
• Security advisories for axe-core. Advisories about axe-core now point to the accessibility engine update with Review Engine Update, and are no longer raised for an older copy the scanner isn't using.
• Clearer first start after an update (Windows). The startup screen now says it is updating to the new version and setting up its components, instead of only "Starting Node".
• Update offers straight after an update. Component and engine updates could be offered for versions the new release already includes. Offers now wait until the new version is set up, and an older downloaded engine is no longer used in place of a newer one built into the app.
• Idle Screen stuck at 0:00. After the pages were scanned, the Idle Screen sat at 0:00 while the scan carried on. It now shows what the scan is doing, such as Checking PDFs or Building the report, with a time estimate for PDF checks once one is available.
• Mac and Windows fixes. The Shut Down After Scan countdown now comes to the front on Mac, quitting during a component update asks first on Mac, the Idle Screen says when a scan was cancelled, update screens no longer get stuck on "Checking" on Windows and the main buttons on Windows are now recognised by screen readers and voice control.
• Reset Data and logs (Windows). Reset Data now deletes the activity and crash logs, as it says.
• Reset Data during updates (Mac and Windows). Reset Data could run while a component update was installing. It now asks you to try again when the update finishes.
• Component update screens (Windows). After accepting the licences, the previous screen briefly flashed before the download screen. It now goes straight to the download.
• Accurate messages (Mac and Windows). The Reset confirmation lists everything it deletes, and the failure and update screens now show the component versions and settings actually in use.
• Opens on more versions of macOS (Mac). The previous version only opened on the newest macOS. It now runs on macOS 14 (Sonoma) or later.
• Screen readers and contrast (Mac and Windows). Update, offline and startup screens now announce themselves and have proper headings, low-contrast grey, orange and red text now meets WCAG contrast and the Shut Down After Scan countdown is announced and can be cancelled with Escape.
• Consistent update screens (Mac and Windows). Update, component and setup screens now share one centred layout and background, with the main button on the right and the antivirus note centred.
• Blank interface window (Mac). If the interface window's web content stopped, the window stayed blank until the app was restarted. It now reloads.
• Return key on update screens (Mac). Return now selects the main button on the app update, engine update, component update and other update screens.
• Startup notice could hang (Windows). If the scanner could not start, the startup notice kept saying it was opening. It now shows that it failed.
• Escape on Dependency Patching (Windows). Escape now closes the Dependency Patching screen, as on the Node Runtime screen.
• Shut Down After Scan (Mac). The quit prompt could stop your Mac from shutting down after a scan. It now shuts down as expected.
• Quitting during component updates (Mac). Quitting during Dependency Patching or a Node Runtime update left the install running in the background. It now stops.
• Reset Data (Mac). Reset Data now deletes every activity log and crash report, as it says, and after using Offline Mode it no longer shows the offline screen.
• Dependency Patching failures (Mac). If the update could not be recorded, Dependency Patching still said Patch Applied. It now reports the failure.
• Fewer update checks (Mac). Closing the Dependency Patching or Node Runtime screen no longer starts an unneeded update check.
• Window size and position (Windows). The window size and position are now remembered however you quit or restart, and restoring from the tray brings back a maximised window.
• VoiceOver and Reduce Motion (Mac). VoiceOver labels now match the visible button text, including Reset Data, and Reduce Motion is respected on more screens.
• Quitting with the Terms window open (Mac). Quitting while Terms and Conditions or Third-Party Licences was open left the app open with the scanner stopped. It now quits.
• Shut Down After Scan (Mac and Windows). The countdown now comes to the front so it can be cancelled, keeps keyboard focus while it is showing, a cancelled shutdown no longer skips the quit prompt later and Cancel returns focus to where it was.
• Component updates (Mac and Windows). Dependency Patching and Node Runtime can no longer interfere with each other, changing the waiting period or update level during a check now sticks and engine updates no longer hang on a stalled connection.
• Theme changes (Windows). Quit and Reset prompts no longer vanish when the Windows theme changes.
• Non-English Windows. Text size settings and update dates are now read and saved correctly on systems with other number and date formats.
• Moved reports folder (Windows). Reports open again when the reports folder has been moved to another drive with a folder link.
• Faster start-up (Mac and Windows). Octopus Scanner now runs its update and safety checks at the same time instead of one after another, so it gets past the start-up screen sooner, and the Mac app checks component updates faster.
• Interface settings folder (Windows). The scanning interface's settings, such as saved configurations, are now kept in the app's data folder instead of beside the app, and existing settings are moved over automatically.
• Reset Data clears the interface (Mac and Windows). Reset Data now clears everything the scanning interface has saved straight away, including saved configurations and Local LLM Review settings with any API key.
• Updates offered for a version you were installing (Mac and Windows). After downloading a new version of Octopus Scanner, the app went on to offer engine and component updates that the new version already included. These notices now wait until the new version opens, so only newer versions are offered. If you skip an app update, the notices say it may already include them.
• Security advisories after patching (Mac and Windows). After Dependency Patching, the result could say an advisory was still present when it wasn't, because it checked a planned list rather than what was installed, and counted axe-core even when an engine update had replaced it. It now checks the installed components, says which advisories the patch fixes and which still apply and runs the Component Safety Check again straight away.
• Update offered before it could be downloaded (Mac and Windows). A new version could be offered as soon as it was listed, before its signed download for your system was available, so Download Update then failed. A new version is now only offered once its signed download can be verified.
• A failed scan looked like it was still running (Mac and Windows). After a scan failed with an error, the app kept the computer awake, said a scan was in progress when quitting and the Idle Screen kept showing it as scanning. The app now recognises the failure.
• Leftover browser processes (Mac and Windows). If the app crashed or was force quit, or the engine crashed, the engine's browser could keep running in the background and using memory. It now closes.
• Restart, shut down and log out (Mac). While the engine was running, Octopus Scanner asked for confirmation and stopped your Mac restarting, shutting down or logging out. It now quits without asking. Quitting also no longer freezes the window while the engine stops, and the last lines of the activity log are saved.
• Two copies at once (Mac). Opening a second copy could stop the first one's engine in the middle of a scan. Opening the app again now brings the open copy forward.
• Zoom in the scanning interface (Mac). The scanning interface couldn't be zoomed. Zoom In, Zoom Out and Actual Size are now in the View menu, with their usual keyboard shortcuts, and you can pinch to zoom.
• Theme and Open At Login (Mac). Theme now applies to the app's other windows and dialogs too. Open At Login no longer switches itself off while macOS waits for your approval.
• Mac wording. The update screen now says to quit Octopus Scanner before replacing it, the Uninstall Guide mentions turning off Open At Login and links that open in your browser now say so to VoiceOver. The folder permission prompts explain that Octopus Scanner needs to read its own files, Open At Login says it opens when you log in, Shut Down After Scan says it applies until the app closes and VoiceOver announces the Terms screen.
• Screen reader announcements (Windows). Narrator and NVDA read the same fixed label instead of the actual message for status announcements. They now read the message.
• Keyboard focus (Windows). Focus was lost when Preferences pages refreshed or the theme changed, a theme change closed any open dialog and the update screen gave no starting focus. These are fixed.
• Windows on more than one display (Windows). The main window could reopen off screen or larger than the display, and the scanning interface always opened on the main display. Both now open on the display the app is using.
• High contrast (Windows). Secondary buttons had no visible edge, and confirm buttons used fixed colours. They now follow your high contrast theme.
• Starting at login (Windows). When Octopus Scanner started at login before the network was ready, the engine waited at a hidden screen and never started. It now starts straight away.
• Engine crashes (Windows). When the engine stopped unexpectedly, it stayed stopped until you restarted it. It now restarts by itself, up to three times in 10 minutes. If the interface window's browser stops working, it reloads or offers to open the interface in your web browser.
• Settings and Reset Data (Windows). If saved settings couldn't be read, the app replaced them with defaults. It now leaves them unchanged. Reset Data also clears the saved window size and position.
• Busy computers (Windows). The engine ran at high priority, so heavy scans could slow down other apps. It now runs at above-normal priority rather than high.
• Update notice wording (Mac and Windows). The notices for dependency and Node.js updates said they had passed safety checks, but those checks run when you install. The wording now says so.
• Notices after an app update you didn't install (Mac and Windows). If you downloaded an app update but didn't install it, engine and component notices stayed hidden until you reopened the app. They now come back after six hours.
• Safety check after Revert (Mac and Windows). After reverting Dependency Patching, the Component Safety Check kept showing results for the patched components. It now checks again.
• A second copy on Mac (Mac). Opening a second copy, for example from the update's disk image, could undo the open copy's component patches or delete an update download before it quit. It now quits before changing anything.
• Starting, resetting and quitting (Mac). Reset Data while the engine was starting could leave a second engine running, a cancelled logout or restart could later let the app quit mid-scan without asking and the last lines of the activity log could be lost when quitting after the engine had stopped. These are fixed.
• Zoom and Open At Login (Mac). Zoom now says when the scanning interface isn't open, Reset Data resets the zoom level and Open At Login says when it is waiting for your approval in System Settings.
• Interface window recovery (Windows). A graphics driver reset could replace a working interface with an error screen, and repeated crashes over a long session stopped recovery. The window now shows the error only when it can't recover, and says that it stopped working rather than that it couldn't open.
• Crash recovery messages (Windows). After a crash loop the scanner was still restarted, and an automatic restart that couldn't run said nothing. Both are fixed, and a failed scan is now announced.
• Focus and windows (Windows). After a theme change, focus moved to the screen's default button. Windows opened from the interface appeared on the main display, and the window size cleared by Reset Data was saved again when quitting. These are fixed, and Preferences no longer refresh on every update progress step, which disturbed screen readers.
• Achievements could be lost (Windows). If the achievements file couldn't be read or was damaged, achievements stopped saving and the file could be overwritten. It is now left alone, and achievement dates read correctly whatever your regional settings.
• Interface window errors (Windows). While the window was stuck, its error screen was rebuilt every few seconds and screen readers heard the wrong message. Recovery also stopped after three crashes in a long session. These are fixed.
• Node runtime screens (Mac and Windows). Being already up to date showed as a failure, and after an update the same version could be offered again. On Windows, a Node.js setting on your computer could also make the runtime update fail. These are fixed.
• Dependency Patching and startup (Mac). After updating only the Node runtime, Advanced said patches were being reverted. A late update notice could send you back to Finish Installation, and Quit & Move quit without asking during a scan. These are fixed.
• Smaller Mac fixes. Shut Down After Scan no longer stays armed after a cancelled shutdown, and a false Permission Required notice no longer replaces The scanner has stopped. Zooming a pop-up window no longer changes the interface's saved zoom, Open At Login updates after you approve it and exported logs use one format.
• Removed versions offered as updates (Mac and Windows). Versions removed from npm or marked deprecated could be offered on Dependency Patching and then fail to install. They are no longer offered.
• Restart Now during a scan (Mac). Restart Now quit straight away, even mid-scan or while an update was installing. It now asks first.
• Mac announcements. VoiceOver now hears when the scanner stops unexpectedly, when macOS needs permission and when a runtime update has nothing to do. Crash dumps also include the engine's last messages.
• Windows fixes. The interface error screen didn't take focus or announce itself. Node Runtime now says when a restart is needed and no longer shows an up-to-date runtime as failed. Its Revert button has its own name, so focus can't land on the wrong Revert, and a crashed embedded frame no longer reloads the whole interface.
• Dependency Patching wording (Mac and Windows). The screen now describes its checks and what Revert restores accurately.
• Update screens after changes (Windows). After patching, reverting or updating the Node runtime, the update screens could offer the same updates again. They now check again.
• Checking for component updates (Mac and Windows). Startup appeared frozen while it checked for component updates. It now shows that it is checking.
• Advanced wording (Mac and Windows). Advanced no longer says updated components are in use before a restart, and the help text now mentions the waiting period. On Windows, Node Runtime also says when a restart is needed after Update Again.
• Windows keyboard and screen reader fixes. Tab no longer escapes the Dependency Patching and Node Runtime screens, and focus returns to the button that opened them. The Terms screen starts with focus on Agree and Continue, screens now scroll at large text sizes and achievements earned as the app opens now show their notification.
• Node Runtime update (Windows). Installing a runtime update no longer freezes the window.
• Restart Now (Mac). The confirmation now says Restart, and logging out or shutting down while it is showing no longer reopens the app.
• System programs are started from Windows' own folder (Windows). Shut Down After Scan, showing a downloaded update in File Explorer and restarting the app now start the Windows programs by their full path, so a file with the same name elsewhere can't be run instead. Restarting the app now starts it directly.
• Downloads only come from the interface (Mac). Only the scanning interface and reports can start a download in the app's window.
• Dropped addresses are tidied before scanning (Windows). A web address dragged onto the window is now normalised before the scan starts.
• Keyboard focus lands in the right place (Windows). While Node.js updates, focus now moves to the update screen. Closing a screen whose opener has gone now moves focus to the first control instead of nowhere, and screens no longer add an extra stop when you press Tab.
• The component check wait screen shows when it should (Windows). If the component check started early but hasn't finished, the wait screen is now shown instead of a blank pause.
• A typed Server Port is kept (Mac). A new Server Port is now saved when you leave Advanced with Esc or Back, not only when you press Return.
• Stopping for a malicious component isn't treated as a crash (Mac). No crash file is saved, and VoiceOver now says the scanner was stopped because a component was reported as malicious.
• Open At Login follows your last choice (Mac). Switching it on and off quickly could leave it in the wrong state. Changes now apply in order.
• axe-core updates install all or nothing (Mac). The engine file and its version record are now replaced together, so a failed install can't leave a new engine under an old version number.
• Achievement saves happen in order (Mac). A save still in progress can no longer bring back achievements after a reset.
• Achievement pop-ups survive a theme change (Windows). If the theme changed while one was showing, no more pop-ups appeared and Esc stopped working once. The pop-up now shows again after the change.
• Focus returns after Preferences when the theme changed (Windows). Closing Preferences after changing Theme now returns focus to where it was, or to the first control.
• Runtime updates are announced (Windows). Screen readers now hear the progress of a Node.js update and whether it worked.
• macOS checks the whole Mac app. The scanner's files have moved inside the app, so macOS now checks that none of them has been changed, not just the program itself. The app still isn't signed with an Apple developer certificate, so macOS warns the first time you open it, as described in the Security Warnings Guide.
• A stopped engine can't overwrite the status (Windows). Output still arriving from an engine that was stopped or restarted is now ignored, so it can't replace the current status.
• The component check doesn't blame the npm registry wrongly (Windows). If the check was restarted part-way through, the Dependency Patching screen said the npm registry could not be reached. It now runs the check again.
• A proper Windows installer. The Windows download is now a Setup file instead of a zip. Run it and follow its steps, with no extracting first.
• Install for yourself or for everyone (Windows). Setup asks whether to install for you only, which needs no administrator permission, or for all users in Program Files. Upgrades keep the choice you made before, and IT administrators can choose with /ALLUSERS or /CURRENTUSER.
• Setup follows dark mode (Windows). The installer matches the Windows light or dark setting, with sharp images at every display scale.
• Offline terms and licences (Windows). The last page of Setup and the Octopus Scanner folder in the Start menu can open the offline copies of the terms and third-party licences installed with the app.
• Setup installs what's missing (Windows). Setup installs the WebView2 Runtime if it's missing, and offers Download Google Chrome on its last page when Chrome isn't found.
• Downgrade warning (Windows). Setup warns you before installing an older version over a newer one.
• Third-Party Licences works offline (Windows). Third-Party Licences in Preferences now opens the licences file installed with the app, so it matches your version, and opens the website only if that file is missing.
• A complete Installed apps entry (Windows). Octopus Scanner now shows its website, support page, updates page, email address and a short description in Windows Settings.
• Choose whether to keep your data when uninstalling (Windows). The uninstaller asks whether to keep your scan reports, settings, preferences and saved configurations, and keeps them by default. It always removes downloaded components, caches and the Open At Login entry, and removes only the files it installed.
• 64-bit Windows only. Setup now stops on 32-bit Windows, which was never supported. PCs with Arm processors are allowed and run the app through Windows' x64 emulation.
• Patched components after an app update (Mac and Windows). When a new copy of Octopus Scanner already includes newer versions of components you had patched, the older patch is now removed when it starts, even if the version number is the same, so it no longer offers an engine update it already includes. A patch you have just applied is kept. On Mac, the update screen says when patches were removed, and the replaced files are deleted straight away.
• The Windows data folder is now called OctopusScanner. Reports, settings and downloaded components now live in a folder named OctopusScanner instead of AccessibilityScanner. Your existing folder is moved automatically the first time the new version opens, retrying if a file is still in use, and the uninstaller cleans up either location.
• Theme and High Contrast changes (Windows). Turning High Contrast on or off, changing contrast theme or turning animation effects off now redraws the window straight away, however Windows reports the change, even while Review Licences, the achievements screen or a consent screen is open, without closing it. A light or dark theme change waits until those screens close instead of closing them and losing your choices, and the taskbar no longer shows a constant busy indicator in High Contrast.
• axe-core updates install on a fresh copy (Mac). Installing a new axe-core engine no longer fails when no earlier engine update exists.
• Faster start-up with an updated Node.js (Mac). Octopus Scanner no longer runs Node.js just to check its version each time it opens.
• A failed dependency patch doesn't freeze the window (Windows). Cleaning up after a failed patch now happens in the background.
• Third-Party Licences shows your patched components (Windows). With a dependency patch installed, Third-Party Licences opens the notice for the components you are actually running.
• Updates wait for setup to finish (Windows). Dependency and Node.js updates can no longer start while Octopus Scanner is still setting up its files.
• Reset Data clears downloaded components (Mac and Windows). Reset Data now also removes patched components, an updated Node.js runtime, the npm download cache and downloaded app updates, unless an update is downloading or ready to install.

Stability and Performance

• Slow LLM servers no longer hold up scans. When the server doesn't reply within Timeout Per Request, Local LLM Review now skips that finding or page straight away instead of trying again, and says which one in the activity log. If 2 requests in a row get no reply, the review stops, explains why and keeps everything checked so far.
• Typing in Preferences (Mac and Windows). Typing numbers in Preferences, such as the server port, no longer briefly freezes the app.
• Less background work. Scans use less processing, large or complicated PDFs can no longer hold up a scan, connections to a local LLM are set up faster and the Windows app pauses CPU and memory sampling while it is hidden.
• A crashed tab could close the app. When several viewports were scanned at once and the main tab crashed, Octopus Scanner closed. The error is now caught and the scan continues.
• Disk errors closed the app. If a screenshot ZIP could not be written, for example on a full disk, the app closed. The error is now handled and the partial file removed.
• Paused scans lost their results. Paused scans with the interface window closed were removed after an hour. They are now kept until you resume or cancel them.
• Pages stuck loading. When a connection was cut off, the page being scanned could keep loading and never finish. It now ends cleanly and the scan carries on.
• Smoother long scans. The activity log no longer builds up while the window is minimised, which could make the app pause when restored.
• Temporary browser files. Temporary browser files left after a crash are now cleaned up automatically.
• Data folder that cannot be written to. If the data folder could not be written to, the scanner closed without explanation. It now says why it cannot start.
• Starting a scan straight after another. Starting a scan just as the last one finished or was cancelled could show the old scan again or damage the cancelled scan's report. A new scan now waits until the previous one has finished.
• Fewer browser restarts. A problem in one tab restarted the whole browser. Only that page is now tried again in a new tab. Scheduled restarts keep the browser's cache and cookies, and a restart that fails is retried.
• Chrome left running. Chrome could keep running after its connection was lost, and the app could try to stop Chrome processes that had already closed. Both are fixed.
• Large sites with parallel scans. After reaching Max Crawl Size, parallel scans still opened a tab for every address left in the queue. Pages are now handed to the workers a few at a time.
• Pages at the page limit. With Parallel Processing, pages already loading when the limit was reached could skip waiting for a busy website, or skip their Deep Scan. They now finish.
• Waiting for pages to settle. Pages with a background video or a cookie banner backdrop waited the full 15 seconds before scanning, and pages that redirected with JavaScript could be scanned mid-redirect. Both now scan as soon as the page settles.
• Faster Deep Scan. The extra audits Deep Scan runs after each interaction no longer repeat the dark mode check and pop-up dismissal.
• Lower memory use. Large scans no longer load every result back into memory at the end, the app keeps much less from earlier scans and HTML reports are now written in pieces instead of being built in memory all at once, so very large reports finish reliably.
• Connection checks after the crawl. A dropped connection while the report was being written could show the scan as paused. Connection checks now stop when the crawl ends, and a pause isn't offered during the Local LLM review.
• Deleting an HTML report. Deleting an HTML report removed the screenshots its JSON report still used. They are kept while the JSON report exists.
• Clear Session while a scan finishes. Clear Session could delete files a cancelled scan was still using. It now waits until the scan has finished, and a finished recording no longer blocks it.
• Browser restarts in parallel scans. If the browser crashed during a Parallel Processing scan and could not be restarted, the app could quit. The scan now finishes early with the pages already scanned. Cancelling a Parallel Processing scan also no longer starts a new browser.
• Long crawl delays. Finish Early and Cancel no longer wait out a long crawl delay. Pages interrupted during the delay are listed as not scanned instead of disappearing, and the page count no longer includes them.
• Restart straight after a crash. After recovering from a browser crash, a scheduled browser restart could follow straight away. The restart count now starts again after a recovery.
• Large CSV and JSON scans use less memory. Results are no longer loaded into memory all at once before the report is written, so very large CSV and JSON scans are far less likely to run out of memory.
• Sites with thousands of PDFs are handled safely. The list of PDFs found during a scan is now limited, so a site linking to huge numbers of PDFs can't use up memory.

Updated Components

This release includes the following updated components.

• @nodable/entities 3.0.0 → to 3.1.0
• @puppeteer/browsers 3.2.2 → to 3.2.5
• ansi-regex 6.3.0 → to 6.4.0
• axe-core 4.13.0 → to 4.14.0
• body-parser 2.3.0 → to 2.4.0
• bundle-name 4.1.0 → to 4.1.1
• chromium-bidi 17.0.2 → to 157.0.8090-0
• content-disposition 1.1.0 → to 2.0.1
• content-type 1.0.5 → to 2.1.0
• devtools-protocol 0.0.1680125 → to 0.0.1696802
• express 5.2.1 → to 5.3.0
• fast-xml-parser 5.11.1 → to 5.11.2
• fs-extra 11.4.0 → to 11.4.1
• Node.js 24.21.0 → to 26.13.0
• puppeteer 25.11.0 → to 25.14.0
• puppeteer-core 25.11.0 → to 25.14.0
• qs 6.16.0 → to 6.16.1
• string-width 8.2.2 → to 8.3.0
• strnum 2.4.2 → to 2.5.1
• typed-query-selector 2.12.2 → to 2.12.3
• user-agents 2.1.191 → to 2.1.217
• webdriver-bidi-protocol 0.4.3 → to 1.0.1
• ws 8.21.3 → to 8.22.0
• wsl-utils 1.0.0 → to 1.0.1
• zod 3.25.76 → to 4.6.6